AI decisions affect real people. Governing AI is split across many professions. RESAIA gives each discipline a defined scope, defines what passes between them, and makes governance traceable from strategy to operational evidence.
Governance distributed across independent functions
A credit scoring model undergoes risk assessment for consumer harm and, separately, compliance assessment for regulatory exposure. Both evaluations examine the same artefact against overlapping criteria, on independent schedules, in formats determined by their respective reporting lines.
Fairness evaluation of a procured foundation model requires three inputs held by three functions: training provenance, which the vendor controls; contractual leverage, which sits with procurement; and the applicable legal standard, held by compliance. No function can complete the evaluation independently.
A board approves a risk appetite statement. For that statement to constrain model selection, it must be translated into a specification requirement or a release gate. Absent that translation, approval is the last point at which the statement has effect.
A regulator requests evidence that a decision was governed end to end. Risk produced an assessment, compliance a report, security an evaluation. Each addresses a distinct question for a distinct reader, and reconciling them into a single account is manual work performed after the request arrives.
Each system passes review on its own terms. System-level review does not count shared dependencies: how many deployed systems draw on a common vendor, or on the same underlying model. The concentration is measurable and goes unmeasured.
Unspecified in existing standards
Existing frameworks establish fairness as a requirement. Fairness admits multiple formal definitions, and two accepted metrics can return opposing verdicts on the same model. Selection of metric, choice of comparison population, and the threshold constituting acceptable performance are left to the implementing team.
Established method assumes a person acts on the system's output. Systems that act directly and keep state across sessions shift what needs controlling: the limits of permitted action, and the record of what was done.
Trace a board decision on acceptable risk to the control implementing it, then to the audit that verifies it. The trace holds only where each document references its predecessor. Maturity assessed discipline by discipline hides the dependency: risk capability is bounded by data governance capability.
The Framework
The framework organises AI governance into four layers. Governance sets the direction within which the other three operate. Safeguard specifies what must be protected, Operate delivers systems within those constraints, and Assure verifies the result independently of the personnel who produced it. The Enable layer spans all four, supplying the platforms, competencies, and working practices on which they depend.
RESAIA AIG Framework
Directives flow from each architectural layer into its governance pillars, and evidence flows back from those pillars to the layer.
Why govern?
Directives flow from each architectural layer into its governance pillars, and evidence flows back from those pillars to the layer.
How protect?
Identifies and rates AI-specific risk across the portfolio.
Protects AI systems against the failure modes unique to them.
Governs the data an AI system is trained on and the data it produces.
Extends governance to vendors, model providers, and embedded AI.
Directives flow from each architectural layer into its governance pillars, and evidence flows back from those pillars to the layer.
What execute?
Directives flow from each architectural layer into its governance pillars, and evidence flows back from those pillars to the layer.
Is it working?
Makes clear how and why a system reached a given output.
Tracks whether a deployed system still performs as intended.
Defines what happens when an AI system fails or causes harm.
Independently verifies that governance is actually applied.
Each domain is scored on its own rather than averaged into a single number. Lifecycle gates cannot operate above the maturity of the risk assessments that feed them, so strength in one domain does not compensate for weakness in another it depends on.
Governance depends on individual initiative. No documented policy exists, and activity follows incidents rather than preceding them.
Policy is approved but covers a subset of the portfolio. Requirements are documented without being systematically enforced.
Methodology is documented, approved, and applied consistently across the portfolio.
First stable plateau
Performance is measured against defined targets. Evidence-based decision replaces judgement-based assessment.
Governance adapts to emerging capability and regulatory change before adaptation is required.
The design decisions
What each domain produces, and which domains consume it
Every governance domain carries a stated scope and stated interfaces. The specification names the outputs each domain produces and the domains that consume them.
A test, a record, and a lifecycle point
Each principle is paired with a method that tests it, a document that records the result, and a lifecycle point at which the test occurs.
One architecture rather than a choice among three
Risk-based, management-system, and control-based approaches are combined within a single architecture, removing the requirement to adopt one and improvise the remainder.
Board decision to audit finding, in either direction
A decision on acceptable risk connects to the control implementing it and to the audit finding that verifies that control, forming a chain traversable in both directions.
Data, personnel, process, and supply chain
The unit of governance is the deployed capability: the data pipeline supporting it, the personnel operating it, the process it executes within, and the suppliers on which it depends.
The Body of Knowledge
The Body of Knowledge specifies how AI governance is practised within each discipline and how the disciplines interconnect. Each chapter treats the work the discipline performs, where accountability sits, the risks it must anticipate, the evidence that demonstrates execution, and the criteria distinguishing a mature practice from a nascent one.
The Certifications
The Body of Knowledge is the only material needed to prepare.
Covers the full scope of AI governance: risk, compliance, security, ethics, and legal as one connected discipline. The entry point for anyone entering or working in AI governance.
AI risk identification, assessment, treatment, and monitoring. Including risks specific to AI such as bias, drift, hallucination, and emergent behaviour in agentic systems.
Threats to AI systems, including adversarial inputs, data poisoning, prompt injection, and model extraction, and the security controls to address them across the AI lifecycle.
Independent audit of AI systems, programme design, evidence collection, compliance verification, and conformity assessment.
Data quality, lineage, privacy, and protection obligations across the AI data lifecycle, from training data through to model outputs.
AI vendor evaluation, supply chain risk, model provenance, and governance of third-party AI systems and foundation models.
Certification by area of practice
Individuals certify in the discipline they practise. Organisations use the same material as an assessment instrument, measuring current governance capability against a defined standard.
Practitioners moving into AI governance from an adjacent field, or building competency ahead of taking on the accountability.
Chief risk officers, heads of compliance, and the teams accountable for AI risk methodology, assessment, and enterprise reporting.
Procurement leads and vendor managers accountable for supplier selection and for governing what those suppliers deliver.
Executive committees, board directors, and policy makers accountable for AI strategy, risk appetite, and enterprise governance.
CISOs, AI security engineers, data protection officers, and data governance leads operating at the technical surface of AI systems.
Internal and external auditors, conformity assessment bodies, and regulators applying the same architecture as the organisations they oversee.
The Body of Knowledge is available to anyone practising AI governance, whatever discipline they entered from.
