AI governance framework

AI governance you can check on the design itself

Most AI governance frameworks live in slide decks: principles, committees, maturity ladders. Then an agent goes live inside a real process and none of it is attached to anything. The framework that works is the one written into the process design, where every rule points at a step you can see.

The five questions a governed design answers

Who executes each step? A human, an AI agent, a hybrid pair, a system. If you cannot answer this, nothing else is answerable.
How autonomous is each agent? Informs, recommends, or acts. Autonomy is granted per step, not per tool.
How risky is the step? Impact × likelihood, scored per step. The product of the two decides how much supervision is mandatory.
What supervises the agent? Preventive, detective and corrective controls, attached with visible "supervises" connections.
Where must a human decide? Gates before consequential actions, and a named accountable human for every autonomous agent.

From framework to automated check

Because the designer models all five answers as properties on the canvas, governance stops being a review meeting and becomes a button. ✔ Verify reads the whole design against its engineering rules, the model-structure rules and the regime advisors you switch on, organised in five perspectives, from "agent acts on a high-risk step with no supervising control" to "human gate missing before an external communication" to the opposite failure, "low-risk step buried under redundant controls". Most findings ship with a one-click fix that edits the design itself.

Risk assessment that fits on one matrix

Each agent step carries impact (insignificant to severe) and likelihood (rare to almost certain). The combination positions it on a proportionality matrix: high-high demands acting supervision and a human gate; low-low earns the right to run lean. This is AI risk assessment at the granularity where it is actionable, the step, rather than the organisation.

Governance also shapes what comes after the design: every step's blueprint inherits its thresholds and escalation paths, and the redesign ships with its controls priced into the business case. See the concepts in action in agentic workflows.

Frequently asked questions

What is an AI governance framework?

An AI governance framework is the set of structures, rules and controls that keep an organisation's use of AI accountable, proportionate and auditable: who is accountable for each AI decision, how risk is assessed, which controls supervise the systems, and when humans must review or approve. The useful test of any framework is whether you can point at a concrete process and show where each rule applies.

How do I apply AI governance to a business process?

Work at the level of steps, not policies. For each step executed by an AI agent, record its autonomy (informs, recommends or acts), score impact and likelihood of harm, attach supervising controls, and add a human gate before consequential actions. A design tool that models these properties can then check the whole process automatically.

What are preventive, detective and corrective controls for AI?

Preventive controls act before the agent does (confidence thresholds, access boundaries, input validation). Detective controls watch it work (sampling of outputs, drift alerts, anomaly monitoring). Corrective controls repair after the fact (reconciliation, rollback routes, escalation). A sound design usually combines the three around its riskiest agents.

Is more governance always better?

No. Over-controlling low-risk steps slows the process, frustrates teams and pushes people toward shadow AI, using unapproved tools outside the design. Good governance is proportionate: heavy supervision where impact and likelihood are high, lightweight elsewhere. This balance is one of the things an automated design check should flag in both directions.

Four European laws and a quality lens, one canvas

Governance rules in the studio do not stop at good practice: they cite the law they operationalise, and three built-in advisors read every design accordingly.

EU AI Act: prohibited-practice signals (Art. 5) are errors; Annex III high-risk candidates (recruitment screening, credit scoring, exam grading...) come with the concrete obligations and the December 2027 deadline; the executive PDF carries a per-agent readiness annex. See the practical AI Act guide.

NIS2: when a process reads like an essential or important entity (health, energy, banking, water, digital infrastructure...), the check demands the incident path in the design: detection, response, and the 24h / 72h / one-month reporting clocks. In Portugal, DL 125/2025.

DORA: financial entities get the lex specialis reading: agents are ICT services, cloud models belong in the Art. 28 third-party register, and major incidents run on 4h / 72h / one-month clocks. Applicable since January 2025.

GDPR: personal data is read on the arrows themselves: minimised hand-overs, flagged external transfers, and Art. 22: no solely automated decisions with significant effect on people without a human gate.

ISO/IEC 42001 (quality lens): every agent scored live on five AI-management checks: a named human owner, a per-step impact assessment, declared input data, a verification plan and AI disclosure to outsiders. Suggestions with the fix included, never alarms.

Every regime is switchable per process (defaults are yours to set), all signals are heuristic and labelled with the article they cite, and none of it is legal advice: classification stays with your counsel.