Getting started
How everything connects
The lifecycle turns system facts into governed work, proof, accountable authority, and continuous reassessment.
AI System → Classification → Governance Plan → Obligations → Controls → Assurance → Evidence → Findings/Risks → Remediation → Decision → Monitoring → Reassessment → Report
From facts to obligations
- AI System → Classification: facts establish the regulatory and risk context.
- Classification → Governance Plan: that context drives a tailored set of activities.
- Governance Plan → Framework Requirement: each activity should explain the source and reason it applies.
- Requirement → Control: practical measures translate expectations into repeatable operations.
From controls to accountable decisions
- Control → Assessment, Control Test, or Evaluation: assurance checks design, operation, or measurable behavior.
- Assurance → Evidence: reviewed proof supports the result.
- Failed assurance → Finding and Risk: record what is deficient and what harm may follow.
- Finding → Remediation → Re-test: correct the cause, then verify effectiveness.
- Assurance package → Approval → Decision: authorized people accept, conditionally approve, or reject with a durable rationale.
Continuous governance
- Decision → Monitoring: observe whether assumptions and controls remain valid.
- Material change → Reassessment: reopen affected assurance and obtain a new decision where required.
- Governance records → Report: communicate the resulting governance truth and evidence trail.