> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AIGO Governance Domains v0.1

# AIGO — AI Governance Operating Framework

## Governance Domains

**Version:** 0.1\
**Status:** Draft\
**Working Name:** AIGO\
**Full Name:** AI Governance Operating Framework

***

## 1. Purpose

The AIGO Governance Domains define the major areas of governance through which an organization can establish, operate, monitor, and continuously improve its AI governance capability.

The domains translate the principles established in the AIGO Framework Principles into structured areas of governance responsibility.

The domains provide an organizational structure for requirements, controls, procedures, evidence, assessments, and implementation guidance.

AIGO Governance Domains are designed to be:

* technology-independent;
* risk-based;
* organization-independent;
* adaptable to different industries;
* applicable to different AI system types; and
* capable of integration with existing governance frameworks.

***

## 2. Domain Architecture

The AIGO framework organizes AI governance into interconnected domains.

The domains are not intended to represent isolated organizational departments.

A single governance activity may involve multiple domains.

The AIGO domain model is:

**Governance → Strategy → Risk → Lifecycle → Data → Security → Privacy → Human Oversight → Transparency → Operations → Third Party → Assurance → Improvement**

The domains provide the foundation from which detailed AIGO requirements and controls can be developed.

***

## 3. Governance Domain Model

AIGO defines the following governance domains:

| Identifier     | Domain                            |
| -------------- | --------------------------------- |
| `AIGO-DOM-001` | Governance and Accountability     |
| `AIGO-DOM-002` | AI Strategy and Policy            |
| `AIGO-DOM-003` | AI Risk Management                |
| `AIGO-DOM-004` | AI System Lifecycle               |
| `AIGO-DOM-005` | Data Governance                   |
| `AIGO-DOM-006` | Security                          |
| `AIGO-DOM-007` | Privacy and Data Protection       |
| `AIGO-DOM-008` | Human Oversight and Human Factors |
| `AIGO-DOM-009` | Transparency and Explainability   |
| `AIGO-DOM-010` | AI Operations and Monitoring      |
| `AIGO-DOM-011` | Third-Party and Supply Chain      |
| `AIGO-DOM-012` | AI Assurance and Evidence         |
| `AIGO-DOM-013` | AI Incident and Issue Management  |
| `AIGO-DOM-014` | AI Competence and Literacy        |
| `AIGO-DOM-015` | Continuous Improvement            |

***

## 4. Governance and Accountability

**Identifier:** `AIGO-DOM-001`

### 4.1 Purpose

The Governance and Accountability domain establishes the organizational structures, responsibilities, authorities, and decision-making mechanisms required to govern AI effectively.

### 4.2 Scope

This domain applies to the governance of:

* organizational AI activities;
* individual AI systems;
* AI portfolios;
* AI programs;
* AI projects;
* AI-enabled business processes; and
* AI-related services and capabilities.

### 4.3 Key Governance Areas

The domain includes:

* governance structure;
* accountability;
* ownership;
* decision authority;
* responsibility assignment;
* escalation;
* governance committees;
* oversight;
* management review; and
* governance documentation.

### 4.4 Expected Outcomes

Organizations should establish clear accountability for AI systems and ensure that relevant governance decisions are made by appropriately authorized individuals or functions.

### 4.5 Related Principles

This domain primarily supports:

* Accountability and Responsibility;
* Human Oversight;
* Governance Integration;
* Continuous Accountability; and
* Evidence-Based Assurance.

***

## 5. AI Strategy and Policy

**Identifier:** `AIGO-DOM-002`

### 5.1 Purpose

The AI Strategy and Policy domain establishes the organizational direction, objectives, policies, principles, and strategic expectations governing the use of AI.

### 5.2 Scope

This domain may include:

* AI strategy;
* AI policy;
* acceptable use;
* prohibited use;
* strategic objectives;
* AI investment;
* AI operating model;
* governance objectives; and
* organizational risk appetite.

### 5.3 Key Governance Areas

Organizations should consider:

* strategic alignment;
* AI objectives;
* governance principles;
* policy requirements;
* business alignment;
* risk appetite;
* responsible AI expectations;
* technology independence; and
* organizational priorities.

### 5.4 Expected Outcomes

The organization should have a clear and documented direction for how AI is expected to be used, governed, and managed.

### 5.5 Related Principles

This domain primarily supports:

* Accountability and Responsibility;
* Responsible and Sustainable AI;
* Governance Integration;
* Proportionality; and
* Technology Independence.

***

## 6. AI Risk Management

**Identifier:** `AIGO-DOM-003`

### 6.1 Purpose

The AI Risk Management domain establishes processes for identifying, assessing, treating, monitoring, accepting, and escalating AI-related risks.

### 6.2 Scope

The domain applies to risks associated with:

* AI systems;
* models;
* data;
* applications;
* autonomous capabilities;
* third-party services;
* operational environments;
* users; and
* affected stakeholders.

### 6.3 Key Governance Areas

The domain includes:

* risk identification;
* risk assessment;
* risk classification;
* risk treatment;
* risk acceptance;
* risk monitoring;
* risk escalation;
* residual risk; and
* risk reporting.

### 6.4 Risk-Based Approach

AI risk management should be proportionate to the characteristics and potential impact of each AI system.

### 6.5 Expected Outcomes

Organizations should understand the material risks associated with their AI systems and have appropriate mechanisms to manage those risks.

### 6.6 Related Principles

This domain primarily supports:

* Risk-Based Governance;
* Proportionality;
* Continuous Monitoring;
* Continuous Improvement; and
* Continuous Accountability.

***

## 7. AI System Lifecycle

**Identifier:** `AIGO-DOM-004`

### 7.1 Purpose

The AI System Lifecycle domain establishes governance requirements across the lifecycle of AI systems.

### 7.2 Lifecycle Stages

AIGO recognizes the following general lifecycle:

**Initiation → Assessment → Design → Development → Testing → Approval → Deployment → Operation → Monitoring → Change → Retirement**

### 7.3 Key Governance Areas

The domain includes:

* lifecycle planning;
* requirements;
* design governance;
* development governance;
* testing;
* approval;
* deployment;
* change management;
* operational governance; and
* retirement.

### 7.4 Lifecycle Gates

Organizations may establish governance gates between lifecycle stages.

The required evidence and approval level should be proportionate to system risk.

### 7.5 Expected Outcomes

AI systems should be governed consistently from initial conception through retirement.

### 7.6 Related Principles

This domain primarily supports:

* Lifecycle Governance;
* Traceability and Recordkeeping;
* Security and Safety by Design;
* AI System and Model Integrity; and
* Continuous Monitoring.

***

## 8. Data Governance

**Identifier:** `AIGO-DOM-005`

### 8.1 Purpose

The Data Governance domain establishes governance expectations for data used, generated, processed, stored, or transmitted by AI systems.

### 8.2 Scope

The domain may apply to:

* training data;
* fine-tuning data;
* retrieval data;
* prompt data;
* operational data;
* user-generated data;
* reference data;
* output data; and
* supporting datasets.

### 8.3 Key Governance Areas

The domain includes:

* data ownership;
* data provenance;
* data quality;
* data lineage;
* data classification;
* data access;
* data retention;
* data transformation; and
* data lifecycle management.

### 8.4 Expected Outcomes

Organizations should understand the important data dependencies of AI systems and manage those dependencies according to risk.

### 8.5 Related Principles

This domain primarily supports:

* Data Governance;
* Privacy and Data Protection;
* Security;
* Traceability and Recordkeeping; and
* AI System and Model Integrity.

***

## 9. Security

**Identifier:** `AIGO-DOM-006`

### 9.1 Purpose

The Security domain establishes governance requirements for protecting AI systems, supporting infrastructure, data, models, interfaces, tools, and services.

### 9.2 Scope

Security considerations may include:

* identity;
* authentication;
* authorization;
* infrastructure;
* APIs;
* models;
* applications;
* prompts;
* tools;
* agents;
* data;
* integrations; and
* third-party services.

### 9.3 Key Governance Areas

The domain includes:

* security architecture;
* access control;
* vulnerability management;
* threat assessment;
* secure development;
* security testing;
* monitoring;
* incident response; and
* security assurance.

### 9.4 AI-Specific Security

Organizations should consider threats relevant to AI systems, including:

* prompt injection;
* data leakage;
* model abuse;
* unauthorized tool use;
* malicious inputs;
* retrieval manipulation;
* excessive permissions;
* model extraction; and
* supply-chain threats.

### 9.5 Expected Outcomes

AI systems should be protected against reasonably foreseeable security threats according to their risk.

### 9.6 Related Principles

This domain primarily supports:

* Security;
* Security and Safety by Design;
* Controlled Autonomy;
* AI System and Model Integrity; and
* Third-Party and Supply Chain Governance.

***

## 10. Privacy and Data Protection

**Identifier:** `AIGO-DOM-007`

### 10.1 Purpose

The Privacy and Data Protection domain establishes governance expectations for AI systems that process personal or otherwise protected information.

### 10.2 Scope

The domain may include:

* personal data;
* sensitive information;
* user information;
* employee information;
* customer information;
* third-party data; and
* data transmitted to external AI providers.

### 10.3 Key Governance Areas

The domain includes:

* privacy assessment;
* lawful and appropriate processing;
* data minimization;
* purpose limitation;
* access;
* retention;
* data sharing;
* third-party processing; and
* privacy risk management.

### 10.4 Expected Outcomes

Organizations should identify and appropriately manage privacy and data protection risks associated with AI systems.

### 10.5 Related Principles

This domain primarily supports:

* Privacy and Data Protection;
* Data Governance;
* Security;
* Transparency and Explainability; and
* Risk-Based Governance.

***

## 11. Human Oversight and Human Factors

**Identifier:** `AIGO-DOM-008`

### 11.1 Purpose

The Human Oversight and Human Factors domain establishes governance requirements for appropriate human involvement in the design, operation, supervision, and use of AI systems.

### 11.2 Scope

The domain may apply to:

* human-in-the-loop systems;
* human-on-the-loop systems;
* decision-support systems;
* autonomous systems;
* agentic systems;
* AI-assisted decisions; and
* AI-enabled business processes.

### 11.3 Key Governance Areas

The domain includes:

* human oversight;
* decision authority;
* intervention;
* escalation;
* user competence;
* automation bias;
* usability;
* accessibility;
* human review; and
* accountability.

### 11.4 Autonomous Systems

Higher-autonomy systems should have appropriately defined:

* permissions;
* boundaries;
* intervention mechanisms;
* escalation conditions; and
* monitoring.

### 11.5 Expected Outcomes

Organizations should ensure that AI systems operate with an appropriate level of human oversight and that users understand their responsibilities.

### 11.6 Related Principles

This domain primarily supports:

* Human Oversight;
* Human-Centered AI;
* Controlled Autonomy;
* AI Literacy and Organizational Competence; and
* Continuous Accountability.

***

## 12. Transparency and Explainability

**Identifier:** `AIGO-DOM-009`

### 12.1 Purpose

The Transparency and Explainability domain establishes requirements for providing appropriate information about AI systems, their purpose, operation, limitations, and relevant decisions.

### 12.2 Scope

The domain may include transparency for:

* users;
* employees;
* customers;
* management;
* auditors;
* regulators;
* affected individuals; and
* other stakeholders.

### 12.3 Key Governance Areas

The domain includes:

* system documentation;
* AI interaction disclosure;
* limitations;
* explanations;
* decision transparency;
* communication; and
* stakeholder information.

### 12.4 Proportionality

The level of transparency should be appropriate to:

* system risk;
* decision impact;
* stakeholder needs;
* system complexity; and
* applicable requirements.

### 12.5 Expected Outcomes

Relevant stakeholders should have sufficient information to understand the role, purpose, limitations, and governance of an AI system.

### 12.6 Related Principles

This domain primarily supports:

* Transparency and Explainability;
* Human-Centered AI;
* Traceability and Recordkeeping; and
* Evidence-Based Assurance.

***

## 13. AI Operations and Monitoring

**Identifier:** `AIGO-DOM-010`

### 13.1 Purpose

The AI Operations and Monitoring domain establishes governance expectations for the operation, monitoring, maintenance, reliability, resilience, and performance of AI systems.

### 13.2 Scope

The domain includes:

* operational monitoring;
* performance;
* availability;
* reliability;
* resilience;
* capacity;
* model behavior;
* system behavior;
* alerts;
* operational incidents; and
* change monitoring.

### 13.3 Key Governance Areas

Organizations should establish appropriate mechanisms for:

* monitoring;
* alerting;
* investigation;
* operational review;
* maintenance;
* incident handling;
* performance management; and
* continuity.

### 13.4 Model and System Drift

Where relevant, organizations should monitor for changes in system behavior caused by:

* data changes;
* model changes;
* user behavior;
* environmental changes;
* external services; or
* other operational factors.

### 13.5 Expected Outcomes

AI systems should remain operationally reliable and monitored throughout their active lifecycle.

### 13.6 Related Principles

This domain primarily supports:

* Continuous Monitoring;
* Reliability, Resilience, and Performance;
* Lifecycle Governance;
* AI System and Model Integrity; and
* Continuous Improvement.

***

## 14. Third-Party and Supply Chain

**Identifier:** `AIGO-DOM-011`

### 14.1 Purpose

The Third-Party and Supply Chain domain establishes governance expectations for external AI providers, models, services, data sources, infrastructure, software, tools, and other dependencies.

### 14.2 Scope

This domain may include:

* AI model providers;
* cloud providers;
* AI APIs;
* SaaS AI platforms;
* external datasets;
* open-source components;
* AI development tools;
* external agents;
* managed AI services; and
* other material dependencies.

### 14.3 Key Governance Areas

The domain includes:

* supplier assessment;
* procurement;
* due diligence;
* contractual requirements;
* security;
* privacy;
* service reliability;
* dependency management;
* provider changes; and
* exit planning.

### 14.4 Expected Outcomes

Organizations should understand and appropriately manage material risks introduced by third-party AI dependencies.

### 14.5 Related Principles

This domain primarily supports:

* Third-Party and Supply Chain Governance;
* Security;
* Privacy and Data Protection;
* Risk-Based Governance; and
* AI System and Model Integrity.

***

## 15. AI Assurance and Evidence

**Identifier:** `AIGO-DOM-012`

### 15.1 Purpose

The AI Assurance and Evidence domain establishes mechanisms for demonstrating that AI governance requirements and controls are appropriately designed, implemented, and operating.

### 15.2 Scope

The domain includes:

* governance evidence;
* assessments;
* reviews;
* audits;
* control testing;
* assurance;
* documentation; and
* evidence management.

### 15.3 Key Governance Areas

Organizations should establish appropriate processes for:

* evidence collection;
* evidence retention;
* control assessment;
* internal review;
* independent review;
* audit;
* reporting; and
* remediation.

### 15.4 Evidence Traceability

Where practical, evidence should be traceable to:

* an AI system;
* a requirement;
* a control;
* an owner;
* an activity; and
* a relevant period.

### 15.5 Expected Outcomes

Organizations should be able to demonstrate how AI governance requirements are implemented and operated.

### 15.6 Related Principles

This domain primarily supports:

* Evidence-Based Assurance;
* Traceability and Recordkeeping;
* Accountability and Responsibility; and
* Continuous Improvement.

***

## 16. AI Incident and Issue Management

**Identifier:** `AIGO-DOM-013`

### 16.1 Purpose

The AI Incident and Issue Management domain establishes governance expectations for identifying, reporting, investigating, responding to, and learning from AI-related incidents and issues.

### 16.2 Scope

AI incidents may include:

* harmful outputs;
* security incidents;
* privacy incidents;
* unauthorized actions;
* model failures;
* operational failures;
* significant bias or unfair outcomes;
* data issues;
* availability failures;
* policy violations; and
* unexpected autonomous behavior.

### 16.3 Key Governance Areas

The domain includes:

* incident identification;
* reporting;
* classification;
* escalation;
* containment;
* investigation;
* remediation;
* communication;
* root-cause analysis; and
* lessons learned.

### 16.4 Incident Severity

Organizations should establish an appropriate method for classifying AI incidents according to:

* impact;
* likelihood;
* affected stakeholders;
* system importance;
* security implications;
* regulatory implications; and
* operational consequences.

### 16.5 Expected Outcomes

AI incidents and significant issues should be identified, managed, documented, and used to improve governance.

### 16.6 Related Principles

This domain primarily supports:

* Continuous Monitoring;
* Continuous Improvement;
* Risk-Based Governance;
* Security;
* Human Oversight; and
* Evidence-Based Assurance.

***

## 17. AI Competence and Literacy

**Identifier:** `AIGO-DOM-014`

### 17.1 Purpose

The AI Competence and Literacy domain establishes governance expectations for ensuring that personnel have appropriate knowledge and skills to perform AI-related responsibilities.

### 17.2 Scope

The domain applies to:

* executives;
* governance personnel;
* system owners;
* developers;
* engineers;
* security teams;
* privacy teams;
* risk teams;
* auditors;
* procurement teams; and
* AI users.

### 17.3 Key Governance Areas

The domain includes:

* AI awareness;
* role-based competence;
* training;
* education;
* acceptable use;
* limitations;
* security awareness;
* privacy awareness; and
* ongoing learning.

### 17.4 Role-Based Requirements

Competence expectations should be proportionate to the individual's responsibilities and the risks associated with the AI systems they interact with.

### 17.5 Expected Outcomes

Relevant personnel should understand their responsibilities and have sufficient knowledge to use, govern, develop, or oversee AI systems appropriately.

### 17.6 Related Principles

This domain primarily supports:

* AI Literacy and Organizational Competence;
* Human-Centered AI;
* Human Oversight; and
* Continuous Improvement.

***

## 18. Continuous Improvement

**Identifier:** `AIGO-DOM-015`

### 18.1 Purpose

The Continuous Improvement domain establishes mechanisms for reviewing AI governance effectiveness and improving governance processes based on evidence, experience, incidents, assessments, emerging risks, and changes in the AI environment.

### 18.2 Scope

The domain includes improvement activities across:

* governance;
* policies;
* risks;
* controls;
* procedures;
* monitoring;
* training;
* assurance; and
* framework implementation.

### 18.3 Key Governance Areas

Organizations should establish mechanisms for:

* management review;
* lessons learned;
* corrective actions;
* preventive actions;
* control improvement;
* process improvement;
* framework review; and
* change management.

### 18.4 Improvement Sources

Improvement activities may be triggered by:

* incidents;
* audits;
* assessments;
* monitoring;
* user feedback;
* technological developments;
* regulatory changes;
* organizational changes;
* emerging risks; and
* operational experience.

### 18.5 Expected Outcomes

AI governance should become more effective and mature over time.

### 18.6 Related Principles

This domain primarily supports:

* Continuous Improvement;
* Continuous Monitoring;
* Evidence-Based Assurance;
* Principle Review and Evolution; and
* Continuous Accountability.

***

## 19. Domain Relationships

AIGO Governance Domains should be treated as interconnected components of a single governance system.

For example:

**Governance** establishes accountability.

**Strategy and Policy** establishes organizational direction.

**Risk Management** determines risk and required treatment.

**Lifecycle Governance** applies governance throughout the AI system lifecycle.

**Data Governance** manages important data dependencies.

**Security and Privacy** protect systems and information.

**Human Oversight** establishes appropriate human involvement.

**Transparency** supports understanding and accountability.

**Operations and Monitoring** provide ongoing operational oversight.

**Third-Party Governance** addresses external dependencies.

**Assurance and Evidence** demonstrates governance effectiveness.

**Incident Management** addresses failures and unexpected events.

**Competence and Literacy** ensures people can perform their responsibilities.

**Continuous Improvement** enables the governance system to evolve.

***

## 20. Domain Applicability

Not every domain will have the same level of applicability to every organization or AI system.

Organizations should determine domain applicability according to:

* AI system characteristics;
* organizational context;
* risk;
* intended purpose;
* applicable requirements;
* stakeholder impact;
* technology;
* operational environment; and
* organizational maturity.

A domain may be:

* fully applicable;
* partially applicable;
* conditionally applicable; or
* not applicable with documented justification.

***

## 21. Domain Implementation

The Governance Domains provide the structural layer between AIGO Principles and detailed AIGO requirements.

The intended progression is:

**Principles → Domains → Requirements → Controls → Procedures → Evidence → Assurance**

Domains should not normally be interpreted as standalone controls.

Detailed implementation requirements should be defined through the appropriate AIGO control and guidance documents.

***

## 22. Relationship to External Standards

AIGO Governance Domains may be mapped to external standards, frameworks, regulations, contractual requirements, and organizational governance systems.

Examples may include:

* ISO/IEC 42001;
* NIST AI Risk Management Framework;
* applicable AI legislation;
* information security standards;
* privacy frameworks;
* organizational risk frameworks; and
* industry-specific requirements.

Mappings should be maintained separately where practical.

AIGO domain definitions should remain technology-independent and should not be rewritten solely to reproduce another framework.

***

## 23. Domain Evolution

AIGO Governance Domains may evolve as AI technologies, organizational practices, risks, standards, regulations, and governance expectations change.

Changes to the domain model should follow the AIGO framework governance and version-management process.

Material changes should maintain appropriate traceability between framework versions.

***

## 24. Domain Summary

The AIGO Governance Domain model provides the structural foundation for translating the AIGO Principles into operational governance requirements.

The domains are:

| Identifier     | Domain                            |
| -------------- | --------------------------------- |
| `AIGO-DOM-001` | Governance and Accountability     |
| `AIGO-DOM-002` | AI Strategy and Policy            |
| `AIGO-DOM-003` | AI Risk Management                |
| `AIGO-DOM-004` | AI System Lifecycle               |
| `AIGO-DOM-005` | Data Governance                   |
| `AIGO-DOM-006` | Security                          |
| `AIGO-DOM-007` | Privacy and Data Protection       |
| `AIGO-DOM-008` | Human Oversight and Human Factors |
| `AIGO-DOM-009` | Transparency and Explainability   |
| `AIGO-DOM-010` | AI Operations and Monitoring      |
| `AIGO-DOM-011` | Third-Party and Supply Chain      |
| `AIGO-DOM-012` | AI Assurance and Evidence         |
| `AIGO-DOM-013` | AI Incident and Issue Management  |
| `AIGO-DOM-014` | AI Competence and Literacy        |
| `AIGO-DOM-015` | Continuous Improvement            |

***

## 25. Document Status

**Document:** AIGO Governance Domains

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Type:** Framework Structure

**Identifier Range:** `AIGO-DOM-001` through `AIGO-DOM-015`

This document is part of the AIGO Framework and should be maintained according to the framework's governance, versioning, review, and change-management processes.