> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 02 AIGO High Risk AI System Example v0.1

# AIGO — High-Risk AI System Example

## AIGO — AI Governance Operating Framework

**Version:** 0.1
**Status:** Draft
**Working Name:** AIGO
**Full Name:** AI Governance Operating Framework
**Document Identifier:** `AIGO-EXAMPLE-002`
**Document Type:** Implementation Example
**Example Type:** High-Risk AI System
**Related Framework:** AIGO AI Governance Operating Framework

***

## 1. Purpose

This document provides an illustrative end-to-end example of how AIGO can be applied to an AI system presenting a significantly higher level of risk than the basic AI system described in the previous example.

The purpose is to demonstrate how increased risk can result in:

* stronger governance;
* enhanced accountability;
* deeper risk assessment;
* increased control requirements;
* stronger human oversight;
* enhanced evidence requirements;
* more restrictive approval;
* increased monitoring;
* more frequent assurance;
* formal change assessment;
* controlled continuation or retirement.

This example is illustrative. Actual governance requirements should be determined according to the organization's context, applicable law, regulatory requirements, standards, contracts, and the characteristics of the AI system.

***

# 2. Example Organization

For this example, the organization is **ExampleCorp**, a fictional organization with an established AIGO governance program.

ExampleCorp operates a large recruitment function and uses AI to assist with candidate screening and prioritization.

Because the system may influence employment-related decisions, ExampleCorp applies enhanced governance.

***

# 3. Example AI System

The example AI system is called:

**ExampleCorp Candidate Assessment Assistant**

The system analyzes candidate information and generates a recommendation concerning whether a candidate should progress to the next stage of recruitment.

The system does not have final hiring authority.

A designated human decision-maker remains responsible for the final recruitment decision.

***

# 4. Intended Purpose

The system is intended to:

* assist recruitment personnel in reviewing candidate information;
* identify candidates meeting defined job-related criteria;
* prioritize candidates for human review;
* identify potentially relevant qualifications;
* support consistent processing of high volumes of applications.

The system is **not intended** to:

* make autonomous hiring decisions;
* reject candidates without human review;
* infer protected characteristics;
* evaluate candidates using unrelated personal attributes;
* replace recruitment professionals.

***

# 5. Example System Profile

| Field             | Example                            |
| ----------------- | ---------------------------------- |
| AI System ID      | `AI-HR-001`                        |
| System Name       | Candidate Assessment Assistant     |
| Business Owner    | Chief People Officer               |
| System Owner      | Head of Talent Technology          |
| Technical Owner   | AI Platform Team                   |
| Risk Owner        | Enterprise Risk Manager            |
| Privacy Owner     | Data Protection Officer            |
| Security Owner    | Chief Information Security Officer |
| Lifecycle Stage   | Pre-deployment                     |
| Classification    | High-Risk                          |
| Business Function | Human Resources                    |
| Intended Users    | Authorized recruitment personnel   |
| Affected Persons  | Job applicants                     |
| AI Capability     | Classification / Recommendation    |
| Human Decision    | Required                           |
| Status            | Under Controlled Deployment        |

***

# 6. Why Enhanced Governance Is Required

The system can influence decisions affecting individuals.

Potential consequences include:

* unfair treatment;
* discrimination;
* inappropriate exclusion;
* privacy impacts;
* inaccurate candidate evaluation;
* lack of transparency;
* automation bias;
* reputational damage;
* regulatory exposure.

Accordingly, ExampleCorp applies enhanced AIGO governance.

***

# 7. Governance Model

The governance structure is strengthened compared with a standard AI system.

```text theme={null}
Executive Accountability
        ↓
AI Governance Authority
        ↓
High-Risk AI Oversight
        ↓
System Owner
        ↓
Risk / Privacy / Security / Legal Functions
        ↓
Operational Users
        ↓
Human Decision-Maker
```

***

# 8. Enhanced Governance Roles

| Role                    | Responsibility                             |
| ----------------------- | ------------------------------------------ |
| Executive Sponsor       | Overall organizational accountability      |
| AI Governance Authority | Governance decision-making                 |
| System Owner            | End-to-end system accountability           |
| Business Owner          | Recruitment process accountability         |
| Risk Owner              | Risk acceptance and treatment              |
| Privacy Owner           | Privacy requirements                       |
| Security Owner          | Security controls                          |
| Legal / Compliance      | Regulatory interpretation                  |
| Model Owner             | Model performance and technical governance |
| HR Governance           | Fairness and employment-process oversight  |
| Assurance Function      | Independent assurance                      |
| Human Decision-Maker    | Final candidate decision                   |

***

# 9. Governance Requirements

The system must not proceed to operational use until:

* the system is registered;
* its intended purpose is documented;
* classification is completed;
* risk assessment is completed;
* applicable legal requirements are identified;
* controls are implemented;
* testing is completed;
* human oversight is established;
* evidence is available;
* residual risk is formally considered;
* required approval is granted.

***

# 10. AIGO Lifecycle

The high-risk system follows the same fundamental AIGO lifecycle, but with enhanced controls.

```text theme={null}
Govern
   ↓
Identify
   ↓
Classify
   ↓
Assess
   ↓
Treat
   ↓
Approve
   ↓
Deploy
   ↓
Operate
   ↓
Monitor
   ↓
Assure
   ↓
Improve
   ↓
Change / Continue / Suspend / Retire
```

***

# 11. Stage 1 — Governance

The organization identifies the system as requiring enhanced governance before technical deployment.

The AI Governance Authority appoints responsible roles and establishes the governance conditions.

***

# 12. Governance Decision

ExampleCorp determines:

**Governance Level: Enhanced**

Reason:

* the system influences employment-related decisions;
* individuals may be materially affected;
* errors may result in unfair outcomes;
* regulatory obligations may apply;
* human oversight is essential.

***

# 13. Stage 2 — Identify

The system is formally registered in the AI inventory.

The registration captures:

* system identity;
* purpose;
* owner;
* business process;
* affected persons;
* data;
* model provider;
* technical architecture;
* dependencies;
* lifecycle stage.

***

# 14. High-Risk AI Inventory Record

| Field                | Value                        |
| -------------------- | ---------------------------- |
| AI ID                | `AI-HR-001`                  |
| Purpose              | Recruitment decision support |
| Affected Persons     | Job applicants               |
| Decision Influence   | High                         |
| Autonomous Decision  | No                           |
| Human Oversight      | Mandatory                    |
| Data Sensitivity     | High                         |
| Regulatory Exposure  | High                         |
| Business Criticality | High                         |
| Governance Level     | Enhanced                     |

***

# 15. Stage 3 — Classification

Classification is performed using the AIGO AI Classification Procedure.

Factors considered include:

* impact on individuals;
* decision significance;
* degree of automation;
* affected population;
* sensitivity of data;
* potential discrimination;
* legal obligations;
* operational dependency;
* severity of potential harm.

***

# 16. Example Classification Result

**AIGO Classification: High-Risk AI System**

The classification is based on the system's role in an employment-related decision process.

***

# 17. Classification Assessment

| Criterion                        | Result      |
| -------------------------------- | ----------- |
| Affects individuals              | Yes         |
| Employment-related               | Yes         |
| Influences significant decisions | Yes         |
| Autonomous final decision        | No          |
| Human oversight                  | Required    |
| Sensitive data                   | Potentially |
| Discrimination risk              | Significant |
| Regulatory exposure              | Significant |
| Classification                   | High-Risk   |

***

# 18. Classification Consequence

The classification automatically increases governance requirements.

```text theme={null}
High-Risk Classification
        ↓
Enhanced Risk Assessment
        ↓
Enhanced Controls
        ↓
Enhanced Evidence
        ↓
Enhanced Approval
        ↓
Enhanced Monitoring
        ↓
Enhanced Assurance
```

***

# 19. Stage 4 — Context Assessment

Before assessing individual risks, ExampleCorp documents the system context.

The context includes:

* recruitment process;
* candidate population;
* jurisdictions;
* job categories;
* decision-makers;
* data sources;
* model characteristics;
* organizational objectives;
* legal requirements.

***

# 20. Affected Stakeholders

Stakeholders include:

* job applicants;
* recruitment personnel;
* hiring managers;
* HR leadership;
* legal and compliance teams;
* privacy function;
* security function;
* AI governance authority;
* executive management.

***

# 21. Stage 5 — Risk Assessment

A detailed AI risk assessment is performed.

Risk categories include:

* fairness;
* discrimination;
* privacy;
* security;
* accuracy;
* robustness;
* explainability;
* transparency;
* human oversight;
* misuse;
* third-party dependency;
* operational continuity;
* legal and regulatory exposure.

***

# 22. High-Risk AI Risk Register

| Risk ID | Risk                          | Likelihood | Impact    | Rating   |
| ------- | ----------------------------- | ---------- | --------- | -------- |
| HR-R001 | Biased candidate ranking      | Medium     | High      | High     |
| HR-R002 | Discriminatory outcome        | Medium     | Very High | Critical |
| HR-R003 | Incorrect candidate exclusion | Medium     | High      | High     |
| HR-R004 | Inaccurate recommendation     | Medium     | High      | High     |
| HR-R005 | Privacy violation             | Low        | High      | High     |
| HR-R006 | Unauthorized model use        | Low        | High      | High     |
| HR-R007 | Automation bias               | High       | High      | High     |
| HR-R008 | Model drift                   | Medium     | High      | High     |
| HR-R009 | Supplier model change         | Medium     | High      | High     |
| HR-R010 | Insufficient explainability   | Medium     | High      | High     |

***

# 23. Risk Treatment Principle

For a high-risk system, ExampleCorp does not rely solely on accepting residual risk.

The organization first seeks to:

1. eliminate unnecessary risks;
2. reduce risks through design;
3. implement preventive controls;
4. implement detective controls;
5. establish human oversight;
6. monitor residual risks;
7. formally document accepted residual risks.

***

# 24. Risk Treatment Hierarchy

```text theme={null}
Identify Risk
      ↓
Avoid
      ↓
Reduce
      ↓
Control
      ↓
Monitor
      ↓
Accept Residual Risk
```

***

# 25. Example Risk Treatments

| Risk                | Treatment                                                            |
| ------------------- | -------------------------------------------------------------------- |
| Bias                | Bias testing and monitoring                                          |
| Discrimination      | Protected-characteristic impact assessment where legally appropriate |
| Incorrect exclusion | Mandatory human review                                               |
| Inaccuracy          | Validation and performance thresholds                                |
| Privacy             | Data minimization and access controls                                |
| Unauthorized use    | Role-based access                                                    |
| Automation bias     | Human decision requirements                                          |
| Model drift         | Periodic performance evaluation                                      |
| Supplier changes    | Change notification and reassessment                                 |
| Explainability      | Decision-support rationale and documentation                         |

***

# 26. Stage 6 — Control Design

Controls are designed specifically for the high-risk nature of the system.

Controls include:

* purpose limitation;
* data governance;
* access control;
* model validation;
* performance testing;
* fairness testing;
* human oversight;
* output review;
* incident management;
* monitoring;
* change management;
* assurance;
* supplier management.

***

# 27. Enhanced Control Set

| Control ID | Control                  | Criticality |
| ---------- | ------------------------ | ----------- |
| HR-C001    | AI system registration   | High        |
| HR-C002    | High-risk classification | High        |
| HR-C003    | AI risk assessment       | Critical    |
| HR-C004    | Data governance          | Critical    |
| HR-C005    | Model validation         | Critical    |
| HR-C006    | Fairness assessment      | Critical    |
| HR-C007    | Human oversight          | Critical    |
| HR-C008    | Decision traceability    | High        |
| HR-C009    | Performance monitoring   | Critical    |
| HR-C010    | Incident management      | High        |
| HR-C011    | Change management        | Critical    |
| HR-C012    | Independent assurance    | Critical    |

***

# 28. Human Oversight

Human oversight is a core control.

The system may provide recommendations, but the final decision remains with an authorized human.

```text theme={null}
AI Analysis
     ↓
AI Recommendation
     ↓
Human Review
     ↓
Challenge / Override
     ↓
Final Human Decision
```

***

# 29. Human Decision Requirements

The human decision-maker must:

* understand the AI system's role;
* review relevant information;
* consider whether the recommendation is reasonable;
* be able to challenge the output;
* be able to override the recommendation;
* avoid treating the AI output as automatically correct;
* record the final decision where required.

***

# 30. Automation Bias Control

ExampleCorp recognizes automation bias as a specific risk.

Controls include:

* user training;
* explicit human decision responsibility;
* explanation of system limitations;
* mandatory review;
* random quality checks;
* override monitoring.

***

# 31. Data Governance

The organization evaluates:

* data source legitimacy;
* data quality;
* relevance;
* accuracy;
* representativeness;
* retention;
* access;
* provenance;
* inappropriate attributes.

***

# 32. Data Governance Decision

The system is prohibited from using unnecessary personal information.

Only information relevant to the approved recruitment purpose may be processed.

***

# 33. Model Validation

Before deployment, the technical and governance teams validate:

* accuracy;
* reliability;
* robustness;
* performance;
* fairness;
* known limitations;
* failure conditions.

***

# 34. Validation Evidence

Example evidence includes:

| Evidence             | Purpose                 |
| -------------------- | ----------------------- |
| Validation Report    | Technical validation    |
| Test Results         | Performance             |
| Bias Assessment      | Fairness                |
| Data Quality Report  | Data suitability        |
| Security Test        | Security                |
| User Acceptance Test | Operational suitability |
| Human Oversight Test | Governance              |

***

# 35. Fairness Assessment

ExampleCorp performs an appropriate fairness assessment based on applicable law, available data, and organizational requirements.

The assessment considers whether system outputs could systematically disadvantage particular groups.

Potential findings require investigation before deployment.

***

# 36. Fairness Decision

If material unexplained disparities are identified, deployment is not automatically permitted.

The organization may:

* modify the system;
* modify data;
* introduce additional controls;
* restrict the use case;
* require additional human review;
* suspend deployment.

***

# 37. Stage 7 — Control Assessment

Every critical control must be assessed before approval.

| Control               | Status   | Evidence               | Result    |
| --------------------- | -------- | ---------------------- | --------- |
| Registration          | Complete | AI inventory           | Effective |
| Classification        | Complete | Classification record  | Effective |
| Risk assessment       | Complete | Risk register          | Effective |
| Data governance       | Complete | Data assessment        | Effective |
| Model validation      | Complete | Validation report      | Effective |
| Fairness assessment   | Complete | Assessment report      | Effective |
| Human oversight       | Complete | Procedure and training | Effective |
| Decision traceability | Complete | Decision records       | Effective |
| Monitoring            | Complete | Monitoring plan        | Effective |
| Incident management   | Complete | Procedure              | Effective |
| Change management     | Complete | Change process         | Effective |
| Independent assurance | Complete | Assurance report       | Effective |

***

# 38. Stage 8 — Approval

Approval requires enhanced governance authority.

The system cannot be deployed solely on the basis of technical acceptance.

The approval decision considers:

* legal requirements;
* risk;
* controls;
* testing;
* fairness;
* human oversight;
* evidence;
* residual risk;
* business necessity.

***

# 39. Approval Chain

```text theme={null}
System Owner
     ↓
Risk Review
     ↓
Privacy Review
     ↓
Security Review
     ↓
Legal / Compliance Review
     ↓
AI Governance Review
     ↓
Executive Approval
     ↓
Controlled Deployment
```

***

# 40. Approval Conditions

Approval may include conditions such as:

* limited initial deployment;
* mandatory human review;
* restricted user population;
* enhanced monitoring;
* periodic fairness testing;
* mandatory incident reporting;
* scheduled reassessment.

***

# 41. Example Approval Record

| Field           | Example                  |
| --------------- | ------------------------ |
| AI System       | `AI-HR-001`              |
| Decision        | Approved with Conditions |
| Authority       | AI Governance Authority  |
| Conditions      | Human review mandatory   |
| Monitoring      | Enhanced                 |
| Assurance       | Quarterly                |
| Risk Acceptance | Formal                   |
| Review Date     |                          |
| Approver        |                          |

***

# 42. Stage 9 — Controlled Deployment

Deployment is performed in stages.

ExampleCorp begins with a limited pilot.

```text theme={null}
Approved
   ↓
Pilot
   ↓
Enhanced Monitoring
   ↓
Performance Review
   ↓
Governance Review
   ↓
Controlled Expansion
```

***

# 43. Pilot Conditions

The pilot requires:

* restricted users;
* restricted job categories;
* increased human review;
* enhanced monitoring;
* incident escalation;
* predefined stop criteria.

***

# 44. Stop Criteria

Deployment must be paused if:

* serious discrimination concerns arise;
* material control failure occurs;
* unauthorized data is processed;
* system performance falls below threshold;
* significant unexplained model behavior occurs;
* required human oversight fails.

***

# 45. Stage 10 — Operation

During operation, ExampleCorp continuously manages:

* system performance;
* candidate-impact indicators;
* incidents;
* user behavior;
* model changes;
* supplier changes;
* control effectiveness.

***

# 46. Operational Control Model

```text theme={null}
AI System
   ↓
AI Recommendation
   ↓
Human Review
   ↓
Decision
   ↓
Decision Record
   ↓
Monitoring
   ↓
Assurance
```

***

# 47. Stage 11 — Monitoring

Monitoring is more intensive than for a standard AI system.

Monitoring includes:

* accuracy;
* performance;
* fairness indicators;
* override rates;
* complaints;
* incidents;
* system drift;
* data changes;
* model changes;
* control failures.

***

# 48. Example Monitoring Metrics

| Metric                    | Example Threshold        |
| ------------------------- | ------------------------ |
| Model performance         | Organizational threshold |
| Material fairness concern | Immediate escalation     |
| Human override rate       | Investigation threshold  |
| Critical incident         | Immediate escalation     |
| Unauthorized access       | Zero tolerance           |
| Control failure           | Immediate remediation    |
| Model drift               | Reassessment threshold   |
| Complaint trend           | Investigation threshold  |

***

# 49. Monitoring Escalation

```text theme={null}
Monitoring
    ↓
Normal
    ↓
Threshold Breach?
   ↙          ↘
 No           Yes
 ↓             ↓
Continue    Investigate
               ↓
          Risk Assessment
               ↓
        Corrective Action
               ↓
          Reassessment
```

***

# 50. Stage 12 — Incident Example

Suppose monitoring identifies a significant difference in candidate prioritization between demographic groups.

The issue is treated as a potential high-severity AI governance incident.

***

# 51. Incident Record

| Field                 | Example                          |
| --------------------- | -------------------------------- |
| Incident ID           | `HR-INC-001`                     |
| System                | `AI-HR-001`                      |
| Issue                 | Potential discriminatory outcome |
| Severity              | High                             |
| Detection             | Monitoring                       |
| Immediate Action      | Suspend affected use case        |
| Investigation         | Required                         |
| Risk Reassessment     | Required                         |
| Governance Escalation | Yes                              |
| Status                | Open                             |

***

# 52. Incident Response

```text theme={null}
Detect
   ↓
Escalate
   ↓
Suspend / Contain
   ↓
Investigate
   ↓
Assess Impact
   ↓
Root Cause
   ↓
Correct
   ↓
Validate
   ↓
Governance Decision
   ↓
Resume / Restrict / Retire
```

***

# 53. Immediate Containment

ExampleCorp may temporarily:

* suspend automated recommendations;
* require manual candidate review;
* restrict affected job categories;
* preserve evidence;
* notify relevant governance functions;
* begin root-cause analysis.

***

# 54. Root Cause Analysis

The investigation may consider:

* training data;
* data representation;
* model behavior;
* feature selection;
* system configuration;
* implementation changes;
* user behavior;
* supplier changes.

***

# 55. Corrective Action

Possible corrective actions include:

* retraining;
* data correction;
* model modification;
* additional controls;
* revised thresholds;
* enhanced human review;
* restriction of system use;
* additional validation.

***

# 56. Stage 13 — Assurance

High-risk AI requires stronger assurance.

Assurance may be:

* more frequent;
* independent;
* evidence-based;
* risk-focused;
* triggered by significant events.

***

# 57. Assurance Scope

Assurance examines:

1. governance;
2. system purpose;
3. classification;
4. risk;
5. controls;
6. data;
7. model validation;
8. fairness;
9. human oversight;
10. monitoring;
11. incidents;
12. changes;
13. evidence;
14. management decisions.

***

# 58. Assurance Finding

Example assurance finding:

**Finding HR-F001 — Human Override Monitoring Insufficient**

The organization has documented human override requirements, but override behavior is not being consistently monitored.

***

# 59. Corrective Action

| Field        | Example                          |
| ------------ | -------------------------------- |
| Finding      | Override monitoring insufficient |
| Severity     | Medium                           |
| Root Cause   | Monitoring design incomplete     |
| Action       | Implement override monitoring    |
| Owner        | System Owner                     |
| Due Date     |                                  |
| Verification | Assurance Function               |
| Status       | Open                             |

***

# 60. Stage 14 — Change Management

High-risk systems require formal reassessment for material changes.

Changes include:

* new model;
* new data;
* new provider;
* new purpose;
* new user population;
* new geography;
* new decision context;
* significant model update.

***

# 61. Material Change Flow

```text theme={null}
Change Request
      ↓
Materiality Assessment
      ↓
Risk Reassessment
      ↓
Control Reassessment
      ↓
Testing
      ↓
Assurance
      ↓
Approval
      ↓
Controlled Release
```

***

# 62. Example Material Change

ExampleCorp proposes using the system for executive recruitment.

This is considered a material change because:

* the affected population changes;
* decision significance increases;
* risk profile changes;
* governance expectations may change.

The existing approval does not automatically authorize the new use.

***

# 63. Change Decision

The organization requires:

* new risk assessment;
* classification review;
* legal review;
* additional testing;
* control reassessment;
* new approval.

***

# 64. Stage 15 — Periodic Review

The system undergoes scheduled management review.

The review considers:

* current risk;
* incidents;
* control performance;
* monitoring;
* complaints;
* model changes;
* regulatory changes;
* business necessity;
* assurance findings.

***

# 65. Management Review Decision

Possible decisions:

```text theme={null}
Periodic Review
      ↓
Continue
   or
Enhance Controls
   or
Restrict
   or
Suspend
   or
Retire
```

***

# 66. Residual Risk

After controls are implemented, ExampleCorp determines residual risk.

Residual risk must be:

* documented;
* understood;
* within approved tolerance;
* assigned to an accountable owner;
* periodically reviewed.

***

# 67. Risk Acceptance

Formal risk acceptance requires appropriate authority.

```text theme={null}
Residual Risk
      ↓
Risk Owner Review
      ↓
Governance Review
      ↓
Acceptance?
   ↙        ↘
 Yes        No
 ↓           ↓
Operate   Treat / Restrict
```

***

# 68. Example Risk Acceptance

| Field                | Example                       |
| -------------------- | ----------------------------- |
| Risk                 | Residual fairness risk        |
| Rating               | Medium                        |
| Treatment            | Enhanced monitoring           |
| Risk Owner           | Enterprise Risk Manager       |
| Acceptance Authority | AI Governance Authority       |
| Conditions           | Quarterly fairness assessment |
| Review               | Quarterly                     |

***

# 69. Stage 16 — Improvement

Lessons from:

* incidents;
* monitoring;
* assurance;
* user feedback;
* regulatory developments;
* technology changes;

are incorporated into the governance system.

***

# 70. Continual Improvement Cycle

```text theme={null}
Monitor
   ↓
Measure
   ↓
Identify Finding
   ↓
Analyze Cause
   ↓
Improve
   ↓
Implement
   ↓
Verify
   ↓
Standardize
```

***

# 71. Stage 17 — Continue, Restrict, Suspend or Retire

At the end of each review cycle, the organization determines the appropriate lifecycle decision.

Possible outcomes:

* continue;
* continue with conditions;
* restrict;
* suspend;
* replace;
* retire.

***

# 72. Retirement Decision

Retirement may be triggered by:

* unacceptable residual risk;
* repeated control failure;
* inability to maintain fairness;
* obsolete technology;
* regulatory prohibition;
* business discontinuation;
* replacement by a safer solution.

***

# 73. Retirement Flow

```text theme={null}
Retirement Trigger
      ↓
Impact Assessment
      ↓
Governance Decision
      ↓
Disable System
      ↓
Preserve Required Evidence
      ↓
Data / Access Closure
      ↓
Supplier Closure
      ↓
Retirement Verification
      ↓
Close Lifecycle
```

***

# 74. High-Risk AI Evidence Package

The evidence package is more extensive than for a standard AI system.

| Evidence Category | Examples                            |
| ----------------- | ----------------------------------- |
| Governance        | Committee decisions                 |
| Registration      | AI inventory                        |
| Classification    | High-risk classification            |
| Risk              | Risk assessment                     |
| Data              | Data governance assessment          |
| Model             | Validation report                   |
| Fairness          | Fairness assessment                 |
| Controls          | Control assessment                  |
| Human Oversight   | Training and review records         |
| Approval          | Formal approval                     |
| Monitoring        | Performance records                 |
| Incidents         | Incident reports                    |
| Assurance         | Assurance reports                   |
| Changes           | Change records                      |
| Improvement       | Corrective actions                  |
| Lifecycle         | Continuation / retirement decisions |

***

# 75. End-to-End Traceability

```text theme={null}
AI System
   ↓
Purpose
   ↓
Affected Persons
   ↓
Classification
   ↓
Risk
   ↓
Control
   ↓
Procedure
   ↓
Evidence
   ↓
Approval
   ↓
Human Decision
   ↓
Monitoring
   ↓
Incident
   ↓
Assurance
   ↓
Improvement
   ↓
Change / Continue / Suspend / Retire
```

***

# 76. Example Traceability Matrix

| AIGO Element       | Example                                |
| ------------------ | -------------------------------------- |
| AI System          | Candidate Assessment Assistant         |
| Governance         | AI Governance Authority                |
| Classification     | High-Risk                              |
| Risk               | Discriminatory outcome                 |
| Control            | Human oversight                        |
| Procedure          | AI Risk Assessment Procedure           |
| Evidence           | Risk assessment                        |
| Approval           | Enhanced governance approval           |
| Operation          | Controlled recruitment support         |
| Monitoring         | Fairness and performance monitoring    |
| Incident           | Potential discriminatory outcome       |
| Assurance          | Independent assurance                  |
| Improvement        | Corrective action                      |
| Change             | New recruitment population             |
| Lifecycle Decision | Continue / Restrict / Suspend / Retire |

***

# 77. Relationship to ISO/IEC 42001

The example demonstrates how an AIGO high-risk AI governance process can support management-system activities associated with:

* organizational context;
* leadership;
* planning;
* risk management;
* operational controls;
* performance evaluation;
* management review;
* continual improvement.

The precise applicability of ISO/IEC 42001 requirements must be assessed against the organization's implementation and the applicable standard.

***

# 78. Relationship to NIST AI RMF

The example can also be represented through the four NIST AI RMF Functions.

| Function | Example                                                    |
| -------- | ---------------------------------------------------------- |
| GOVERN   | Governance authority, roles and accountability             |
| MAP      | System purpose, stakeholders, affected persons and context |
| MEASURE  | Risk, fairness, performance and control assessment         |
| MANAGE   | Risk treatment, incident response and corrective action    |

***

# 79. Comparison With Basic AI Example

| Dimension           | Basic AI      | High-Risk AI                 |
| ------------------- | ------------- | ---------------------------- |
| Governance          | Standard      | Enhanced                     |
| Risk Assessment     | Standard      | Detailed                     |
| Human Oversight     | Appropriate   | Mandatory / strengthened     |
| Testing             | Proportionate | Extensive                    |
| Evidence            | Standard      | Enhanced                     |
| Monitoring          | Periodic      | Enhanced                     |
| Assurance           | Periodic      | More frequent / independent  |
| Change Management   | Standard      | Strict                       |
| Approval            | Standard      | Enhanced                     |
| Risk Acceptance     | Proportionate | Formal                       |
| Incident Escalation | Standard      | Immediate for serious events |

***

# 80. Key Governance Lessons

This example demonstrates that higher AI risk should result in proportionately stronger governance.

Important principles include:

1. classification must influence governance intensity;
2. affected persons must be considered;
3. risk assessment must address potential harm;
4. controls must address identified risks;
5. human oversight must be meaningful;
6. technical validation is not sufficient by itself;
7. fairness and impact considerations require evidence;
8. approval must be based on evidence;
9. monitoring must continue throughout operation;
10. material changes require reassessment;
11. incidents must feed continual improvement;
12. retirement must be governed as carefully as deployment.

***

# 81. Minimum High-Risk AI Governance Package

A high-risk AI system should generally have, at minimum:

* system registration;
* documented purpose;
* identified stakeholders;
* classification;
* comprehensive risk assessment;
* risk treatment;
* control assessment;
* data governance;
* model validation;
* appropriate impact/fairness assessment;
* human oversight;
* approval;
* monitoring;
* incident management;
* assurance;
* change management;
* management review;
* documented lifecycle decision.

The actual minimum package should be determined by applicable organizational and legal requirements.

***

# 82. Example Final Operational State

At the conclusion of this example:

**System:** Active under enhanced governance
**Lifecycle Stage:** Operate / Monitor
**Classification:** High-Risk
**Human Oversight:** Mandatory
**Risk:** Residual risk formally accepted
**Controls:** Operational
**Monitoring:** Enhanced
**Assurance:** Periodic and independent
**Approval:** Conditional / controlled
**Decision:** Continue with conditions

***

# 83. Final Governance Model

```text theme={null}
High-Risk AI System
        ↓
Governance Authority
        ↓
Identification
        ↓
High-Risk Classification
        ↓
Comprehensive Risk Assessment
        ↓
Enhanced Controls
        ↓
Validation & Testing
        ↓
Human Oversight
        ↓
Evidence
        ↓
Enhanced Approval
        ↓
Controlled Deployment
        ↓
Enhanced Monitoring
        ↓
Assurance
        ↓
Continual Improvement
        ↓
Reassessment
        ↓
Continue / Restrict / Suspend / Retire
```

***

# 84. Relationship to Future AIGO Templates

This example provides requirements that should later be reflected in AIGO templates, including:

* high-risk AI system profile;
* enhanced classification assessment;
* high-risk risk assessment;
* impact/fairness assessment;
* model validation record;
* human oversight record;
* enhanced control assessment;
* approval record;
* monitoring record;
* incident record;
* assurance record;
* change assessment;
* risk acceptance record;
* lifecycle decision record.

Templates should be finalized only after the examples, framework, procedures, and mappings have been sufficiently validated.

***

# 85. Document Status

**Document:** AIGO — High-Risk AI System Example

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Identifier:** `AIGO-EXAMPLE-002`

**Document Type:** Implementation Example

**Example Type:** High-Risk AI System

This document provides an illustrative example of enhanced AIGO governance for an AI system presenting significant potential impact and risk.

***

# 86. End of Example Document

**AIGO — High-Risk AI System Example**

**Document ID:** `AIGO-EXAMPLE-002`

**Version:** 0.1

**Status:** Draft

**End of Document**