Proprietary Framework · AI Governance

NS-AIGF v1.0

A proprietary, structured, and automation-ready approach to AI governance for organisations deploying, developing, or procuring AI in regulated and high-impact environments — replacing fragmented compliance efforts and aspirational governance with a single, evidence-based, board-ready model for continuous AI accountability.

60Governance Controls

7Weighted Domains

300Control Interpretations

3Frameworks Unified

L1–L5Maturity Progression

Controls 60 AI Governance Controls across 7 Weighted Domains Aligned EU AI Act · ISO 42001 · NIST AI RMF · 3 Frameworks Unified Domains Risk Classification · Transparency · Human Oversight · Data Governance Coverage High-Risk AI · GenAI · Foundation Models · Agentic AI Systems Output AI Governance Posture Score · Board Reports · Audit Trails Maturity 300 Control Interpretations · Weighted Domain Scoring Platform Paxley · Continuous NS-AIGF Monitoring in Production Controls 60 AI Governance Controls across 7 Weighted Domains Aligned EU AI Act · ISO 42001 · NIST AI RMF · 3 Frameworks Unified Domains Risk Classification · Transparency · Human Oversight · Data Governance Coverage High-Risk AI · GenAI · Foundation Models · Agentic AI Systems Output AI Governance Posture Score · Board Reports · Audit Trails Maturity 300 Control Interpretations · Weighted Domain Scoring Platform Paxley · Continuous NS-AIGF Monitoring in Production

Why NS-AIGF Was Built

For most of the past decade, organisations deploying AI have operated on a fundamentally flawed premise: that having an AI ethics policy, a responsible AI statement, and a risk committee that meets quarterly constitutes AI governance. It does not. It constitutes AI governance theatre — the appearance of accountability without the operational substance that accountability requires.

That world is over. The EU AI Act entered into force in August 2024. ISO/IEC 42001, the world's first AI Management System standard, was published in December 2023. Regulators across 40+ countries reference the NIST AI RMF. AI governance is no longer an ethical aspiration — it is a regulatory obligation.

NS-AIGF v1.0 was designed from first principles as a purpose-built AI governance architecture for this regulatory environment. Every control was designed through four lenses: specificity (one auditable requirement per control), regulatory alignment (specific article or clause mapping), evidence clarity (what adequate evidence looks like at L1–L5), and maturity differentiation (distinct criteria distinguishing ad hoc intent from automated, continuously validated governance).

The Gap

Governed on paper, exposed in practice

Organisations with comprehensive responsible AI policies and active ethics committees are being found non-compliant with EU AI Act requirements every year — not because they lack principles, but because they lack the specific operational controls that binding regulation requires.

The Cost

Fragmented compliance is expensive

Managing EU AI Act, ISO 42001, and NIST AI RMF as three separate programmes — 600–1,200 person-hours annually in duplicate evidence collection, separate audit cycles, and inconsistent maturity views rather than one defensible truth.

The Answer

One control library. Three regulatory obligations. One evidence base.

Control 15 — Human Oversight, implemented to NS-AIGF v1.0 standard, simultaneously satisfies EU AI Act Art. 14, ISO 42001 §8.4, and NIST AI RMF MANAGE 2.2 — with one evidence collection exercise and one maturity score.

Framework Architecture

Domain Weights & Coverage

7 weighted governance domains across 60 controls. Domain weights reflect EU AI Act enforcement priorities and ISO 42001 certification requirements — not arbitrary allocation. D2 Risk Classification carries the highest weight because getting AI risk classification right is the prerequisite for all other compliance obligations.

D118%

D222%

D315%

D412%

D512%

D613%

D78%

D1 — AI Governance & Oversight Governance Structure & Accountability AI Governance Charter, executive accountability, AI inventory ownership, shadow AI detection, third-party AI vendor governance, AI acceptable use policy, and AI training programme. Foundational governance authority — without it, all other controls are legally insufficient.

18%8 CONTROLS

D2 — Risk Classification & EU AI Act EU AI Act Compliance Controls AI risk classification (four-tier EU AI Act taxonomy), high-risk AI identification against Annex III, prohibited use controls (6 banned categories), conformity assessment management, risk reassessment on model change, and technical documentation (Art. 11). Classification errors create direct and immediate legal exposure.

22%HIGHEST WEIGHT

D3 — AI Lifecycle & Model Governance Operational AI Control Points Use case approval gate, model registry, model versioning (Art. 11), testing gates before production deployment, rollback capability, post-market monitoring (Art. 9), and model retirement. Without these, governance policies have no operational implementation.

15%LIFECYCLE LAYER

D4 — Data Governance for AI Training Data & Pipeline Integrity Data lineage, data quality management, bias in data detection (EU AI Act Art. 10), consent and legal basis (GDPR), data minimisation, sensitive data handling, and data drift detection. Most AI failures trace to data governance failures that occurred before the model was trained.

12%DATA LAYER

D5 — Fairness & Responsible AI Explainability, Fairness & Human Oversight Explainability framework, model cards, transparency obligations (Art. 13), human oversight mechanisms (Art. 14), bias testing and fairness, fairness monitoring in production, adverse impact assessment, and ethical review process. Non-negotiable for regulated and public-facing AI.

12%FAIRNESS LAYER

D6 — AI Security & Monitoring MLSecOps & AI-Specific Attack Surfaces Prompt injection defence (OWASP LLM #1), adversarial robustness testing, model theft prevention, data poisoning controls, AI model access control, continuous performance monitoring, security logging (Art. 12), and anomaly detection. AI attack surfaces that standard cybersecurity frameworks do not adequately address.

13%SECURITY LAYER

D7 — Incident & Auditability Incident Response & Audit Trail Completeness AI incident response playbooks, regulatory reporting (EU AI Act Art. 73 — mandatory for high-risk AI providers), audit trail completeness (tamper-evident), continuous compliance monitoring, and ISO 42001 §9.1 monitoring requirements. The audit trail is the primary evidence source for regulatory investigations.

8%AUDIT LAYER

Framework Specification

NS-AIGF v1.0 replaces voluntary principles with 60 specific, auditable controls — each with 300 control-specific maturity interpretations, a 5-level maturity scale, and simultaneous alignment to the EU AI Act, ISO/IEC 42001, and NIST AI RMF at the article and clause level.

Controls	60 fully defined governance controls across 7 weighted domains — each addressing one auditable governance requirement with specific evidence standards at every maturity level. 300 control-specific interpretations eliminate assessor-dependent scoring.
Maturity Scale	L1 Initial (ad hoc, no structured evidence) → L2 Managed (manual, partially defined) → L3 Defined (standardised, repeatable — baseline for EU AI Act compliance and ISO 42001 certification readiness) → L4 Quantitative (automated, metrics-driven) → L5 Optimising (self-improving, predictive). L1 InitialL2 ManagedL3 DefinedL4 QuantitativeL5 Optimising
Framework Alignment	Every control maps simultaneously to all applicable frameworks at the specific article, clause, and function level: EU AI Act (Articles 9–14, 43, 50, 73) · ISO/IEC 42001 (§4–§10) · NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE functions). One control satisfies obligations across all three frameworks from a single evidence base.
ISO 42001 Pathway	Completing an NS-AIGF v1.0 assessment simultaneously completes a pre-certification readiness assessment. The ISO 42001 Readiness module maps domain scores directly to §4–§10 clauses and calculates a gap-to-certification score — the assessment IS the gap analysis. One improvement programme serves EU AI Act compliance, NIST AI RMF alignment, and ISO 42001 certification simultaneously.
Scoring Formula	Domain maturity scores = mean of all in-scope control scores within the domain. Overall score = sum of domain scores × domain weights. Priority Score = Gap × Domain Weight — a control in D2 with a 3-level gap scores 0.66; the same gap in D7 scores 0.24. Roadmap auto-sorts by priority to direct governance investment where it reduces the most risk.
Assessment Tool	Eight interconnected modules: 20-question Scoping Module (auto-applies control applicability logic), 7 Domain Assessment Modules, auto-generated Board Report, Prioritisation Engine, Evidence Register (collection date, expiry date, owner, status), ISO 42001 Readiness module, and Assessment History for longitudinal maturity tracking across multiple cycles.
Delivery Model	Structured engagement delivering 60-control baseline assessment, domain maturity scores, board governance report, prioritised improvement roadmap, ISO 42001 readiness indicator, and regulatory evidence packages per framework. Continuous reassessment cadence recommended quarterly for high-priority controls.

Controls Organisations Most Commonly Miss

The Operational Controls Principles Cannot Replace

The controls most consistently absent from enterprise AI governance programmes are not strategic — they are operational, technical, and specific. And they are the ones regulators are actively enforcing.

AI Inventory Ownership

A complete register of every AI system deployed, consumed, or integrated across the enterprise — with a named owner accountable for each system's governance compliance. Almost universally missing despite its fundamental importance. At L4, auto-updated through deployment pipeline integrations.

C11

Prohibited Use Controls

Technical and procedural controls that actively prevent the 6 EU AI Act banned AI categories from reaching production — social scoring, real-time biometric surveillance, subliminal manipulation, emotional inference in workplaces. At L4, embedded in deployment pipelines and fire automatically.

C23

Rollback Capability

When a model begins producing incorrect, biased, or harmful outputs in production, the organisation needs the ability to revert to a prior known-good version rapidly. Consistently one of the least mature and most consequential controls in initial assessments. The difference between L2 and L3 here could be the difference between a contained incident and a sustained public AI failure.

C25

Shadow AI Detection

A significant proportion of AI usage in organisations with 100+ employees occurs without IT or governance awareness — ChatGPT, Copilot, Claude, and dozens of vertical-specific tools processing sensitive customer data, proprietary information, or regulated health records without DLP controls or audit trails. At L4, detection is continuous through CASB and network monitoring.

C34

Data Drift Detection

Automated monitoring to detect when the statistical distribution of production data has drifted significantly from the training distribution — causing well-validated models to produce degraded, unreliable, or unsafe outputs silently over time. EU AI Act Art. 9 requires post-market monitoring. This is the technical mechanism through which that obligation is operationalised.

C44

Prompt Injection Defence

OWASP LLM Top 10 #1 — consistently absent or immature in organisations deploying large language models. Prompt injection attacks override model instructions via malicious inputs, causing models to disclose confidential information, ignore safety guardrails, or perform actions outside their intended scope. At L4, automated testing is integrated into the deployment lifecycle.

Continuous Compliance Engine

AI Governance Maturity Assessment Tool

The delivery vehicle for NS-AIGF v1.0 — transforming a governance evaluation into a living management system. Eight interconnected modules automatically generate board-ready governance reporting, a prioritised improvement roadmap, ISO 42001 certification readiness indicators, and longitudinal maturity tracking across assessment cycles. The board report translates maturity scores into governance health narrative that audit committees can act on directly. The evidence register tracks every governance artifact with collection date, expiry date, owner, and status — transforming a week-long audit preparation exercise into a dashboard query. The governance programme generates management intelligence as a natural output of operations rather than as a separate, expensive reporting effort.

Request a demo →

End AI governance theatre — permanently

We assess your AI governance posture across all 60 controls, identify your highest-priority gaps, and build you the board-ready, regulator-ready evidence infrastructure that genuine AI accountability requires.

Request a briefing →Explore Core Pillar 2A →