Frameworks, policies and the lifecycle

Compliance Mode governs a task when it starts. This is what keeps that governance true afterwards — when an exception runs out, a model changes, a policy is revised or something goes wrong. Policies, exceptions, reviews and incidents are in Business and Enterprise; frameworks, your own frameworks, reassessment on material change and agent authority are in Enterprise.

The governance dashboard#

Admin → Agent governance → AI governance counts what matters across the organisation: AI systems, what is in production and at high risk, governed tasks, outstanding controls, pending approvals, expired exceptions, open incidents and what needs review. Filter by AI system, risk, owner and provider — and on Enterprise by jurisdiction and framework. It shows counts, never a compliance score.

Policies#

AI policies holds your internal AI policies, one row per version. A governed task records the version it was evaluated against, and approvals for its controls say so. Publishing a new version never rewrites that: the task shows that a newer version is in force and recommends a reassessment, which a person makes.

Exceptions#

A control that does not apply for now gets an exception, not a silent skip: why, who owns it, the risk accepted, what compensates for it, and an expiry no more than three years out. Only a person grants one. When it expires, the control is outstanding again and the dashboard counts the lapse until someone acts.

Reviews and incidents#

• Recurring reviews. Set a review cycle on a governed task. When a review falls overdue, the governance gate stops the work until a person records one.
• Incidents. Anyone — an agent included — can report an AI incident against a task or an AI system. A high or critical incident closes the gate for the work it concerns until a person resolves it, saying how. A report cannot be withdrawn.

Frameworks#

Frameworks maps external and internal frameworks onto the same controls, so evidence recorded once counts towards every framework that asks for it. On Business the mappings are there to read. On Enterprise you apply a framework: its requirements become controls on governed tasks wherever it applies — a regional pack only in its jurisdictions — and each control shows the requirement behind it. The built-in packs:

• NIST AI Risk Management Framework (NIST AI 100-1, AI RMF 1.0 (January 2023)), version 2026.10
• ISO/IEC 42001 AI management system (ISO/IEC 42001:2023, clauses and Annex A controls), version 2026.10
• EU AI Act (Regulation (EU) 2024/1689), version 2026.10, in EU
• UK AI regulatory principles (A pro-innovation approach to AI regulation (2023), the five cross-sector principles), version 2026.10, in UK

A task keeps the framework version it was assessed under. When you apply a newer version, tasks already assessed are recommended for reassessment rather than changed. You can also write your own framework from your internal AI standard — an agent can draft one — with your own controls; it applies only once a person publishes and applies it, and a published version is never edited.

Reassessment#

On Enterprise, Deliverd reopens the assessment when something material changes: a new provider, model or model version; personal or sensitive data that was not there before; a new jurisdiction; internal use becoming external; a recommendation becoming an automated decision; more autonomy or less oversight. The gate closes until a person completes the reassessment, and evidence the change makes stale — an evaluation of the old model, an approval of a smaller role — stops counting.

What agents may do#

On Enterprise, set what agents may do on their own, only with a person's approval, or not at all — for the organisation, and stricter for a particular agent. Governed work asks the gate before each kind of action. Where nothing is set: