AI governance operating system

Track AI purpose, data boundaries, owners and change-triggered reviews.

What the baseline contains

15 structured records from P02_AI_Governance. The source workbook is a historical portfolio model, not verified operational evidence.

What is implemented

OPA evaluates missing ownership, assessment and evaluation evidence alongside selected Article 50 controls. OSCAL describes original local controls with explicit framework references.

Inspect the engineering

policies/ai.rego and oscal/component-definition.json in the downloadable repository package. Open the executive observatory to inspect the modeled risk register and current technical snapshot.

Decision boundary

Evidence checks can pass while legal applicability or marking effectiveness remains unresolved. Approved lifecycle changes require human review.

Review procedure

1. Establish system scope, owner, observation period and evidence provenance.
2. Execute the applicable check and inspect unknown, stale or failed results.
3. Record an evidence-linked finding, assign a treatment owner and set a review date.
4. Retest with new evidence. Keep the earlier snapshot and the reviewer’s conclusion.