Governance & Operations
This section translates standards requirements into operational processes: risk assessment methodologies, incident response procedures, audit evidence collection, and transparency documentation.
In This Section
| Process | Standards Mapping | Primary Output |
|---|---|---|
| AI Risk Assessment | NIST AI RMF MAP/MEASURE, EU AI Act Art. 9, ISO 42001 A.4 | Risk register, treatment plan, residual risk acceptance |
| AI Incident Response | NIST AI RMF MANAGE, EU AI Act Art. 20/73, ISO 42001 A.6.2 | IR plan, runbooks, post-incident reports |
| Audit & Evidence | EU AI Act Art. 11/17/72, ISO 42001 A.4/A.7/A.10, NIST AI RMF GOVERN | Model cards, data sheets, conformity artefacts |
| Transparency & Documentation | EU AI Act Art. 13/50/53, NIST AI RMF GOVERN, ISO 42001 A.10 | System cards, dataset docs, user-facing disclosures |
Governance Framework
Standards (NIST, EU AI Act, ISO 42001)
│
▼
Policy & Procedures (Governance Layer)
│
▼
Controls Implementation (Architecture/Runtime/Input)
│
▼
Monitoring & Measurement (MEASURE Function)
│
▼
Incident Response & Improvement (MANAGE Function)
│
▼
Audit & Evidence (Conformity Assessment)
Cross-References
- Standards: Standards & Frameworks
- Threats: Threat Taxonomy
- Controls: Defensive Architectures
- Engagement: Request Assessment