AIGO — AI Governance Operating Framework
AI Classification Template
Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-004
Document Type: AI Classification Template
Template Purpose: Controlled Classification and Governance-Tiering Record for an AI System
1. Template Purpose
This template provides the controlled record for determining, approving, documenting, and maintaining the governance classification of an AI system. Classification establishes the appropriate level of AIGO governance intensity based on the characteristics and context of the AI system. The classification record supports decisions concerning:- governance intensity;
- risk assessment depth;
- control requirements;
- human oversight;
- monitoring;
- assurance;
- approval authority;
- evidence requirements;
- review frequency;
- change management;
- reclassification.
2. Classification Instructions
Complete all applicable sections. Where information is not yet available, record: Pending — [reason] Where a criterion does not apply, record: Not Applicable — [reason] Classification decisions should be supported by evidence. The completed classification record should be linked to the corresponding:- AI System Registration;
- AI System Profile;
- Risk Assessment;
- Control Assessment;
- Approval;
- Monitoring;
- Assurance;
- Change Management;
- Evidence records.
3. Classification Record
3.1 Identification
AI System ID: Classification Record ID: System Name: System Version: Classification Version: Classification Status: Classification Owner: Classification Reviewer: Approval Authority: Date Initiated: Date Completed: Next Review Date:3.2 Classification Status
Current Status:- Draft
- Under Assessment
- Under Review
- Approved
- Approved with Conditions
- Reassessment Required
- Suspended
- Superseded
4. AI System Identification
4.1 System Description
Brief description of the AI system:4.2 AI Capability
Select applicable capabilities:- Classification
- Prediction
- Recommendation
- Ranking
- Generation
- Retrieval
- Detection
- Optimization
- Forecasting
- Decision Support
- Conversational Interaction
- Natural Language Processing
- Computer Vision
- Speech / Audio
- Multimodal Processing
- Other
4.3 Intended Purpose
Approved intended purpose:4.4 Intended Use
Approved intended use:4.5 Restricted Uses
Restricted uses:4.6 Prohibited Uses
Prohibited uses:5. Classification Context
5.1 Organization
Organization: Business Unit: Business Function: Jurisdictions:5.2 Operating Context
Operating environment:5.3 Business Criticality
Business Criticality:- Low
- Medium
- High
- Critical
5.4 Lifecycle Stage
Current AIGO Lifecycle Stage: Lifecycle Status:6. Stakeholder and Affected-Person Assessment
6.1 Stakeholders
6.2 Affected Persons
Who may be directly or indirectly affected by system operation or outputs?6.3 Affected Population Scale
Estimated number / scale of affected persons: Scale Classification:- Limited
- Moderate
- Large
- Very Large
- Systemic / Broad
7. Decision Significance
7.1 Does the AI System Influence Decisions?
Decision Influence:- None
- Informational
- Limited Decision Support
- Material Decision Support
- Significant Decision Influence
- Autonomous Decision
7.2 Decision Description
Describe decisions influenced or made by the AI system:7.3 Decision Impact
Potential decision impacts may include:- financial;
- employment;
- access to services;
- eligibility;
- safety;
- security;
- privacy;
- legal rights or interests;
- health;
- education;
- customer treatment;
- operational continuity;
- other material impacts.
7.4 Final Decision Authority
Who has final decision authority?8. Automation and Autonomy
8.1 Degree of Automation
Automation Level:- Informational
- Assistive
- Human-in-the-Loop
- Human-on-the-Loop
- High Automation
- Autonomous
8.2 Human Intervention
Can a human intervene before a consequential action occurs?8.3 Human Override
Can an authorized human override the AI output or action?8.4 Human Authority
Who has authority to challenge, override, approve, or reject AI outputs?8.5 Autonomy Rationale
Rationale for the selected automation / autonomy classification:9. Impact Assessment
9.1 Potential Impact
Potential impacts may include:- individual harm;
- financial harm;
- operational harm;
- privacy harm;
- security harm;
- safety harm;
- discriminatory impact;
- reputational harm;
- legal or regulatory impact;
- societal impact.
9.2 Impact Severity
Potential Impact Severity:- Insignificant
- Minor
- Moderate
- Major
- Severe
9.3 Reversibility
Reversibility of Potential Consequences:- Fully Reversible
- Substantially Reversible
- Partially Reversible
- Limited Reversibility
- Irreversible
9.4 Detectability
Ability to detect harmful outcomes:- High
- Moderate
- Low
- Very Low
10. Data Sensitivity
10.1 Data Categories
Select applicable:- Public
- Internal
- Confidential
- Proprietary
- Personal Data
- Sensitive Personal Data
- Employee Data
- Customer Data
- Financial Data
- Health Data
- Security Data
- Government Data
- Other
10.2 Data Sensitivity Level
Data Sensitivity:- Low
- Medium
- High
- Very High
10.3 Data Volume
Approximate Data Volume / Scale:10.4 Data Dependency
How dependent is system behavior on the quality and characteristics of the data?11. Security Considerations
11.1 Security Exposure
Security Significance:- Low
- Medium
- High
- Critical
11.2 Security Risks
Potential risks may include:- unauthorized access;
- data exposure;
- model manipulation;
- adversarial attacks;
- model extraction;
- service compromise;
- dependency vulnerabilities.
11.3 Security Assessment
Security Assessment ID: Assessment Status:12. Privacy Considerations
12.1 Privacy Applicability
Privacy Requirements Applicable:12.2 Privacy Significance
Privacy Significance:- Low
- Medium
- High
- Critical
12.3 Privacy Assessment
Privacy Assessment ID: Assessment Status:13. Fairness and Discrimination Considerations
13.1 Applicability
Fairness / Discrimination Assessment Applicable:13.2 Fairness Significance
Fairness Risk Significance:- Low
- Medium
- High
- Critical
13.3 Potentially Affected Groups
Potentially affected groups:13.4 Fairness Assessment
Fairness Assessment ID: Assessment Status:14. Safety and Reliability Considerations
14.1 Safety Significance
Safety Significance:- Not Applicable
- Low
- Medium
- High
- Critical
14.2 Reliability Significance
Reliability Significance:- Low
- Medium
- High
- Critical
14.3 Failure Consequences
Potential consequence of system failure:15. Scale and Deployment Characteristics
15.1 Deployment Scale
Deployment Scale:- Limited
- Departmental
- Organizational
- Multi-Organizational
- Large-Scale
- Systemic
15.2 Geographic Scale
Geographic Scope:15.3 User Scale
Approximate Number of Users:15.4 Affected-Person Scale
Approximate Number of Affected Persons:15.5 Scale Rationale
Rationale:16. Third-Party and Supply-Chain Considerations
16.1 Third-Party Dependency
Third-Party Dependency:- None
- Low
- Medium
- High
- Critical
16.2 External Model / Service Provider
Provider: Service: Provider Criticality:16.3 Supplier Risks
Known Supplier Risks:16.4 Supplier Assessment
Supplier Risk Assessment ID: Supplier Assurance Reference:17. Human Oversight Assessment
17.1 Oversight Requirement
Human Oversight Requirement:- Not Required
- Recommended
- Required
- Mandatory
- Enhanced Mandatory Oversight
17.2 Oversight Capability
Assess:17.3 Oversight Conclusion
Conclusion:18. Regulatory and Legal Context
18.1 Applicable Requirements
18.2 Regulatory Significance
Regulatory Significance:- Low
- Medium
- High
- Critical
18.3 Regulatory Classification Dependency
Does any applicable law or regulation impose a classification that affects governance? Reference:19. Risk Assessment Summary
Classification should consider the existing AI risk assessment but should not replace it.19.1 Risk Assessment Reference
Risk Assessment ID: Risk Assessment Date: Risk Owner:19.2 Overall Risk
Inherent Risk: Residual Risk: Risk Status:19.3 Highest Risks
19.4 Risk Assessment Conclusion
Summary:20. Classification Scoring Factors
The organization may use a structured classification score.
Total / Classification Indicator:
Scoring Methodology Reference:
The scoring methodology should be approved within the organization’s classification framework.
21. Governance Classification Levels
The organization may define governance levels such as:
These classes are illustrative.
The organization’s approved classification methodology determines the authoritative classification rules.
22. Proposed Classification
22.1 Proposed Class
Proposed Classification:22.2 Classification Rationale
Detailed Rationale:22.3 Governance Intensity
The proposed classification should determine applicable:- governance authority;
- risk assessment depth;
- control requirements;
- evidence requirements;
- approval requirements;
- monitoring requirements;
- assurance requirements;
- review frequency.
23. Governance Requirements Generated by Classification
24. Control Requirements Generated by Classification
24.1 Required Controls
Required Controls:24.2 Critical Controls
Critical Controls:24.3 Enhanced Controls
Enhanced Controls Required:24.4 Control Assessment Requirement
Control Assessment Required: Assessment Reference:25. Evidence Requirements Generated by Classification
25.1 Required Evidence
Required Evidence:- system registration;
- system profile;
- classification assessment;
- risk assessment;
- control assessment;
- approval record;
- monitoring plan;
- assurance evidence;
- change records where applicable;
- incident records where applicable.
25.2 Evidence Strength
Minimum Evidence Standard:- Basic
- Standard
- Enhanced
- Independent / Verified
26. Approval Requirements Generated by Classification
Required Approval Authority: Required Reviews:- Risk
- Security
- Privacy
- Legal / Compliance
- Technical
- Business
- AI Governance
- Assurance
- Other
27. Monitoring Requirements Generated by Classification
Monitoring Level:- Basic
- Standard
- Enhanced
- Continuous / Intensive
28. Assurance Requirements Generated by Classification
Assurance Level:- Basic
- Standard
- Enhanced
- Independent / Specialized
29. Review Frequency Generated by Classification
Required Classification Review Frequency: Required Governance Review Frequency: Required Risk Review Frequency: Required Control Review Frequency: Required Assurance Frequency:30. Classification Decision
30.1 Final Classification
Final AIGO Classification: Governance Level: Decision Date: Effective Date: Classification Owner: Classification Reviewer: Approval Authority:30.2 Decision Rationale
Final Classification Rationale:31. Classification Conditions
31.1 Conditions of Classification
Classification may be subject to conditions. Conditions:31.2 Condition Owners
32. Classification Exceptions
32.1 Exception Request
Exception ID: Classification Requirement: Requested Deviation: Reason: Risk: Compensating Controls: Requested Duration: Owner: Approval Authority:32.2 Exception Review
Review Date: Review Outcome: Residual Risk: Additional Actions: Expiry Date:33. Reclassification Triggers
Reclassification should be considered when:- intended purpose changes;
- users change materially;
- affected persons change materially;
- decision significance changes;
- automation increases;
- autonomy increases;
- new data categories are introduced;
- data sensitivity increases;
- model architecture changes materially;
- model version changes materially;
- deployment scale increases;
- geographic scope changes;
- third-party dependencies change materially;
- risk increases;
- significant incidents occur;
- control effectiveness decreases;
- regulatory requirements change;
- human oversight changes.
34. Reclassification Record
Reclassification Required: Trigger: Original Classification: Proposed Classification: Reclassification Assessment ID: Reassessment Date: Decision Authority: Decision: Effective Date: Rationale:35. Classification Monitoring
Classification should be monitored for continued appropriateness.35.1 Monitoring Indicators
35.2 Classification Drift
Conditions that could indicate classification drift:36. Classification Evidence
36.1 Evidence Repository
Evidence Repository: Evidence Owner:36.2 Supporting Evidence
36.3 Evidence Completeness
Evidence Status:- Complete
- Substantially Complete
- Partially Complete
- Incomplete
- Under Review
37. Classification Traceability
The classification decision should be traceable to relevant AIGO records.38. Classification Decision Workflow
39. Classification Review and Approval
39.1 Prepared By
Name: Role: Date:39.2 Reviewed By
Name: Role: Date:39.3 Approved By
Name: Role: Date:39.4 Decision
Decision:- Approved
- Approved with Conditions
- Returned for Reassessment
- Deferred
- Rejected
40. Classification Change History
41. Classification Completion Checklist
- AI System ID assigned
- Classification Record ID assigned
- System purpose documented
- Intended use documented
- Restricted / prohibited uses documented
- Organizational context documented
- Stakeholders identified
- Affected persons identified
- Affected-person scale assessed
- Decision significance assessed
- Automation / autonomy assessed
- Human oversight assessed
- Potential impact assessed
- Reversibility assessed
- Detectability assessed
- Data sensitivity assessed
- Security significance assessed
- Privacy significance assessed
- Fairness significance assessed
- Safety significance assessed where applicable
- Reliability significance assessed
- Deployment scale assessed
- Third-party dependency assessed
- Regulatory context assessed
- Risk assessment reviewed
- Classification methodology applied
- Proposed classification documented
- Governance intensity determined
- Control requirements identified
- Evidence requirements identified
- Approval requirements identified
- Monitoring requirements identified
- Assurance requirements identified
- Review frequency established
- Final classification approved
- Conditions recorded
- Exceptions recorded where applicable
- Reclassification triggers documented
- Supporting evidence linked
- Related AIGO records linked
42. Template Usage Instructions
This template should be completed according to the organization’s approved AIGO AI Classification Procedure. Classification should be performed using the organization’s approved classification methodology and criteria. The classification record should:- be evidence-based;
- identify the classification rationale;
- identify applicable governance requirements;
- identify approval authority;
- establish review frequency;
- remain linked to the AI System Profile and Registration;
- be reassessed after material changes or other defined triggers.
43. Template Governance
43.1 Template Owner
Template Owner:43.2 Template Review
Review Frequency: Next Review Date:43.3 Template Change Control
Changes to this template should be managed through the applicable AIGO document and change-management process. Material changes should consider their effect on:- AI Classification Procedure;
- AI System Registration;
- AI System Profile;
- Risk Assessment;
- Control Assessment;
- Approval;
- Monitoring;
- Assurance;
- schemas;
- mappings;
- tools.
44. Document Control
45. Template Status
Document: AIGO — AI Classification Template Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-004
Document Type: AI Classification Template
This template provides the controlled structure for determining, documenting, approving, monitoring, and maintaining the governance classification of an AI system within the AIGO AI Governance Operating Framework.
46. End of Template
AIGO — AI Classification Template Document ID:AIGO-TPL-004
Version: 0.1
Status: Draft
End of Template