Accountability and decision rights
Who owns this decision, and where is that written?
A decision with no named owner still gets made: by a supplier's default, an engineer's judgement call, or nobody, until an incident assigns it in hindsight. The governing body remains accountable either way.
Note
Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Leadership
The leadership pages
Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.
- Choosing between human review, human oversight, and autonomous authority for AI-assisted workdecision narrative
- Choosing how much cloud and supplier concentration to accept and what exit readiness to maintaindecision narrative
- What the governing body should require before an AI system goes into productionexecutive brief
Documents
The governing documents
The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.
- Exception and Risk Acceptance Management Policypolicy, Governance
- AI Governance and Risk Frameworkframework, AI
- AI Model Risk Frameworkframework, AI
- Supplier and Cloud Governance Frameworkframework, Supply chain
- AI Access and Agent Permissions Standardstandard, AI
- AI and Agentic Development Security Standardstandard, AI
- AI Model Risk Standardstandard, AI
- AI Security and Risk Standardstandard, AI
- AI Testing, Validation and Documentation Standardstandard, AI
- Cloud Exit and Data Portability Standardstandard, Supply chain
- Data Classification and Handling Standardstandard, Security
- Supplier Resilience Monitoring Standardstandard, Supply chain
- Third-Party and Supply Chain Risk Standardstandard, Risk
- AI System Impact Assessment Procedureprocedure, AI
- Business Impact Analysis Procedureprocedure, Resilience
- Change Management and Configuration Control Procedureprocedure, Operations
- Fourth-Party and Nth-Party Risk Procedureprocedure, Supply chain
- Risk Acceptance Procedureprocedure, Risk
- Supplier Exit and Data Return Procedureprocedure, Supply chain
- AI Board Oversight Guideguide, AI
- AI Incident Response Planplan, AI
- Concentration Risk Registerregister, Supply chain
- Model Registryregister, AI
- AI System Register Templatetemplate, AI
- Risk Appetite Statement Templatetemplate, Risk
- Supplier Offboarding Evidence Templatetemplate, Supply chain
Frameworks
Frameworks touched
The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.
- AEO/AEO-S
- Canada TBS Guide on the Use of Agentic AI (comparator)
- Canada Treasury Board Directive on Automated Decision-Making
- Cloud Security Alliance (CSA)
- COBIT
- CSA AI Model Risk Management Framework (2024)
- CSA AICM
- CSA CCM
- CSA STAR
- CTPAT
- Datasheets for datasets
- DORA
- DORA RTS (EU) 2025/532
- EBA Guidelines on outsourcing arrangements
- EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1 (adopted 7 July 2021)
- ETSI EN 304 223 V2.1.1
- ETSI TR 104 128 V1.1.1 (2025-05)
- EU AI Act
- EU Data Act (Regulation (EU) 2023/2854), Chapter VI: Switching between data processing services
- EU GPAI Code of Practice, Safety and Security Chapter (July 2025)
- FSB Cyber Lexicon and Third-Party Risk Toolkit
- GDPR
- IEEE 2883-2022
- ISO 28000:2022
- ISO 31000
- ISO/IEC 20000-1:2018
- ISO/IEC 23894:2023
- ISO/IEC 25059:2023
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27035-3:2020
- ISO/IEC 27036
- ISO/IEC 27036-2:2022
- ISO/IEC 27036-3:2023
- ISO/IEC 38507:2022
- ISO/IEC 42001
- ISO/IEC 42005:2025
- ISO/IEC 42006:2025
- ISO/IEC 5338:2023
- ISO/IEC 8183:2023
- ISO/IEC TR 24027:2021
- ISO/IEC TR 24029-1:2021
- ISO/IEC TR 27563:2023
- ISO/IEC TS 25058:2024
- MITRE ATLAS
- Model card pattern
- NIS 2
- NIST
- NIST AI 100-2e2025
- NIST AI 600-1 (Generative AI Profile)
- NIST AI RMF
- NIST CSF
- NIST IR 8286D-upd1 (Using Business Impact Analysis to Inform Risk Prioritization and Response)
- NIST IR 8312
- NIST SP 800-161 Rev. 1
- NIST SP 800-37 Rev. 2
- NIST SP 800-53
- NIST SP 800-88 Rev. 2
- OECD AI Principles
- OECD Recommendation on Critical Information Infrastructure Protection
- OSFI Guideline E-23 (2025, effective 2027)
- OWASP AI Exchange
- OWASP LLM Top 10
- OWASP Top 10 for Agentic Applications (ASI)
- SANS CAISG v1.4
- Singapore IMDA Model AI Governance Framework for Agentic AI (v1.5, 2026)
- WCO SAFE
Go deeper