AIGO — AI Governance Operating Framework
AIGO — ISO/IEC 42001 Requirements Mapping
Version: 0.1Status: Draft
Working Name: AIGO
Full Name: AI Governance Operating Framework
Document Identifier: AIGO-MAP-ISO42001-002
Mapping Standard: ISO/IEC 42001
Mapping Type: Requirements Mapping
1. Purpose
This document defines the mapping between the AIGO AI Governance Operating Framework and the requirements of ISO/IEC 42001. The purpose of the mapping is to demonstrate how AIGO framework components address, support, or complement the requirements of an AI management system based on ISO/IEC 42001. This document is intended to support:- framework alignment;
- implementation planning;
- traceability;
- gap identification;
- governance assessment;
- assurance activities; and
- future certification-readiness activities.
2. Scope
This mapping covers the principal ISO/IEC 42001 management-system requirements and their relationship to AIGO. The mapping considers:- organizational context;
- leadership;
- planning;
- support;
- operation;
- performance evaluation;
- improvement;
- AI risk management; and
- AI management-system controls.
3. Mapping Methodology
3.1 Mapping Relationship
Each ISO/IEC 42001 requirement is mapped to one or more AIGO components. The relationship may be classified as:- Direct — AIGO explicitly addresses the requirement.
- Supporting — AIGO provides supporting governance capability.
- Partial — AIGO addresses part of the requirement.
- Complementary — AIGO provides additional governance beyond the requirement.
- Gap — AIGO does not currently provide sufficient coverage.
3.2 Mapping Confidence
Mapping confidence may be classified as:- High
- Medium
- Low
3.3 Mapping Status
Each mapping should have a current status:- Covered
- Partially Covered
- Planned
- Gap
- Not Applicable
- Requires Organizational Implementation
4. AIGO Mapping Architecture
The mapping should connect ISO/IEC 42001 requirements to the AIGO architecture. Primary AIGO framework areas include:- Charter
- Principles
- Governance Domains
- Governance Roles
- AI Governance Lifecycle
- AI Risk Management
- AI Governance Controls
- AI Governance Maturity
- AI System Profiles
- Implementation Guidance
- Operational Procedures
- Templates
- Examples
- Schemas
- Tools
5. Clause 4 — Context of the Organization
5.1 Understanding the Organization and Its Context
ISO/IEC 42001 Reference: Clause 4.1 AIGO Coverage: AIGO addresses organizational context through the definition of governance scope, organizational responsibilities, AI governance domains, applicable requirements, and the environment in which AI systems operate. Primary AIGO References:framework/01-charter/framework/03-domains/framework/04-roles/framework/09-profiles/
- Governance scope
- AI governance structure
- AI system profiles
- Applicable organizational requirements
- Governance responsibilities
6. Clause 4 — Interested Parties
6.1 Understanding the Needs and Expectations of Interested Parties
ISO/IEC 42001 Reference: Clause 4.2 AIGO Coverage: AIGO governance requires consideration of stakeholders and affected parties throughout AI governance, risk management, lifecycle management, monitoring, and assurance activities. Primary AIGO References:framework/01-charter/framework/03-domains/framework/05-lifecycle/framework/06-risk/framework/07-controls/
- Stakeholder identification
- Impact assessment
- Governance decisions
- Risk assessments
- Human oversight
- Incident management
7. Clause 4 — Scope of the AI Management System
7.1 Determining the Scope
ISO/IEC 42001 Reference: Clause 4.3 AIGO Coverage: AIGO defines governance scope through the framework charter, governance domains, AI system profiles, organizational boundaries, lifecycle coverage, and risk scope. Primary AIGO References:framework/01-charter/framework/03-domains/framework/09-profiles/
8. Clause 4 — AI Management System
8.1 Establishing the AI Management System
ISO/IEC 42001 Reference: Clause 4.4 AIGO Coverage: AIGO provides an integrated governance architecture covering governance, principles, roles, lifecycle, risk, controls, maturity, system profiles, implementation guidance, and operational procedures. Primary AIGO References:framework/01-charter/framework/02-principles/framework/03-domains/framework/04-roles/framework/05-lifecycle/framework/06-risk/framework/07-controls/framework/08-maturity/framework/09-profiles/
9. Clause 5 — Leadership
9.1 Leadership and Commitment
ISO/IEC 42001 Reference: Clause 5.1 AIGO Coverage: AIGO defines governance accountability, decision authority, organizational roles, escalation, oversight, risk ownership, and governance responsibilities. Primary AIGO References:framework/01-charter/framework/03-domains/framework/04-roles/
guidance/01-implementation/02-AIGO-Governance-Implementation-v0.1.md
10. Clause 5 — AI Policy
10.1 AI Policy
ISO/IEC 42001 Reference: Clause 5.2 AIGO Coverage: AIGO establishes principles, governance objectives, accountability requirements, risk-based governance, control expectations, and lifecycle governance that can support an organizational AI policy. Primary AIGO References:framework/01-charter/framework/02-principles/framework/03-domains/framework/07-controls/
11. Clause 5 — Roles and Responsibilities
11.1 Organizational Roles, Responsibilities and Authorities
ISO/IEC 42001 Reference: Clause 5.3 AIGO Coverage: AIGO explicitly defines AI governance roles, responsibilities, authorities, accountability, escalation, and decision rights. Primary AIGO Reference:framework/04-roles/AIGO-Governance-Roles-v0.1.md
12. Clause 6 — Planning
12.1 Actions to Address Risks and Opportunities
ISO/IEC 42001 Reference: Clause 6.1 AIGO Coverage: AIGO provides a dedicated AI risk-management framework and associated procedures for identifying, assessing, treating, accepting, monitoring, and reviewing AI-related risks. Primary AIGO References:framework/06-risk/AIGO-AI-Risk-Management-v0.1.mdframework/07-controls/AIGO-AI-Governance-Controls-v0.1.md
guidance/02-procedures/03-AIGO-AI-Risk-Assessment-Procedure-v0.1.mdguidance/02-procedures/11-AIGO-AI-Risk-Acceptance-Procedure-v0.1.md
13. Clause 6 — AI Risk Assessment
13.1 AI Risk Assessment Process
ISO/IEC 42001 Reference: Clause 6.1.2 AIGO Coverage: AIGO provides an AI risk-management framework covering risk identification, analysis, evaluation, treatment, residual risk, acceptance, monitoring, and review. Primary AIGO Reference:framework/06-risk/AIGO-AI-Risk-Management-v0.1.md
guidance/02-procedures/03-AIGO-AI-Risk-Assessment-Procedure-v0.1.md
14. Clause 6 — AI Risk Treatment
14.1 AI Risk Treatment Process
ISO/IEC 42001 Reference: Clause 6.1.3 AIGO Coverage: AIGO defines risk treatment through control selection, risk reduction, residual risk evaluation, risk acceptance, monitoring, and escalation. Primary AIGO References:framework/06-risk/framework/07-controls/
guidance/02-procedures/03-AIGO-AI-Risk-Assessment-Procedure-v0.1.mdguidance/02-procedures/11-AIGO-AI-Risk-Acceptance-Procedure-v0.1.md
15. Clause 6 — AI Objectives
15.1 AI Objectives and Planning
ISO/IEC 42001 Reference: Clause 6.2 AIGO Coverage: AIGO provides governance objectives, risk objectives, control objectives, maturity objectives, monitoring requirements, and continuous-improvement mechanisms. Primary AIGO References:framework/01-charter/framework/07-controls/framework/08-maturity/
16. Clause 6 — Planning Changes
16.1 Planning of Changes
ISO/IEC 42001 Reference: Clause 6.3 AIGO Coverage: AIGO lifecycle and change-management governance address planning, assessment, approval, implementation, monitoring, and review of material AI changes. Primary AIGO References:framework/05-lifecycle/framework/06-risk/framework/07-controls/
guidance/02-procedures/07-AIGO-AI-Change-Management-Procedure-v0.1.md
17. Clause 7 — Support
17.1 Resources
ISO/IEC 42001 Reference: Clause 7.1 AIGO Coverage: AIGO governance roles, implementation guidance, procedures, controls, monitoring, and assurance requirements establish the governance capabilities required to support AI management activities. Primary AIGO References:framework/04-roles/framework/07-controls/guidance/01-implementation/
18. Clause 7 — Competence
18.1 Competence
ISO/IEC 42001 Reference: Clause 7.2 AIGO Coverage: AIGO assigns responsibilities and identifies governance capabilities required for AI governance. Organizational implementation should establish competency criteria and training requirements for assigned roles. Primary AIGO References:framework/04-roles/framework/08-maturity/
19. Clause 7 — Awareness
19.1 Awareness
ISO/IEC 42001 Reference: Clause 7.3 AIGO Coverage: AIGO implementation guidance and governance responsibilities provide a basis for AI governance awareness. Organizations should establish appropriate awareness activities for personnel involved in AI governance and AI system operation. Primary AIGO References:framework/02-principles/framework/04-roles/guidance/01-implementation/
20. Clause 7 — Communication
20.1 Communication
ISO/IEC 42001 Reference: Clause 7.4 AIGO Coverage: AIGO provides governance reporting, escalation, monitoring, incident management, assurance, and stakeholder governance mechanisms. Primary AIGO References:framework/03-domains/framework/04-roles/framework/07-controls/
guidance/02-procedures/08-AIGO-AI-Incident-Management-Procedure-v0.1.mdguidance/02-procedures/09-AIGO-AI-Monitoring-Procedure-v0.1.mdguidance/02-procedures/10-AIGO-AI-Assurance-Procedure-v0.1.md
21. Clause 7 — Documented Information
21.1 Documented Information
ISO/IEC 42001 Reference: Clause 7.5 AIGO Coverage: AIGO defines governance records, system profiles, risk records, control records, approval records, incident records, monitoring records, assurance records, and lifecycle documentation. Primary AIGO References:framework/01-charter/framework/05-lifecycle/framework/07-controls/framework/09-profiles/
guidance/02-procedures/
22. Clause 8 — Operation
22.1 Operational Planning and Control
ISO/IEC 42001 Reference: Clause 8.1 AIGO Coverage: AIGO implementation guidance and operational procedures provide processes for governance, registration, classification, risk assessment, control assessment, approval, change, incident management, monitoring, assurance, risk acceptance, retirement, and continuous improvement. Primary AIGO References:guidance/01-implementation/guidance/02-procedures/
23. Clause 8 — AI Risk Assessments
23.1 Conducting AI Risk Assessments
ISO/IEC 42001 Reference: Clause 8.2 AIGO Coverage: AIGO provides an AI risk-management framework and operational risk-assessment procedure. Primary AIGO References:framework/06-risk/guidance/02-procedures/03-AIGO-AI-Risk-Assessment-Procedure-v0.1.md
24. Clause 8 — AI Risk Treatment
24.1 Implementing AI Risk Treatment
ISO/IEC 42001 Reference: Clause 8.3 AIGO Coverage: AIGO connects risk treatment to governance controls, lifecycle activities, monitoring, assurance, risk acceptance, and change management. Primary AIGO References:framework/06-risk/framework/07-controls/framework/05-lifecycle/
25. Clause 8 — AI System Lifecycle
25.1 AI Lifecycle Governance
ISO/IEC 42001 Reference: Operational AI management requirements AIGO Coverage: AIGO defines lifecycle governance from planning through retirement. Primary AIGO Reference:framework/05-lifecycle/AIGO-AI-Governance-Lifecycle-v0.1.md
guidance/01-implementation/06-AIGO-Lifecycle-Implementation-v0.1.md
26. Clause 8 — AI System Registration
26.1 System Registration
AIGO Coverage: AIGO establishes AI system registration and system profile requirements to provide traceability and governance visibility. Primary AIGO Reference:framework/09-profiles/AIGO-AI-System-Profiles-v0.1.md
guidance/02-procedures/02-AIGO-AI-System-Registration-Procedure-v0.1.md
27. Clause 8 — AI Classification
27.1 System Classification
AIGO Coverage: AIGO provides classification mechanisms supporting proportional governance based on AI system characteristics and risk. Supporting Procedure:guidance/02-procedures/04-AIGO-AI-Classification-Procedure-v0.1.md
28. Clause 8 — AI Approval
28.1 Approval Governance
AIGO Coverage: AIGO defines governance approval mechanisms for AI systems and material governance decisions. Primary AIGO References:framework/04-roles/framework/05-lifecycle/framework/07-controls/
guidance/02-procedures/06-AIGO-AI-Approval-Procedure-v0.1.md
29. Clause 8 — AI Change Management
29.1 AI Changes
AIGO Coverage: AIGO provides a dedicated AI change-management process covering change identification, assessment, approval, implementation, validation, and governance review. Supporting Procedure:guidance/02-procedures/07-AIGO-AI-Change-Management-Procedure-v0.1.md
30. Clause 8 — AI Incident Management
30.1 AI Incidents
AIGO Coverage: AIGO establishes incident management, escalation, response, investigation, corrective action, and lessons-learned processes. Supporting Procedure:guidance/02-procedures/08-AIGO-AI-Incident-Management-Procedure-v0.1.md
31. Clause 8 — AI Monitoring
31.1 AI Monitoring
AIGO Coverage: AIGO provides monitoring governance covering AI system performance, controls, risk indicators, incidents, thresholds, escalation, and reporting. Primary AIGO References:framework/07-controls/framework/08-maturity/
guidance/02-procedures/09-AIGO-AI-Monitoring-Procedure-v0.1.md
32. Clause 8 — AI Assurance
32.1 AI Assurance
AIGO Coverage: AIGO establishes assurance activities for governance, risk, controls, lifecycle processes, monitoring, and AI system operation. Primary AIGO Reference:framework/07-controls/
guidance/02-procedures/10-AIGO-AI-Assurance-Procedure-v0.1.md
33. Clause 8 — Risk Acceptance
33.1 Residual Risk Acceptance
AIGO Coverage: AIGO establishes a formal process for accepting residual AI risks within authorized tolerance. Primary AIGO Reference:framework/06-risk/
guidance/02-procedures/11-AIGO-AI-Risk-Acceptance-Procedure-v0.1.md
34. Clause 8 — AI Retirement
34.1 AI System Retirement
AIGO Coverage: AIGO provides controlled retirement requirements covering shutdown, data, access, dependencies, records, risk, validation, and closure. Primary AIGO Reference:framework/05-lifecycle/
guidance/02-procedures/12-AIGO-AI-Retirement-Procedure-v0.1.md
35. Clause 9 — Performance Evaluation
35.1 Monitoring, Measurement, Analysis and Evaluation
ISO/IEC 42001 Reference: Clause 9.1 AIGO Coverage: AIGO provides monitoring, measurement, governance metrics, risk indicators, control assessment, assurance, and maturity evaluation. Primary AIGO References:framework/07-controls/framework/08-maturity/
guidance/02-procedures/09-AIGO-AI-Monitoring-Procedure-v0.1.mdguidance/02-procedures/10-AIGO-AI-Assurance-Procedure-v0.1.md
36. Clause 9 — Internal Audit
36.1 Internal Audit
ISO/IEC 42001 Reference: Clause 9.2 AIGO Coverage: AIGO assurance and control governance provide a basis for internal assessment and audit activities. Organizations should establish audit programs appropriate to their management-system requirements. Primary AIGO References:framework/07-controls/framework/08-maturity/
37. Clause 9 — Management Review
37.1 Management Review
ISO/IEC 42001 Reference: Clause 9.3 AIGO Coverage: AIGO governance reporting, maturity assessment, monitoring, assurance, incident reporting, risk reporting, and continuous improvement support management review. Primary AIGO References:framework/03-domains/framework/08-maturity/
guidance/01-implementation/07-AIGO-Monitoring-Assurance-Implementation-v0.1.mdguidance/01-implementation/08-AIGO-Continuous-Improvement-v0.1.md
38. Clause 10 — Improvement
38.1 Nonconformity and Corrective Action
ISO/IEC 42001 Reference: Clause 10.1 AIGO Coverage: AIGO incident management, assurance, control assessment, corrective action, and continuous improvement processes support identification and remediation of governance weaknesses. Primary AIGO References:framework/07-controls/framework/08-maturity/
guidance/02-procedures/08-AIGO-AI-Incident-Management-Procedure-v0.1.mdguidance/02-procedures/10-AIGO-AI-Assurance-Procedure-v0.1.mdguidance/02-procedures/13-AIGO-Continuous-Improvement-Procedure-v0.1.md
39. Clause 10 — Continual Improvement
39.1 Continual Improvement
ISO/IEC 42001 Reference: Clause 10.2 AIGO Coverage: AIGO establishes continuous improvement as an explicit governance capability covering lessons learned, findings, risk changes, control improvements, lifecycle improvements, and governance maturity. Primary AIGO References:framework/08-maturity/
guidance/01-implementation/08-AIGO-Continuous-Improvement-v0.1.md
guidance/02-procedures/13-AIGO-Continuous-Improvement-Procedure-v0.1.md
40. Annex A — AI Management Controls
40.1 Control Mapping
ISO/IEC 42001 Annex A contains AI management controls that should be mapped separately to the AIGO control framework. The detailed control mapping is maintained in:03-AIGO-ISO-42001-Control-Mapping-v0.1.md
Primary AIGO Reference:
framework/07-controls/AIGO-AI-Governance-Controls-v0.1.md
Mapping: Direct
Status: Covered through separate control mapping
41. AIGO Risk Alignment
AIGO provides a dedicated AI risk-management structure that supports ISO/IEC 42001 risk requirements. Primary areas include:- risk identification;
- risk analysis;
- risk evaluation;
- risk treatment;
- residual risk;
- risk acceptance;
- monitoring;
- escalation; and
- review.
framework/06-risk/AIGO-AI-Risk-Management-v0.1.md
42. AIGO Lifecycle Alignment
AIGO applies governance throughout the AI lifecycle. Lifecycle stages include:- Planning
- Design
- Development
- Data preparation
- Testing and validation
- Approval
- Deployment
- Operation
- Monitoring
- Change
- Assurance
- Retirement
framework/05-lifecycle/AIGO-AI-Governance-Lifecycle-v0.1.md
43. AIGO Governance Alignment
AIGO establishes governance through:- governance domains;
- governance roles;
- decision authority;
- accountability;
- escalation;
- oversight;
- risk ownership;
- control ownership; and
- governance reporting.
framework/03-domains/framework/04-roles/
44. AIGO Control Alignment
AIGO controls provide the operational mechanism for implementing governance requirements. Controls may address:- accountability;
- risk;
- security;
- privacy;
- human oversight;
- transparency;
- monitoring;
- assurance;
- lifecycle governance;
- incident management; and
- continuous improvement.
framework/07-controls/AIGO-AI-Governance-Controls-v0.1.md
45. AIGO Maturity Alignment
AIGO maturity provides a mechanism for evaluating the development and effectiveness of AI governance capabilities. Primary AIGO Reference:framework/08-maturity/AIGO-AI-Governance-Maturity-v0.1.md
Maturity assessment may be used to identify:
- governance gaps;
- capability weaknesses;
- improvement priorities;
- implementation progress; and
- strategic governance objectives.
46. AIGO System Profile Alignment
AIGO system profiles provide structured information about individual AI systems. Profile information may support:- scope;
- classification;
- risk;
- lifecycle;
- controls;
- ownership;
- monitoring;
- assurance; and
- retirement.
framework/09-profiles/AIGO-AI-System-Profiles-v0.1.md
47. Requirements Coverage Summary
The following high-level assessment summarizes the current AIGO alignment.48. Organizational Implementation Dependencies
AIGO provides a framework-level mapping, but organizational implementation remains necessary. Organizations should establish:- documented management-system processes;
- organizational policies;
- assigned personnel;
- competence requirements;
- training;
- internal audit;
- management review;
- documented evidence;
- operational records;
- implementation controls; and
- continual improvement activities.
49. Mapping Limitations
This mapping does not constitute:- certification;
- conformity assessment;
- legal advice;
- regulatory approval;
- audit evidence by itself; or
- a substitute for reviewing the applicable ISO/IEC 42001 standard.
50. Gap Management
Identified gaps should be recorded and managed through the AIGO continuous improvement process. Each material gap should identify:- gap identifier;
- requirement;
- description;
- affected AIGO component;
- risk;
- owner;
- remediation;
- target date;
- status; and
- verification evidence.
51. Mapping Review
This mapping should be reviewed when:- AIGO framework components change;
- ISO/IEC 42001 requirements change;
- controls are modified;
- procedures change;
- significant implementation findings occur;
- assurance identifies mapping gaps; or
- new organizational requirements emerge.
52. Document Control
53. Traceability
This document should maintain traceability between:- ISO/IEC 42001 requirements;
- AIGO framework components;
- AIGO implementation guidance;
- AIGO operational procedures;
- AIGO controls;
- AIGO records;
- AIGO evidence; and
- AIGO improvement activities.
54. Document Status
Document: AIGO — ISO/IEC 42001 Requirements Mapping Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-MAP-ISO42001-002
Document Type: Requirements Mapping
This document establishes the requirements-level traceability between AIGO and ISO/IEC 42001 and provides the foundation for the detailed control, lifecycle, risk, governance, evidence, and implementation mappings.