AI Governance Framework and Document Architecture

1. Purpose

This framework establishes how [CLIENT NAME] governs artificial intelligence (AI) — both the AI tools our people use and the AI systems and agents we build or commission. It defines the governance document hierarchy, the documents in force, how they relate, and the shared definitions used across all of them.

The framework is model-agnostic. Policies and standards state outcomes that apply to any AI vendor or model. Vendor-specific settings are kept in separate Vendor Annexes so that a change of vendor, or a vendor feature release, does not require board re-approval of policy.

2. Design principles

Principle	What it means in this kit
Model-agnostic	Policies and standards never name a vendor. Vendor settings live in Vendor Annexes (AGK-ANX-*).
Proportionate	Three adoption tiers (Lite, Standard, Regulated). Controls are tagged by the minimum tier at which they apply.
Use and Build separated	Track A governs staff use of AI tools; Track B governs building and operating AI systems and agents. Both share one Core.
Enforced as configuration	Wherever possible a control is implemented as a platform setting, not only as a rule people must remember.
Named accountability	Every AI system, connector and agent has a named human owner recorded in a register.
Evidence by design	Every mandatory control has an ID so evidence can be collected and audited against it.
Regulation-ready	Mapped to NIST AI RMF, ISO/IEC 42001, Malaysia AIGE and PDPA, Singapore Model AI Governance Frameworks and MAS guidance, and the EU AI Act.

3. Document hierarchy

Governance documents are organised in five levels. A lower-level document may add detail but must not contradict a higher-level document. Where documents conflict, the higher level prevails.

Level	Type (prefix)	Answers	Binding	Approved by	Typical change frequency
1	Policy (POL)	Why and what — principles, scope, “shall” statements	Mandatory	[Board / CEO]	Annual or on law change
2	Standard (STD)	What exactly — testable controls with IDs	Mandatory	[AI Governance Committee]	6–12 months
3	Procedure (PRC)	How — step-by-step workflow, owners, SLAs	Mandatory	[Control owner]	As needed
3	Guideline (GDL)	How, recommended — practical advice	Recommended	[Control owner]	As needed
4	Template (TPL)	Records — forms and registers	Record	—	Living
5	Vendor Annex (ANX)	Where — vendor settings implementing each control	Implementation	[AI Platform Administrator]	Monthly review

Example — one requirement through four levels A policy says: “AI agents shall not perform irreversible actions without human approval.” The standard turns it into a control: “AGK-STD-A03-C09 — Each write or act tool on a connector shall be set to”needs approval” or “blocked”.” The procedure explains how a request to enable a write tool is assessed and approved. The Vendor Annex states the exact setting on each platform, e.g. the per-tool permission set to “Needs approval”.

4. Tracks and document register

Two tracks, one core

	Track A — AI Use Governance	Track B — AI Build Governance (AgentOps)
Question	How do our people use AI tools safely?	How do we build and run AI systems and agents safely?
Audience	All staff, AI platform administrators, AIGC	Engineers, architects, product and platform teams
Governs	Enterprise AI assistants, connectors, browser and computer-use agents, skills and custom instructions, data input	Agent design, identity and access, evaluation and release, guardrails, monitoring, remediation, model and prompt change
Our role	Deployer / user	Developer, and deployer of in-house systems

The Core (charter, policies, risk assessment, register, vendor assessment, incident response, recertification, training, transparency) applies to both tracks. An in-house agent and a SaaS AI tool go into the same AI System Register, use the same risk tiers and follow the same incident procedure.

Document register

Legend: ● Required · ◐ Condensed version acceptable · ◇ Required once the feature is enabled for any user · ○ Optional · “If used” = adopt the annex for each AI platform in use.