AIGO — AI System Schema Documentation

1. Document Purpose

This document describes the machine-readable AIGO AI System Schema. The schema provides the structured representation of an AI system governed under the AIGO AI Governance Operating Framework. It is intended to support:

AI system registration;
AI system identification and ownership;
intended-purpose documentation;
organizational and operational context;
AI classification;
lifecycle management;
risk and control traceability;
governance decisions;
monitoring and assurance;
incident and change relationships;
evidence management; and
controlled retirement.

The JSON schema defines structural requirements. This documentation explains the intended meaning and governance use of those structures.

2. Schema Information

Field	Value
Schema	AIGO AI System Schema
Schema Identifier	`https://aigo.example/schema/ai-system/v0.1`
Schema Version	`0.1`
JSON Schema Dialect	JSON Schema Draft 2020-12
Object Type	`AI_SYSTEM`
File	`01-AIGO-AI-System-Schema-v0.1.json`
Status	Draft
Framework	AIGO — AI Governance Operating Framework

3. Scope

The schema applies to AI systems and AI-enabled systems that are subject to the organization’s AIGO governance arrangements. The schema may be used for systems that are:

internally developed;
externally developed;
purchased or licensed;
provided through a third party;
embedded in business applications;
operated as a service;
used for decision support;
used for automated or semi-automated decisions; or
otherwise designated as requiring AI governance.

The applicability decision should be made through the organization’s AI governance procedures.

4. Object Model

The primary object represented by this schema is:

AI_SYSTEM

An AI System record represents the governed system as an accountable organizational object. The record should remain distinct from:

a risk record;
a control record;
an assessment record;
an approval record;
a monitoring plan;
an incident record;
a change record;
an assurance record;
an evidence record; and
a retirement record.

These related objects should normally be connected through stable identifiers.

5. Core Identity

An AI System record should contain stable identity information. Key fields include:

id;
objectType;
objectVersion;
schemaVersion;
system name;
system owner;
business owner;
governance owner where applicable; and
lifecycle status.

The distinction between record identity and record version should be preserved. For example:

{
  "id": "AI-SYS-001",
  "objectType": "AI_SYSTEM",
  "objectVersion": "1.0",
  "schemaVersion": "0.1"
}

The identifier should remain stable as the record changes.

6. System Description

The system description should establish what the AI system is and what it does. It should provide sufficient information for governance stakeholders to understand:

system purpose;
principal functionality;
users;
affected stakeholders;
deployment context;
AI capabilities;
system boundaries; and
relevant dependencies.

The description should be sufficiently precise to support classification and risk assessment.

7. Intended Purpose

Intended purpose is a central governance attribute. The record should describe:

the intended purpose;
intended uses;
intended users;
operating context;
expected outputs;
supported decisions or activities;
foreseeable limitations; and
prohibited or restricted uses where applicable.

Changes to intended purpose may represent a material change and should therefore be evaluated under AIGO change-management procedures.

8. AI Characteristics

The schema should capture the relevant characteristics of the AI system. Examples include:

AI technique or method;
model type;
model version;
data dependencies;
autonomy;
decision role;
human involvement;
output type;
integration architecture; and
operational environment.

Not all characteristics will be relevant to every system. The record should therefore distinguish applicable attributes from attributes that are not applicable.

9. Ownership and Accountability

The AI System record should support clear accountability. Typical ownership roles include:

Role	Primary Responsibility
AI System Owner	Accountable for system governance and lifecycle
Business Owner	Accountable for business use and business outcomes
Technical Owner	Accountable for technical operation
Risk Owner	Accountable for identified AI risks
Control Owner	Accountable for applicable controls
Governance Owner	Accountable for governance oversight where assigned

Organizations may define additional roles. The relevant authority and escalation relationships should be maintained through AIGO governance records.

10. Organizational Context

The system record may contain organizational information such as:

business unit;
function;
geographic scope;
jurisdiction;
operating entity;
customer or stakeholder environment; and
relevant regulatory context.

This information supports applicability and risk determination.

11. Lifecycle Status

The AI System schema supports lifecycle state representation. Typical states include:

PROPOSED
PLANNING
DESIGN
DEVELOPMENT
TESTING
APPROVAL_PENDING
APPROVED
DEPLOYED
OPERATIONAL
RESTRICTED
SUSPENDED
UNDER_CHANGE
UNDER_REVIEW
RETIRING
RETIRED

The exact values defined in the JSON schema are authoritative. Status changes must be governed through the applicable AIGO lifecycle and approval procedures. The schema does not independently authorize a lifecycle transition.

12. Lifecycle Information

The system record should support traceability across the AIGO AI lifecycle. Relevant lifecycle stages may include:

Planning
Design
Development
Data Preparation
Testing and Validation
Approval
Deployment
Operation
Monitoring
Change
Assurance
Retirement

The system record should identify the current lifecycle state and, where supported, relevant historical or planned transitions.

13. Classification

AI classification is a governance decision. The AI System record may reference:

classification level;
classification methodology;
classification date;
classification owner;
classification assessment;
classification rationale; and
reclassification requirements.

Classification should not be inferred solely from a system’s technical characteristics. It should consider the organization’s approved classification procedure and applicable legal, regulatory, business, stakeholder, safety, security, privacy, and risk requirements.

14. Risk Relationships

An AI System may have one or more associated risks. The system record should reference risk records rather than duplicating complete risk assessments. Example:

{
  "id": "AI-SYS-001",
  "riskIds": [
    "RISK-001",
    "RISK-002"
  ]
}

The referenced risk records remain authoritative for:

risk description;
likelihood;
impact;
risk level;
treatment;
residual risk;
acceptance; and
review.

15. Control Relationships

The system may reference applicable control records. Controls may address:

governance;
security;
privacy;
fairness;
human oversight;
data quality;
model performance;
monitoring;
incident management;
change management;
documentation;
third-party risk; and
other relevant governance requirements.

Controls should be maintained independently so that a control can apply to more than one AI system where appropriate.

16. Assessment Relationships

The system may reference assessment records including:

classification assessments;
risk assessments;
control assessments;
technical validation;
model validation;
security assessments;
privacy assessments;
fairness assessments;
impact assessments;
monitoring reviews;
change-impact assessments; and
retirement assessments.

The assessment record remains authoritative for the assessment result and supporting evidence.

17. Approval Relationships

Where approval is required, the AI System record should reference the applicable approval records. Approval relationships may support:

initial deployment;
continued operation;
material changes;
resumption after suspension;
restricted operation;
emergency decisions; and
retirement.

An "APPROVED" status in the AI System record should therefore be supported by an appropriate approval trail where governance requires formal approval.

18. Monitoring Relationships

AI systems should reference applicable monitoring arrangements. Monitoring may include:

model performance;
system performance;
data quality;
data drift;
model drift;
fairness;
safety;
reliability;
security;
privacy;
human oversight;
operational performance;
risk;
control effectiveness; and
compliance indicators.

The monitoring schema should remain authoritative for monitoring configuration, indicators, thresholds, alerts, responses, and monitoring reviews.

19. Incident Relationships

The AI System record may reference incidents associated with the system. Examples include:

model failures;
harmful outputs;
fairness incidents;
privacy incidents;
security incidents;
safety incidents;
control failures;
unauthorized changes;
third-party failures; and
regulatory events.

Incident records should remain independently governed and should contain the authoritative investigation and remediation information.

20. Change Relationships

AI systems should maintain traceability to material and relevant changes. Change records may identify modifications to:

models;
model versions;
data;
prompts;
configuration;
infrastructure;
application logic;
integrations;
controls;
monitoring;
intended purpose;
human oversight; or
suppliers.

A material change may require reassessment, reclassification, additional testing, approval, enhanced monitoring, or other governance action.

21. Assurance Relationships

The AI System record may reference assurance activities. Assurance may cover:

governance;
controls;
risk management;
compliance;
technical performance;
human oversight;
monitoring;
security;
privacy;
fairness;
lifecycle processes; or
other applicable areas.

The assurance schema remains authoritative for assurance scope, procedures, findings, conclusions, and follow-up.

22. Evidence Relationships

Evidence should normally be maintained as independent records. An AI System may reference evidence supporting:

registration;
classification;
risk assessment;
control implementation;
testing;
approval;
monitoring;
incidents;
changes;
assurance;
management review; and
retirement.

The evidence schema provides additional properties concerning:

source;
collection;
integrity;
authenticity;
completeness;
relevance;
accuracy;
timeliness;
traceability;
retention; and
disposition.

23. Human Oversight

Where human oversight applies, the AI System record should identify the relevant oversight arrangement. This may include:

human-in-the-loop;
human-on-the-loop;
human review;
human approval;
human override;
escalation;
intervention authority;
competence requirements; and
oversight responsibilities.

Human oversight should be proportionate to the system’s classification, risk, use context, and potential impact.

24. Security and Privacy

The AI System record should provide sufficient information to identify relevant security and privacy governance requirements. This may include:

sensitivity of data;
security classification;
privacy relevance;
security assessment references;
privacy assessment references;
security controls;
privacy controls;
access requirements; and
relevant incidents.

Detailed security and privacy records should remain in their appropriate governance repositories.

25. Third-Party Dependencies

Where an AI system depends on external suppliers, the record should support traceability to the relevant third-party governance records. Examples include:

hosted AI services;
model providers;
data providers;
infrastructure providers;
external development teams;
APIs;
managed services; and
third-party AI components.

Third-party dependencies may influence:

risk;
controls;
monitoring;
incident notification;
change management;
assurance; and
retirement.

26. Regulatory Context

An AI System may be subject to multiple external requirements. The system record may therefore reference:

applicable laws;
regulations;
standards;
contractual requirements;
industry obligations; and
organizational commitments.

External mapping repositories should provide the authoritative mapping logic. Relevant AIGO mapping repositories include:

mappings/iso-42001/
mappings/nist-ai-rmf/
mappings/eu-ai-act/
mappings/other/

27. Data and Model Traceability

Where supported by the schema implementation, the AI System record should identify important data and model relationships. This can include:

training data sources;
operational data sources;
model identifier;
model version;
model lineage;
data pipelines;
feature sources;
external models;
prompt or configuration dependencies; and
downstream systems.

Detailed technical artifacts may be maintained in separate technical repositories and referenced from the AI System record.

28. Dependencies and Integrations

An AI System can depend on other services or components. Dependencies may include:

identity systems;
data platforms;
applications;
model services;
APIs;
infrastructure;
external suppliers;
business processes;
monitoring systems;
security services; and
downstream decision systems.

Dependency information is particularly important for:

risk assessment;
change management;
incident response;
business continuity; and
retirement.

29. Business Continuity

The organization should identify whether the AI system is business-critical or supports critical processes. Where applicable, the record should identify:

continuity requirements;
alternative processes;
recovery requirements;
system dependencies;
recovery priorities; and
relevant continuity plans.

Business continuity considerations may affect approval, monitoring, incident response, change planning, and retirement.

30. Decision Impact

Where an AI system affects decisions, the system record should support identification of the affected decision types. Examples include:

recommendation;
prioritization;
classification;
screening;
eligibility assessment;
fraud detection;
resource allocation;
content generation;
operational optimization; and
automated decision-making.

The organization should determine the governance significance of the decision context using its classification and risk procedures.

31. Stakeholder Impact

The system record may identify relevant stakeholder groups and affected persons. These may include:

customers;
employees;
applicants;
users;
suppliers;
members of the public;
regulators;
business partners; and
other affected stakeholders.

Stakeholder impact information supports:

risk assessment;
fairness and impact assessment;
human oversight;
communication;
incident management; and
governance decisions.

32. Records and Documentation

AI System governance should be supported by controlled records. Typical related records include:

Governance Record
AI System Registration
AI System Profile
Classification
Risk Assessment
Control Assessment
Approval
Monitoring Plan
Incidents
Changes
Assurance
Evidence
Management Review
Improvement
Retirement

These records should maintain consistent identifiers and traceable relationships.

33. Validation Requirements

A valid AI System record should satisfy:

Structural Validation

The JSON document must validate against: 01-AIGO-AI-System-Schema-v0.1.json

Reference Validation

Referenced risk, control, assessment, approval, monitoring, incident, change, assurance, evidence, improvement, and retirement records should exist where required.

Governance Validation

The record should comply with applicable AIGO procedures.

Lifecycle Validation

The lifecycle state should be consistent with the organization’s authorized transition process.

Ownership Validation

Required accountable roles should be assigned.

Traceability Validation

Material governance decisions should remain traceable to relevant supporting records and evidence.

34. Schema Limitations

JSON Schema validates structural consistency but does not independently validate:

whether a person actually holds a particular organizational role;
whether an approval authority is legally or organizationally authorized;
whether a referenced record exists in an external repository;
whether a risk assessment is substantively adequate;
whether a control is actually effective;
whether a monitoring result is accurate; or
whether an organization’s AI governance obligations have been fully satisfied.

Those matters require procedural, organizational, technical, and assurance controls.

35. Change and Version Management

Changes to the AI System schema should be managed through the AIGO change-management process. Material changes may require:

impact assessment;
backward-compatibility review;
validation;
example updates;
documentation updates;
tooling updates;
migration guidance;
approval; and
registry updates.

The schema version should not be changed casually.

36. Relationship to Templates

The schema corresponds primarily to AIGO AI system registration and profile records. Relevant human-readable templates include:

guidance/03-templates/02-AIGO-AI-System-Registration-Template-v0.1.md
guidance/03-templates/03-AIGO-AI-System-Profile-Template-v0.1.md

The templates are human-operational artifacts. The JSON schema is their machine-readable structural counterpart.

37. Relationship to Procedures

The schema should be used together with applicable procedures, including:

guidance/02-procedures/02-AIGO-AI-System-Registration-Procedure-v0.1.md
guidance/02-procedures/04-AIGO-AI-Classification-Procedure-v0.1.md
guidance/02-procedures/03-AIGO-AI-Risk-Assessment-Procedure-v0.1.md
guidance/02-procedures/06-AIGO-AI-Approval-Procedure-v0.1.md
guidance/02-procedures/07-AIGO-AI-Change-Management-Procedure-v0.1.md
guidance/02-procedures/09-AIGO-AI-Monitoring-Procedure-v0.1.md
guidance/02-procedures/10-AIGO-AI-Assurance-Procedure-v0.1.md
guidance/02-procedures/12-AIGO-AI-Retirement-Procedure-v0.1.md

The schema structures the record. The procedures define how the organization operates the governance process.

38. Framework Traceability

AIGO Component	Relationship
Governance Domains	AI system governance scope and responsibilities
Governance Roles	System ownership and accountability
AI Governance Lifecycle	Lifecycle state and transitions
AI Risk Management	Risk references and risk context
AI Governance Controls	Control references and governance requirements
AI Governance Maturity	Governance capability context
AI System Profiles	Primary source for system profile structure
Implementation Guidance	Operational implementation
Procedures	Registration, classification, risk, approval, monitoring, assurance, change and retirement
Templates	Human-readable registration and profile records
External Mappings	Regulatory and standards traceability

39. Example Record

A minimal conceptual AI System record may look like:

{
  "id": "AI-SYS-001",
  "objectType": "AI_SYSTEM",
  "objectVersion": "1.0",
  "schemaVersion": "0.1",
  "status": "OPERATIONAL",
  "name": "Example AI Decision Support System",
  "intendedPurpose": "Provide decision-support recommendations to authorized users.",
  "systemOwner": {
    "role": "AI System Owner"
  },
  "riskIds": [
    "RISK-001"
  ],
  "controlIds": [
    "CTRL-001",
    "CTRL-002"
  ],
  "assessmentIds": [
    "ASSESS-001"
  ],
  "approvalIds": [
    "APPROVAL-001"
  ],
  "monitoringIds": [
    "MON-001"
  ]
}

The actual record must conform to the authoritative JSON schema and should contain all required properties defined there.

40. Schema Registry Relationship

This schema is registered in: schemas/00-AIGO-Schema-Registry-v0.1.json Registry information should include:

schema identifier;
object type;
version;
controlled path;
status;
dependencies;
referenced schemas;
owner;
documentation path; and
traceability information.

41. Document Control

Field	Value
Document	AIGO AI System Schema Documentation
Version	0.1
Status	Draft
Document Identifier	`AIGO-SCHEMA-DOC-001`
Document Type	Schema Documentation
Schema	`01-AIGO-AI-System-Schema-v0.1.json`
Owner
Technical Reviewer
Governance Reviewer
Approved By
Effective Date
Next Review Date

42. Document Status

Document: AIGO — AI System Schema Documentation Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-SCHEMA-DOC-001 Document Type: Schema Documentation This document provides the human-readable interpretation, governance context, validation expectations, and traceability guidance for the AIGO AI System Schema. End of Document

​AIGO — AI System Schema Documentation

​1. Document Purpose

​2. Schema Information

​3. Scope

​4. Object Model

​5. Core Identity

​6. System Description

​7. Intended Purpose

​8. AI Characteristics

​9. Ownership and Accountability

​10. Organizational Context

​11. Lifecycle Status

​12. Lifecycle Information

​13. Classification

​14. Risk Relationships

​15. Control Relationships

​16. Assessment Relationships

​17. Approval Relationships

​18. Monitoring Relationships

​19. Incident Relationships

​20. Change Relationships

​21. Assurance Relationships

​22. Evidence Relationships

​23. Human Oversight

​24. Security and Privacy

​25. Third-Party Dependencies

​26. Regulatory Context

​27. Data and Model Traceability

​28. Dependencies and Integrations

​29. Business Continuity

​30. Decision Impact

​31. Stakeholder Impact

​32. Records and Documentation

​33. Validation Requirements

​Structural Validation

​Reference Validation

​Governance Validation

​Lifecycle Validation

​Ownership Validation

​Traceability Validation

​34. Schema Limitations

​35. Change and Version Management

​36. Relationship to Templates

​37. Relationship to Procedures

​38. Framework Traceability

​39. Example Record

​40. Schema Registry Relationship

​41. Document Control

​42. Document Status