AIGO — AI Governance Operating Framework
AI Governance Template
Version: 0.2 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-001
Document Type: Governance Template
Template Purpose: Organizational AI Governance Arrangement
1. Template Purpose
This template provides a structured record for establishing, documenting, approving, operating, reviewing, and improving an organization’s AI governance arrangement under the AIGO AI Governance Operating Framework. The completed record should establish:- governance scope;
- governance objectives;
- governance principles;
- governance authority;
- roles and responsibilities;
- decision rights;
- AI portfolio governance;
- risk governance;
- lifecycle governance;
- control governance;
- monitoring;
- assurance;
- incident governance;
- change governance;
- risk acceptance;
- retirement;
- evidence and records;
- reporting;
- regulatory and external requirements;
- third-party governance;
- exceptions;
- continual improvement.
2. Template Completion Instructions
Complete the fields that apply to the organization’s governance arrangement. Where a section is not applicable, record: Not Applicable — [reason] Where a decision, requirement, control, or activity is delegated to another controlled record, reference that record rather than duplicating it. Use controlled identifiers wherever possible. Recommended identifiers include:- Governance Record ID;
- AI System ID;
- Risk ID;
- Control ID;
- Approval ID;
- Incident ID;
- Change ID;
- Evidence ID;
- Assurance ID;
- Improvement ID.
3. Governance Record
3.1 Governance Record Identification
Governance Record ID: Organization: Business Unit / Function: Governance Arrangement Name: Governance Owner: Prepared By: Date Created: Last Updated: Version: Status:3.2 Governance Arrangement Status
Current Status:- Draft
- Under Review
- Approved
- Approved with Conditions
- Suspended
- Under Revision
- Retired
4. Governance Scope
4.1 Organizational Scope
Organization covered by this governance arrangement:4.2 Business Scope
Business functions, departments, products, or services covered:4.3 Geographic Scope
Countries, regions, jurisdictions, or legal entities covered:4.4 AI Scope
AI systems, AI-enabled processes, AI services, AI development activities, and AI-related third parties covered:4.5 Lifecycle Scope
AI lifecycle activities covered:- Govern
- Identify
- Classify
- Assess
- Treat
- Approve
- Deploy
- Operate
- Monitor
- Assure
- Improve
- Change
- Continue
- Retire
4.6 Exclusions
Activities, systems, business functions, jurisdictions, or other areas excluded from scope: Exclusion rationale:4.7 Scope Review
Scope review frequency: Scope-change trigger:5. Governance Context
5.1 Organizational Context
Relevant organizational objectives: Organizational context affecting AI governance:5.2 AI Governance Context
Why AI governance is required within the organization: Key AI-related opportunities: Key AI-related risks:5.3 Stakeholder Context
5.4 External Context
Relevant external factors may include:- laws;
- regulations;
- standards;
- contractual obligations;
- industry requirements;
- customer expectations;
- technology dependencies;
- third-party dependencies.
6. Governance Objectives
6.1 Primary Objectives
The governance arrangement should define measurable or assessable objectives. Primary objectives:6.2 Expected Governance Outcomes
Expected outcomes:6.3 Governance Success Criteria
How governance effectiveness will be determined:7. Governance Principles
The governance arrangement should identify the principles that guide AI-related decisions.7.1 Applicable AIGO Principles
The following principles may be adopted or adapted:- Accountability
- Transparency
- Human Oversight
- Risk-Based Governance
- Proportionality
- Security
- Privacy
- Fairness
- Safety
- Reliability
- Resilience
- Traceability
- Evidence-Based Decision-Making
- Lifecycle Accountability
- Continual Improvement
7.2 Principle Application
How the principles are applied in practice:8. Governance Authority
8.1 Primary Governance Authority
Governance Body / Authority: Mandate: Authority: Accountability:8.2 Executive Sponsorship
Executive Sponsor: Executive Responsibilities:8.3 Delegated Governance Authority
Delegated authority: Delegation scope: Delegation conditions: Delegation limitations: Delegation expiry / review:9. Governance Structure
9.1 Governance Bodies
9.2 Reporting Structure
Governance reporting relationships: Escalation relationships:9.3 Governance Committee Requirements
Quorum requirements: Decision-record requirements: Conflict-of-interest requirements: Meeting-record requirements:10. Governance Roles and Responsibilities
10.1 AI Governance Owner
Role / Position: Responsibilities:10.2 AI System Owner
Role / Position: Responsibilities:10.3 Risk Owner
Role / Position: Responsibilities:10.4 Control Owner
Role / Position: Responsibilities:10.5 Assurance Role
Role / Function: Responsibilities:10.6 Other Roles
11. Segregation of Duties
The governance arrangement should identify activities requiring separation of responsibilities.11.1 Segregated Activities
11.2 Conflict-of-Interest Requirements
Requirements:12. Decision Authority
12.1 Governance Decision Matrix
12.2 Delegated Decisions
Delegated decision authorities: Conditions and limitations:13. AI Portfolio Governance
13.1 AI Inventory
AI Inventory Owner: Inventory Location / System: Inventory Review Frequency: Inventory Reconciliation Method:13.2 Inventory Minimum Information
Each AI system should be identifiable through, as applicable:- AI System ID;
- System Name;
- System Owner;
- Business Owner;
- Intended Purpose;
- Classification;
- Risk Level;
- Lifecycle Stage;
- Deployment Status;
- Applicable Controls;
- Approval Status;
- Monitoring Status.
13.3 Portfolio Review
Portfolio review frequency: Portfolio risk review method: Aggregate-risk review requirements:14. AI System Governance
14.1 Registration Requirement
Each AI system within scope should have a controlled registration record. Registration Procedure: Registration Owner: Registration Repository:14.2 Required Registration Information
- AI System ID
- System Name
- System Owner
- Business Owner
- Intended Purpose
- AI Capability
- Classification
- Risk Level
- Lifecycle Stage
- Deployment Environment
- Data Categories
- Model / Provider
- Third-Party Dependencies
- Applicable Controls
- Approval Status
- Monitoring Status
14.3 System Profile
System Profile Requirement: System Profile Repository: Profile Review Frequency:15. AI Classification Governance
15.1 Classification Method
Classification Methodology: Classification Owner: Classification Approval Authority:15.2 Classification Criteria
Classification may consider:- intended purpose;
- affected stakeholders;
- individual impact;
- business criticality;
- autonomy;
- decision significance;
- potential harm;
- data sensitivity;
- security;
- privacy;
- fairness;
- safety;
- regulatory requirements;
- deployment scale;
- reversibility;
- human oversight.
15.3 Classification Record
AI System ID: Classification: Classification Date: Classification Owner: Reviewer: Approval Authority: Supporting Evidence IDs: Classification Rationale:15.4 Reclassification Triggers
Reclassification should be considered when:- intended purpose changes;
- decision significance changes;
- automation changes;
- affected populations change;
- material data changes occur;
- material model changes occur;
- risk changes materially;
- significant incidents occur;
- applicable requirements change.
16. AI Risk Governance
16.1 Risk Management Method
Risk Methodology: Risk Scoring Method: Risk Criteria:16.2 Risk Appetite
AI Risk Appetite:16.3 Risk Tolerance
AI Risk Tolerance:16.4 Risk Ownership
Risk Owner Assignment Method:16.5 Risk Escalation
Risks should be escalated when:- risk exceeds tolerance;
- required controls are unavailable;
- critical controls fail;
- material incidents occur;
- significant changes occur;
- monitoring thresholds are exceeded;
- uncertainty becomes material;
- legal or regulatory concerns arise.
17. AI Risk Acceptance Governance
17.1 Acceptance Requirements
Residual risk may be accepted only when:- the risk has been assessed;
- treatment options have been considered;
- applicable controls have been evaluated;
- residual risk is understood;
- acceptance is within authorized tolerance;
- appropriate authority approves the decision;
- the decision is documented;
- review requirements are established.
17.2 Acceptance Authority
Risk Acceptance Authority:17.3 Acceptance Conditions
Conditions for acceptance:17.4 Acceptance Monitoring
Monitoring Requirements: Review Frequency: Expiry / Reapproval Requirements:18. AI Lifecycle Governance
Governance should operate throughout the AIGO lifecycle.18.1 Lifecycle Governance Requirements
Requirements:18.2 Lifecycle Entry and Exit Criteria
19. Governance Controls
19.1 Control Framework
Applicable Control Framework: Control Repository:19.2 Control Ownership
19.3 Control Exceptions
Exception Process: Exception Approval Authority: Compensating Control Requirements: Exception Monitoring:20. Human Oversight Governance
20.1 Oversight Requirements
Required Human Oversight:20.2 Oversight Responsibilities
Responsible Role: Oversight Activities:20.3 Human Authority
Can human users challenge AI outputs? Can human users override AI outputs? Who has final decision authority?20.4 Escalation
Conditions requiring human escalation:21. AI Monitoring Governance
21.1 Monitoring Requirements
Monitoring Scope: Monitoring Owner: Monitoring Frequency: Enhanced Monitoring Triggers:21.2 Monitoring Indicators
21.3 Monitoring Evidence
Evidence Repository: Evidence Retention:21.4 Monitoring Response
Threshold Breach Process: Incident Trigger Criteria: Risk Reassessment Trigger Criteria: Change Trigger Criteria:22. Assurance Governance
22.1 Assurance Requirements
Assurance Scope: Assurance Frequency: Assurance Owner: Required Independence:22.2 Assurance Activities
Applicable activities may include:- control assessment;
- compliance assessment;
- technical assessment;
- model validation;
- operational review;
- independent review;
- audit;
- evidence review;
- management review.
22.3 Assurance Reporting
Assurance Reporting Authority: Finding Escalation Requirements: Corrective-Action Follow-Up:23. Incident Governance
23.1 Incident Management
Incident Management Procedure: Incident Repository: Incident Owner:23.2 Incident Severity
Severity Methodology:23.3 Incident Escalation
Incidents should be escalated according to:- severity;
- affected stakeholders;
- potential harm;
- business impact;
- regulatory significance;
- safety impact;
- security impact;
- privacy impact;
- control failure.
23.4 Incident Closure
Closure Authority: Closure Evidence Requirements: Lessons-Learned Requirements:24. Change Governance
24.1 Change Requirements
Material AI changes should be assessed before implementation. Change Management Procedure: Change Owner:24.2 Change Classification
Change Classification Method:24.3 Change Criteria
Potential material changes include:- intended-purpose changes;
- model changes;
- model-version changes;
- training-data changes;
- inference-data changes;
- data-pipeline changes;
- feature changes;
- integration changes;
- provider changes;
- human-oversight changes;
- control changes;
- operating-environment changes.
24.4 Change Approval
Change Approval Authority: Required Reviews: Testing Requirements: Rollback Requirements:24.5 Post-Change Review
Post-Change Monitoring: Post-Change Validation: Closure Requirements:25. AI Retirement Governance
25.1 Retirement Requirements
AI systems should be formally retired when:- the system is no longer required;
- the system is replaced;
- risk becomes unacceptable;
- required controls can no longer be maintained;
- the system becomes obsolete;
- the intended purpose ends;
- another approved retirement trigger occurs.
25.2 Retirement Approval
Retirement Approval Authority:25.3 Retirement Activities
- authorization;
- controlled shutdown;
- access removal;
- data disposition;
- dependency closure;
- evidence retention;
- residual-risk closure;
- monitoring closure;
- stakeholder communication.
25.4 Retirement Evidence
Required evidence may include:- retirement approval;
- shutdown record;
- access-removal record;
- data-disposition record;
- dependency-closure record;
- risk-closure record;
- final monitoring record;
- final validation;
- lessons learned.
26. Documentation and Records
26.1 Required Records
Governance records may include:- AI inventory;
- AI system profiles;
- classification records;
- risk assessments;
- risk acceptance records;
- treatment plans;
- control assessments;
- approvals;
- deployment records;
- change records;
- incident records;
- monitoring records;
- assurance records;
- management reviews;
- improvement records;
- retirement records.
26.2 Evidence Traceability
Material records should be traceable through:26.3 Record Retention
Retention Requirements: Records Owner: Records Repository: Access Requirements: Disposition Requirements:27. Reporting
27.1 Governance Reporting
Reporting Frequency: Recipients: Reporting Owner:27.2 Reporting Content
Reporting may include:- AI inventory status;
- classification status;
- AI risk profile;
- residual risks;
- control effectiveness;
- incidents;
- assurance findings;
- accepted risks;
- material changes;
- monitoring results;
- exceptions;
- improvement actions;
- retirement activity.
28. Governance Metrics
Organizations may establish governance metrics.
Additional Metrics:
29. Regulatory and External Requirements
29.1 Applicable Requirements
Identify applicable:- laws;
- regulations;
- standards;
- contractual requirements;
- internal policies;
- external commitments.
29.2 Regulatory Change Monitoring
Monitoring Owner: Review Frequency: Change Escalation Process:30. Third-Party AI Governance
30.1 Third-Party Services
Third-Party AI Services Within Scope:30.2 Third-Party Requirements
Requirements may include:- due diligence;
- contractual controls;
- security requirements;
- privacy requirements;
- AI-risk assessment;
- assurance;
- monitoring;
- incident notification;
- change notification;
- model-change notification;
- evidence;
- termination requirements.
30.3 Third-Party Monitoring
Monitoring Requirements: Review Frequency:31. Governance Exceptions
31.1 Exception Request
Exception ID: Requirement: Reason: Risk: Compensating Controls: Requested Duration: Owner: Approval Authority:31.2 Exception Review
Review Date: Review Outcome: Residual Risk: Additional Actions: Expiry / Renewal Date:32. Governance Review
The governance arrangement should be reviewed periodically and when material events occur.32.1 Periodic Review
Review Frequency: Next Review Date: Review Owner:32.2 Triggered Review
Review triggers may include:- significant incidents;
- material changes;
- regulatory developments;
- assurance findings;
- changes in organizational strategy;
- changes in AI technology;
- changes in risk appetite;
- changes in organizational context;
- significant stakeholder concerns;
- continual-improvement findings.
32.3 Review Outputs
Required Outputs:33. Management Review
33.1 Review Inputs
Management review may consider:- AI portfolio;
- governance performance;
- risk status;
- control effectiveness;
- monitoring;
- incidents;
- assurance;
- exceptions;
- regulatory developments;
- changes;
- stakeholder feedback;
- improvement actions.
33.2 Review Decisions
Possible outcomes include:- continue;
- improve;
- change;
- restrict;
- suspend;
- retire;
- change governance requirements;
- change monitoring requirements.
34. Continuous Improvement
34.1 Improvement Sources
Improvement opportunities may originate from:- incidents;
- monitoring;
- assurance;
- audits;
- risk assessments;
- control assessments;
- stakeholder feedback;
- management reviews;
- technology developments;
- regulatory developments;
- implementation lessons learned.
34.2 Improvement Actions
35. Governance Approval
35.1 Approval Record
Prepared By: Role: Date: Reviewed By: Role: Date: Approved By: Role: Date:35.2 Approval Decision
Decision:- Approved
- Approved with Conditions
- Rejected
- Deferred
- Suspended
35.3 Approval Evidence
Approval Record ID: Supporting Evidence IDs:36. Governance Status
Governance Record ID: Current Status: Effective Date: Next Review Date: Governance Owner: Approval Authority: Related AIGO Records:37. Template Traceability
This template should maintain traceability to relevant AIGO framework components.38. Template Record Relationships
Where applicable, the completed governance record should link to:39. Template Completion Review
Before the completed governance record is approved, verify:- Scope is defined
- Context is documented
- Objectives are defined
- Governance authority is assigned
- Roles are assigned
- Decision rights are defined
- AI inventory requirements are established
- Classification requirements are established
- Risk governance is established
- Lifecycle governance is established
- Controls are assigned
- Human oversight requirements are defined
- Monitoring requirements are defined
- Assurance requirements are defined
- Incident governance is established
- Change governance is established
- Retirement governance is established
- Evidence requirements are established
- Reporting requirements are established
- External requirements are identified
- Third-party governance is addressed
- Exceptions are governed
- Review requirements are established
- Management review is defined
- Continual improvement is established
- Approval authority is identified
- Related records are linked
40. Template Usage Instructions
This template should be completed according to the organization’s approved AIGO governance procedures. The completed governance record should be:- controlled;
- versioned;
- attributable;
- approved;
- periodically reviewed;
- updated following material changes;
- supported by appropriate evidence;
- retained according to applicable requirements.
- governance structure;
- organizational context;
- AI portfolio;
- risk methodology;
- classification methodology;
- control framework;
- regulatory environment;
- roles and responsibilities;
- evidence architecture;
- records-management requirements.
41. Template Governance
41.1 Template Owner
Template Owner:41.2 Template Review
Review Frequency: Next Review Date:41.3 Template Change Control
Changes to this template should be managed through the applicable AIGO change-management process. Material changes should consider their effect on:- related procedures;
- templates;
- schemas;
- evidence requirements;
- mappings;
- tools;
- completed governance records.
42. Document Control
43. Template Status
Document: AIGO — AI Governance Template Version: 0.2 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-001
Document Type: Governance Template
This template provides the baseline structure for establishing, documenting, approving, operating, reviewing, and improving an organization’s AI governance arrangement under the AIGO AI Governance Operating Framework.
44. End of Template
AIGO — AI Governance Template Document ID:AIGO-TPL-001
Version: 0.2
Status: Draft
End of Template