AIGO — High-Risk AI System Example

AIGO — AI Governance Operating Framework

Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-EXAMPLE-002 Document Type: Implementation Example Example Type: High-Risk AI System Related Framework: AIGO AI Governance Operating Framework

1. Purpose

This document provides an illustrative end-to-end example of how AIGO can be applied to an AI system presenting a significantly higher level of risk than the basic AI system described in the previous example. The purpose is to demonstrate how increased risk can result in:

stronger governance;
enhanced accountability;
deeper risk assessment;
increased control requirements;
stronger human oversight;
enhanced evidence requirements;
more restrictive approval;
increased monitoring;
more frequent assurance;
formal change assessment;
controlled continuation or retirement.

This example is illustrative. Actual governance requirements should be determined according to the organization’s context, applicable law, regulatory requirements, standards, contracts, and the characteristics of the AI system.

2. Example Organization

For this example, the organization is ExampleCorp, a fictional organization with an established AIGO governance program. ExampleCorp operates a large recruitment function and uses AI to assist with candidate screening and prioritization. Because the system may influence employment-related decisions, ExampleCorp applies enhanced governance.

3. Example AI System

The example AI system is called: ExampleCorp Candidate Assessment Assistant The system analyzes candidate information and generates a recommendation concerning whether a candidate should progress to the next stage of recruitment. The system does not have final hiring authority. A designated human decision-maker remains responsible for the final recruitment decision.

4. Intended Purpose

The system is intended to:

assist recruitment personnel in reviewing candidate information;
identify candidates meeting defined job-related criteria;
prioritize candidates for human review;
identify potentially relevant qualifications;
support consistent processing of high volumes of applications.

The system is not intended to:

make autonomous hiring decisions;
reject candidates without human review;
infer protected characteristics;
evaluate candidates using unrelated personal attributes;
replace recruitment professionals.

5. Example System Profile

Field	Example
AI System ID	`AI-HR-001`
System Name	Candidate Assessment Assistant
Business Owner	Chief People Officer
System Owner	Head of Talent Technology
Technical Owner	AI Platform Team
Risk Owner	Enterprise Risk Manager
Privacy Owner	Data Protection Officer
Security Owner	Chief Information Security Officer
Lifecycle Stage	Pre-deployment
Classification	High-Risk
Business Function	Human Resources
Intended Users	Authorized recruitment personnel
Affected Persons	Job applicants
AI Capability	Classification / Recommendation
Human Decision	Required
Status	Under Controlled Deployment

6. Why Enhanced Governance Is Required

The system can influence decisions affecting individuals. Potential consequences include:

unfair treatment;
discrimination;
inappropriate exclusion;
privacy impacts;
inaccurate candidate evaluation;
lack of transparency;
automation bias;
reputational damage;
regulatory exposure.

Accordingly, ExampleCorp applies enhanced AIGO governance.

7. Governance Model

The governance structure is strengthened compared with a standard AI system.

Executive Accountability
        ↓
AI Governance Authority
        ↓
High-Risk AI Oversight
        ↓
System Owner
        ↓
Risk / Privacy / Security / Legal Functions
        ↓
Operational Users
        ↓
Human Decision-Maker

8. Enhanced Governance Roles

Role	Responsibility
Executive Sponsor	Overall organizational accountability
AI Governance Authority	Governance decision-making
System Owner	End-to-end system accountability
Business Owner	Recruitment process accountability
Risk Owner	Risk acceptance and treatment
Privacy Owner	Privacy requirements
Security Owner	Security controls
Legal / Compliance	Regulatory interpretation
Model Owner	Model performance and technical governance
HR Governance	Fairness and employment-process oversight
Assurance Function	Independent assurance
Human Decision-Maker	Final candidate decision

9. Governance Requirements

The system must not proceed to operational use until:

the system is registered;
its intended purpose is documented;
classification is completed;
risk assessment is completed;
applicable legal requirements are identified;
controls are implemented;
testing is completed;
human oversight is established;
evidence is available;
residual risk is formally considered;
required approval is granted.

10. AIGO Lifecycle

The high-risk system follows the same fundamental AIGO lifecycle, but with enhanced controls.

Govern
   ↓
Identify
   ↓
Classify
   ↓
Assess
   ↓
Treat
   ↓
Approve
   ↓
Deploy
   ↓
Operate
   ↓
Monitor
   ↓
Assure
   ↓
Improve
   ↓
Change / Continue / Suspend / Retire

11. Stage 1 — Governance

The organization identifies the system as requiring enhanced governance before technical deployment. The AI Governance Authority appoints responsible roles and establishes the governance conditions.

12. Governance Decision

ExampleCorp determines: Governance Level: Enhanced Reason:

the system influences employment-related decisions;
individuals may be materially affected;
errors may result in unfair outcomes;
regulatory obligations may apply;
human oversight is essential.

13. Stage 2 — Identify

The system is formally registered in the AI inventory. The registration captures:

system identity;
purpose;
owner;
business process;
affected persons;
data;
model provider;
technical architecture;
dependencies;
lifecycle stage.

14. High-Risk AI Inventory Record

Field	Value
AI ID	`AI-HR-001`
Purpose	Recruitment decision support
Affected Persons	Job applicants
Decision Influence	High
Autonomous Decision	No
Human Oversight	Mandatory
Data Sensitivity	High
Regulatory Exposure	High
Business Criticality	High
Governance Level	Enhanced

15. Stage 3 — Classification

Classification is performed using the AIGO AI Classification Procedure. Factors considered include:

impact on individuals;
decision significance;
degree of automation;
affected population;
sensitivity of data;
potential discrimination;
legal obligations;
operational dependency;
severity of potential harm.

16. Example Classification Result

AIGO Classification: High-Risk AI System The classification is based on the system’s role in an employment-related decision process.

17. Classification Assessment

Criterion	Result
Affects individuals	Yes
Employment-related	Yes
Influences significant decisions	Yes
Autonomous final decision	No
Human oversight	Required
Sensitive data	Potentially
Discrimination risk	Significant
Regulatory exposure	Significant
Classification	High-Risk

18. Classification Consequence

The classification automatically increases governance requirements.

High-Risk Classification
        ↓
Enhanced Risk Assessment
        ↓
Enhanced Controls
        ↓
Enhanced Evidence
        ↓
Enhanced Approval
        ↓
Enhanced Monitoring
        ↓
Enhanced Assurance

19. Stage 4 — Context Assessment

Before assessing individual risks, ExampleCorp documents the system context. The context includes:

recruitment process;
candidate population;
jurisdictions;
job categories;
decision-makers;
data sources;
model characteristics;
organizational objectives;
legal requirements.

20. Affected Stakeholders

Stakeholders include:

job applicants;
recruitment personnel;
hiring managers;
HR leadership;
legal and compliance teams;
privacy function;
security function;
AI governance authority;
executive management.

21. Stage 5 — Risk Assessment

A detailed AI risk assessment is performed. Risk categories include:

fairness;
discrimination;
privacy;
security;
accuracy;
robustness;
explainability;
transparency;
human oversight;
misuse;
third-party dependency;
operational continuity;
legal and regulatory exposure.

22. High-Risk AI Risk Register

Risk ID	Risk	Likelihood	Impact	Rating
HR-R001	Biased candidate ranking	Medium	High	High
HR-R002	Discriminatory outcome	Medium	Very High	Critical
HR-R003	Incorrect candidate exclusion	Medium	High	High
HR-R004	Inaccurate recommendation	Medium	High	High
HR-R005	Privacy violation	Low	High	High
HR-R006	Unauthorized model use	Low	High	High
HR-R007	Automation bias	High	High	High
HR-R008	Model drift	Medium	High	High
HR-R009	Supplier model change	Medium	High	High
HR-R010	Insufficient explainability	Medium	High	High

23. Risk Treatment Principle

For a high-risk system, ExampleCorp does not rely solely on accepting residual risk. The organization first seeks to:

eliminate unnecessary risks;
reduce risks through design;
implement preventive controls;
implement detective controls;
establish human oversight;
monitor residual risks;
formally document accepted residual risks.

24. Risk Treatment Hierarchy

Identify Risk
      ↓
Avoid
      ↓
Reduce
      ↓
Control
      ↓
Monitor
      ↓
Accept Residual Risk

25. Example Risk Treatments

Risk	Treatment
Bias	Bias testing and monitoring
Discrimination	Protected-characteristic impact assessment where legally appropriate
Incorrect exclusion	Mandatory human review
Inaccuracy	Validation and performance thresholds
Privacy	Data minimization and access controls
Unauthorized use	Role-based access
Automation bias	Human decision requirements
Model drift	Periodic performance evaluation
Supplier changes	Change notification and reassessment
Explainability	Decision-support rationale and documentation

26. Stage 6 — Control Design

Controls are designed specifically for the high-risk nature of the system. Controls include:

purpose limitation;
data governance;
access control;
model validation;
performance testing;
fairness testing;
human oversight;
output review;
incident management;
monitoring;
change management;
assurance;
supplier management.

27. Enhanced Control Set

Control ID	Control	Criticality
HR-C001	AI system registration	High
HR-C002	High-risk classification	High
HR-C003	AI risk assessment	Critical
HR-C004	Data governance	Critical
HR-C005	Model validation	Critical
HR-C006	Fairness assessment	Critical
HR-C007	Human oversight	Critical
HR-C008	Decision traceability	High
HR-C009	Performance monitoring	Critical
HR-C010	Incident management	High
HR-C011	Change management	Critical
HR-C012	Independent assurance	Critical

28. Human Oversight

Human oversight is a core control. The system may provide recommendations, but the final decision remains with an authorized human.

AI Analysis
     ↓
AI Recommendation
     ↓
Human Review
     ↓
Challenge / Override
     ↓
Final Human Decision

29. Human Decision Requirements

The human decision-maker must:

understand the AI system’s role;
review relevant information;
consider whether the recommendation is reasonable;
be able to challenge the output;
be able to override the recommendation;
avoid treating the AI output as automatically correct;
record the final decision where required.

30. Automation Bias Control

ExampleCorp recognizes automation bias as a specific risk. Controls include:

user training;
explicit human decision responsibility;
explanation of system limitations;
mandatory review;
random quality checks;
override monitoring.

31. Data Governance

The organization evaluates:

data source legitimacy;
data quality;
relevance;
accuracy;
representativeness;
retention;
access;
provenance;
inappropriate attributes.

32. Data Governance Decision

The system is prohibited from using unnecessary personal information. Only information relevant to the approved recruitment purpose may be processed.

33. Model Validation

Before deployment, the technical and governance teams validate:

accuracy;
reliability;
robustness;
performance;
fairness;
known limitations;
failure conditions.

34. Validation Evidence

Example evidence includes:

Evidence	Purpose
Validation Report	Technical validation
Test Results	Performance
Bias Assessment	Fairness
Data Quality Report	Data suitability
Security Test	Security
User Acceptance Test	Operational suitability
Human Oversight Test	Governance

35. Fairness Assessment

ExampleCorp performs an appropriate fairness assessment based on applicable law, available data, and organizational requirements. The assessment considers whether system outputs could systematically disadvantage particular groups. Potential findings require investigation before deployment.

36. Fairness Decision

If material unexplained disparities are identified, deployment is not automatically permitted. The organization may:

modify the system;
modify data;
introduce additional controls;
restrict the use case;
require additional human review;
suspend deployment.

37. Stage 7 — Control Assessment

Every critical control must be assessed before approval.

Control	Status	Evidence	Result
Registration	Complete	AI inventory	Effective
Classification	Complete	Classification record	Effective
Risk assessment	Complete	Risk register	Effective
Data governance	Complete	Data assessment	Effective
Model validation	Complete	Validation report	Effective
Fairness assessment	Complete	Assessment report	Effective
Human oversight	Complete	Procedure and training	Effective
Decision traceability	Complete	Decision records	Effective
Monitoring	Complete	Monitoring plan	Effective
Incident management	Complete	Procedure	Effective
Change management	Complete	Change process	Effective
Independent assurance	Complete	Assurance report	Effective

38. Stage 8 — Approval

Approval requires enhanced governance authority. The system cannot be deployed solely on the basis of technical acceptance. The approval decision considers:

legal requirements;
risk;
controls;
testing;
fairness;
human oversight;
evidence;
residual risk;
business necessity.

39. Approval Chain

System Owner
     ↓
Risk Review
     ↓
Privacy Review
     ↓
Security Review
     ↓
Legal / Compliance Review
     ↓
AI Governance Review
     ↓
Executive Approval
     ↓
Controlled Deployment

40. Approval Conditions

Approval may include conditions such as:

limited initial deployment;
mandatory human review;
restricted user population;
enhanced monitoring;
periodic fairness testing;
mandatory incident reporting;
scheduled reassessment.

41. Example Approval Record

Field	Example
AI System	`AI-HR-001`
Decision	Approved with Conditions
Authority	AI Governance Authority
Conditions	Human review mandatory
Monitoring	Enhanced
Assurance	Quarterly
Risk Acceptance	Formal
Review Date
Approver

42. Stage 9 — Controlled Deployment

Deployment is performed in stages. ExampleCorp begins with a limited pilot.

Approved
   ↓
Pilot
   ↓
Enhanced Monitoring
   ↓
Performance Review
   ↓
Governance Review
   ↓
Controlled Expansion

43. Pilot Conditions

The pilot requires:

restricted users;
restricted job categories;
increased human review;
enhanced monitoring;
incident escalation;
predefined stop criteria.

44. Stop Criteria

Deployment must be paused if:

serious discrimination concerns arise;
material control failure occurs;
unauthorized data is processed;
system performance falls below threshold;
significant unexplained model behavior occurs;
required human oversight fails.

45. Stage 10 — Operation

During operation, ExampleCorp continuously manages:

system performance;
candidate-impact indicators;
incidents;
user behavior;
model changes;
supplier changes;
control effectiveness.

46. Operational Control Model

AI System
   ↓
AI Recommendation
   ↓
Human Review
   ↓
Decision
   ↓
Decision Record
   ↓
Monitoring
   ↓
Assurance

47. Stage 11 — Monitoring

Monitoring is more intensive than for a standard AI system. Monitoring includes:

accuracy;
performance;
fairness indicators;
override rates;
complaints;
incidents;
system drift;
data changes;
model changes;
control failures.

48. Example Monitoring Metrics

Metric	Example Threshold
Model performance	Organizational threshold
Material fairness concern	Immediate escalation
Human override rate	Investigation threshold
Critical incident	Immediate escalation
Unauthorized access	Zero tolerance
Control failure	Immediate remediation
Model drift	Reassessment threshold
Complaint trend	Investigation threshold

49. Monitoring Escalation

Monitoring
    ↓
Normal
    ↓
Threshold Breach?
   ↙          ↘
 No           Yes
 ↓             ↓
Continue    Investigate
               ↓
          Risk Assessment
               ↓
        Corrective Action
               ↓
          Reassessment

50. Stage 12 — Incident Example

Suppose monitoring identifies a significant difference in candidate prioritization between demographic groups. The issue is treated as a potential high-severity AI governance incident.

51. Incident Record

Field	Example
Incident ID	`HR-INC-001`
System	`AI-HR-001`
Issue	Potential discriminatory outcome
Severity	High
Detection	Monitoring
Immediate Action	Suspend affected use case
Investigation	Required
Risk Reassessment	Required
Governance Escalation	Yes
Status	Open

52. Incident Response

Detect
   ↓
Escalate
   ↓
Suspend / Contain
   ↓
Investigate
   ↓
Assess Impact
   ↓
Root Cause
   ↓
Correct
   ↓
Validate
   ↓
Governance Decision
   ↓
Resume / Restrict / Retire

53. Immediate Containment

ExampleCorp may temporarily:

suspend automated recommendations;
require manual candidate review;
restrict affected job categories;
preserve evidence;
notify relevant governance functions;
begin root-cause analysis.

54. Root Cause Analysis

The investigation may consider:

training data;
data representation;
model behavior;
feature selection;
system configuration;
implementation changes;
user behavior;
supplier changes.

55. Corrective Action

Possible corrective actions include:

retraining;
data correction;
model modification;
additional controls;
revised thresholds;
enhanced human review;
restriction of system use;
additional validation.

56. Stage 13 — Assurance

High-risk AI requires stronger assurance. Assurance may be:

more frequent;
independent;
evidence-based;
risk-focused;
triggered by significant events.

57. Assurance Scope

Assurance examines:

governance;
system purpose;
classification;
risk;
controls;
data;
model validation;
fairness;
human oversight;
monitoring;
incidents;
changes;
evidence;
management decisions.

58. Assurance Finding

Example assurance finding: Finding HR-F001 — Human Override Monitoring Insufficient The organization has documented human override requirements, but override behavior is not being consistently monitored.

59. Corrective Action

Field	Example
Finding	Override monitoring insufficient
Severity	Medium
Root Cause	Monitoring design incomplete
Action	Implement override monitoring
Owner	System Owner
Due Date
Verification	Assurance Function
Status	Open

60. Stage 14 — Change Management

High-risk systems require formal reassessment for material changes. Changes include:

new model;
new data;
new provider;
new purpose;
new user population;
new geography;
new decision context;
significant model update.

61. Material Change Flow

Change Request
      ↓
Materiality Assessment
      ↓
Risk Reassessment
      ↓
Control Reassessment
      ↓
Testing
      ↓
Assurance
      ↓
Approval
      ↓
Controlled Release

62. Example Material Change

ExampleCorp proposes using the system for executive recruitment. This is considered a material change because:

the affected population changes;
decision significance increases;
risk profile changes;
governance expectations may change.

The existing approval does not automatically authorize the new use.

63. Change Decision

The organization requires:

new risk assessment;
classification review;
legal review;
additional testing;
control reassessment;
new approval.

64. Stage 15 — Periodic Review

The system undergoes scheduled management review. The review considers:

current risk;
incidents;
control performance;
monitoring;
complaints;
model changes;
regulatory changes;
business necessity;
assurance findings.

65. Management Review Decision

Possible decisions:

Periodic Review
      ↓
Continue
   or
Enhance Controls
   or
Restrict
   or
Suspend
   or
Retire

66. Residual Risk

After controls are implemented, ExampleCorp determines residual risk. Residual risk must be:

documented;
understood;
within approved tolerance;
assigned to an accountable owner;
periodically reviewed.

67. Risk Acceptance

Formal risk acceptance requires appropriate authority.

Residual Risk
      ↓
Risk Owner Review
      ↓
Governance Review
      ↓
Acceptance?
   ↙        ↘
 Yes        No
 ↓           ↓
Operate   Treat / Restrict

68. Example Risk Acceptance

Field	Example
Risk	Residual fairness risk
Rating	Medium
Treatment	Enhanced monitoring
Risk Owner	Enterprise Risk Manager
Acceptance Authority	AI Governance Authority
Conditions	Quarterly fairness assessment
Review	Quarterly

69. Stage 16 — Improvement

Lessons from:

incidents;
monitoring;
assurance;
user feedback;
regulatory developments;
technology changes;

are incorporated into the governance system.

70. Continual Improvement Cycle

Monitor
   ↓
Measure
   ↓
Identify Finding
   ↓
Analyze Cause
   ↓
Improve
   ↓
Implement
   ↓
Verify
   ↓
Standardize

71. Stage 17 — Continue, Restrict, Suspend or Retire

At the end of each review cycle, the organization determines the appropriate lifecycle decision. Possible outcomes:

continue;
continue with conditions;
restrict;
suspend;
replace;
retire.

72. Retirement Decision

Retirement may be triggered by:

unacceptable residual risk;
repeated control failure;
inability to maintain fairness;
obsolete technology;
regulatory prohibition;
business discontinuation;
replacement by a safer solution.

73. Retirement Flow

Retirement Trigger
      ↓
Impact Assessment
      ↓
Governance Decision
      ↓
Disable System
      ↓
Preserve Required Evidence
      ↓
Data / Access Closure
      ↓
Supplier Closure
      ↓
Retirement Verification
      ↓
Close Lifecycle

74. High-Risk AI Evidence Package

The evidence package is more extensive than for a standard AI system.

Evidence Category	Examples
Governance	Committee decisions
Registration	AI inventory
Classification	High-risk classification
Risk	Risk assessment
Data	Data governance assessment
Model	Validation report
Fairness	Fairness assessment
Controls	Control assessment
Human Oversight	Training and review records
Approval	Formal approval
Monitoring	Performance records
Incidents	Incident reports
Assurance	Assurance reports
Changes	Change records
Improvement	Corrective actions
Lifecycle	Continuation / retirement decisions

75. End-to-End Traceability

AI System
   ↓
Purpose
   ↓
Affected Persons
   ↓
Classification
   ↓
Risk
   ↓
Control
   ↓
Procedure
   ↓
Evidence
   ↓
Approval
   ↓
Human Decision
   ↓
Monitoring
   ↓
Incident
   ↓
Assurance
   ↓
Improvement
   ↓
Change / Continue / Suspend / Retire

76. Example Traceability Matrix

AIGO Element	Example
AI System	Candidate Assessment Assistant
Governance	AI Governance Authority
Classification	High-Risk
Risk	Discriminatory outcome
Control	Human oversight
Procedure	AI Risk Assessment Procedure
Evidence	Risk assessment
Approval	Enhanced governance approval
Operation	Controlled recruitment support
Monitoring	Fairness and performance monitoring
Incident	Potential discriminatory outcome
Assurance	Independent assurance
Improvement	Corrective action
Change	New recruitment population
Lifecycle Decision	Continue / Restrict / Suspend / Retire

77. Relationship to ISO/IEC 42001

The example demonstrates how an AIGO high-risk AI governance process can support management-system activities associated with:

organizational context;
leadership;
planning;
risk management;
operational controls;
performance evaluation;
management review;
continual improvement.

The precise applicability of ISO/IEC 42001 requirements must be assessed against the organization’s implementation and the applicable standard.

78. Relationship to NIST AI RMF

The example can also be represented through the four NIST AI RMF Functions.

Function	Example
GOVERN	Governance authority, roles and accountability
MAP	System purpose, stakeholders, affected persons and context
MEASURE	Risk, fairness, performance and control assessment
MANAGE	Risk treatment, incident response and corrective action

79. Comparison With Basic AI Example

Dimension	Basic AI	High-Risk AI
Governance	Standard	Enhanced
Risk Assessment	Standard	Detailed
Human Oversight	Appropriate	Mandatory / strengthened
Testing	Proportionate	Extensive
Evidence	Standard	Enhanced
Monitoring	Periodic	Enhanced
Assurance	Periodic	More frequent / independent
Change Management	Standard	Strict
Approval	Standard	Enhanced
Risk Acceptance	Proportionate	Formal
Incident Escalation	Standard	Immediate for serious events

80. Key Governance Lessons

This example demonstrates that higher AI risk should result in proportionately stronger governance. Important principles include:

classification must influence governance intensity;
affected persons must be considered;
risk assessment must address potential harm;
controls must address identified risks;
human oversight must be meaningful;
technical validation is not sufficient by itself;
fairness and impact considerations require evidence;
approval must be based on evidence;
monitoring must continue throughout operation;
material changes require reassessment;
incidents must feed continual improvement;
retirement must be governed as carefully as deployment.

81. Minimum High-Risk AI Governance Package

A high-risk AI system should generally have, at minimum:

system registration;
documented purpose;
identified stakeholders;
classification;
comprehensive risk assessment;
risk treatment;
control assessment;
data governance;
model validation;
appropriate impact/fairness assessment;
human oversight;
approval;
monitoring;
incident management;
assurance;
change management;
management review;
documented lifecycle decision.

The actual minimum package should be determined by applicable organizational and legal requirements.

82. Example Final Operational State

At the conclusion of this example: System: Active under enhanced governance Lifecycle Stage: Operate / Monitor Classification: High-Risk Human Oversight: Mandatory Risk: Residual risk formally accepted Controls: Operational Monitoring: Enhanced Assurance: Periodic and independent Approval: Conditional / controlled Decision: Continue with conditions

83. Final Governance Model

High-Risk AI System
        ↓
Governance Authority
        ↓
Identification
        ↓
High-Risk Classification
        ↓
Comprehensive Risk Assessment
        ↓
Enhanced Controls
        ↓
Validation & Testing
        ↓
Human Oversight
        ↓
Evidence
        ↓
Enhanced Approval
        ↓
Controlled Deployment
        ↓
Enhanced Monitoring
        ↓
Assurance
        ↓
Continual Improvement
        ↓
Reassessment
        ↓
Continue / Restrict / Suspend / Retire

84. Relationship to Future AIGO Templates

This example provides requirements that should later be reflected in AIGO templates, including:

high-risk AI system profile;
enhanced classification assessment;
high-risk risk assessment;
impact/fairness assessment;
model validation record;
human oversight record;
enhanced control assessment;
approval record;
monitoring record;
incident record;
assurance record;
change assessment;
risk acceptance record;
lifecycle decision record.

Templates should be finalized only after the examples, framework, procedures, and mappings have been sufficiently validated.

85. Document Status

Document: AIGO — High-Risk AI System Example Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-EXAMPLE-002 Document Type: Implementation Example Example Type: High-Risk AI System This document provides an illustrative example of enhanced AIGO governance for an AI system presenting significant potential impact and risk.

86. End of Example Document

AIGO — High-Risk AI System Example Document ID: AIGO-EXAMPLE-002 Version: 0.1 Status: Draft End of Document

​AIGO — High-Risk AI System Example

​AIGO — AI Governance Operating Framework

​1. Purpose

​2. Example Organization

​3. Example AI System

​4. Intended Purpose

​5. Example System Profile

​6. Why Enhanced Governance Is Required

​7. Governance Model

​8. Enhanced Governance Roles

​9. Governance Requirements

​10. AIGO Lifecycle

​11. Stage 1 — Governance

​12. Governance Decision

​13. Stage 2 — Identify

​14. High-Risk AI Inventory Record

​15. Stage 3 — Classification

​16. Example Classification Result

​17. Classification Assessment

​18. Classification Consequence

​19. Stage 4 — Context Assessment

​20. Affected Stakeholders

​21. Stage 5 — Risk Assessment

​22. High-Risk AI Risk Register

​23. Risk Treatment Principle

​24. Risk Treatment Hierarchy

​25. Example Risk Treatments

​26. Stage 6 — Control Design

​27. Enhanced Control Set

​28. Human Oversight

​29. Human Decision Requirements

​30. Automation Bias Control

​31. Data Governance

​32. Data Governance Decision

​33. Model Validation

​34. Validation Evidence

​35. Fairness Assessment

​36. Fairness Decision

​37. Stage 7 — Control Assessment

​38. Stage 8 — Approval

​39. Approval Chain

​40. Approval Conditions

​41. Example Approval Record

​42. Stage 9 — Controlled Deployment

​43. Pilot Conditions

​44. Stop Criteria

​45. Stage 10 — Operation

​46. Operational Control Model

​47. Stage 11 — Monitoring

​48. Example Monitoring Metrics

​49. Monitoring Escalation

​50. Stage 12 — Incident Example

​51. Incident Record

​52. Incident Response

​53. Immediate Containment

​54. Root Cause Analysis

​55. Corrective Action

​56. Stage 13 — Assurance

​57. Assurance Scope

​58. Assurance Finding

​59. Corrective Action

​60. Stage 14 — Change Management

​61. Material Change Flow

​62. Example Material Change

​63. Change Decision

​64. Stage 15 — Periodic Review

​65. Management Review Decision

​66. Residual Risk

​67. Risk Acceptance

​68. Example Risk Acceptance

​69. Stage 16 — Improvement

​70. Continual Improvement Cycle

​71. Stage 17 — Continue, Restrict, Suspend or Retire

​72. Retirement Decision

​73. Retirement Flow

​74. High-Risk AI Evidence Package

​75. End-to-End Traceability

​76. Example Traceability Matrix

​77. Relationship to ISO/IEC 42001

​78. Relationship to NIST AI RMF