AI Governance

Governance is the artifact you hand a risk committee, not a policy nobody can evidence.

Career ladder

The titles this track maps onto. Levels differ between companies. The useful part is the direction, and what each step adds to the one before it.

1. L1Compliance Analyst
2. L2AI Governance Specialist
3. L3AI Risk Manager
4. L4Head of AI Governance
5. L5Chief Risk / AI Officer

Tech stack

What the work is actually done with. Grouped by the job each tool does, so the list reads as a system rather than a pile of names.

Frameworks

NIST AI RMFISO/IEC 42001ISO/IEC 27001EU AI Act

Regulated

HIPAAGDPRFedRAMPSOC 2

Practice

Model cardsRisk registerEvidence packsApproval workflow

The delivery flow

The order the work actually happens in. Each step is where a decision gets made and written down, not a chapter heading.

1. 1System register
2. 2Ownership + accountability
3. 3Risk classification
4. 4Control mapping
5. 5Evidence collection
6. 6Approval workflow
7. 7Periodic review
8. 8Audit pack

Reference repository structure

A starting layout for this track. The directories are the ones that get added late and hurt. Decisions, evals, policy, lineage. Promoted to the top level where they are visible.

ai-governance/
├── register/              # every AI system, with a named owner
├── risk/
│   ├── classification.md  # tiering criteria, applied consistently
│   └── register.csv
├── controls/
│   ├── nist-ai-rmf/       # mapped control by control
│   └── iso-42001/
├── evidence/              # the artifact an auditor actually reads
│   └── <system>/<control>/
├── approvals/             # who signed, when, on what basis
├── model-cards/
└── reviews/               # scheduled, with dates that are kept

Reading path

9 published guides on this track. Every one is a live page on this site. Nothing here is a placeholder.

1. 01AI Compliance in 2026: HIPAA, FedRAMP, and GDPR for ML Systems
2. 02A Phased Governance Rollout for AI Agents: Crawl, Walk, Run
3. 03AI Governance for the Enterprise: A Practical Framework
4. 04AI for Healthcare in Africa: HIPAA Meets NDPR
5. 05AWS Security Audit Kit, Free, Citadel Cloud Management
6. 06Audit Trails for AI Agents: Making Every Action Attributable
7. 07FedRAMP Cloud Services, Compliant Solutions
8. 08Mapping AI Agent Deployments to ISO/IEC 42001 and NIST AI RMF
9. 09SOC 2 Type II for SaaS Products: The Developer's Playbook

Reference implementations

Citadel’s open-source repositories for this track. Terraform modules, MCP servers, and reference architectures you can read, fork, and run. Apache/MIT licensed; check each repository for its terms.

• GitHubmulti-industry-ai-assistantHIPAA/SOX/OSHA AI assistant for Healthcare, Finance, Oil & Gas. Plugin architecture, PII detection, NLI faithfulness validation, audit logging. FastAPI + Python.multi-industry-ai-assistant on github.com (external site, opens in a new tab)
• GitHubterraform-aws-security-baselineAWS security baseline module with GuardDuty, Security Hub, Config, CloudTrail, Macie, and Access Analyzerterraform-aws-security-baseline on github.com (external site, opens in a new tab)
• GitHubai-agent-soc-triageAI-powered SOC alert triage agent with MITRE ATT&CK classification, severity scoring, and automated response playbooksai-agent-soc-triage on github.com (external site, opens in a new tab)

Primary sources

The standards, framework documents, and vendor references this track is built against. Go here when you need the authoritative wording rather than a summary. In a security review or an audit, the source is what counts.

• NIST AI Risk Management Framework (external site, opens in a new tab)nist.gov
• ISO/IEC 42001 AI management systems (external site, opens in a new tab)iso.org
• ISO/IEC 27001 information security (external site, opens in a new tab)iso.org
• EU AI Act full text (external site, opens in a new tab)artificialintelligenceact.eu
• NIST SP 800-53 security controls (external site, opens in a new tab)csrc.nist.gov
• FedRAMP (external site, opens in a new tab)fedramp.gov

Other tracks