What this record represents
General principles, framework, and process guidance for managing risk across organizations.
Why it matters
It provides the enterprise risk foundation into which AI-specific risk practices can be integrated.
How the library classifies this instrument
Categories
Key topics
Questions that must be answered before reliance
- 01
Who issued or published this instrument?
- 02
What legal, regulatory, contractual, professional, or voluntary force does it carry?
- 03
Which edition, amendment, or publication state is being relied upon?
- 04
Has it been adopted, incorporated, superseded, withdrawn, stayed, or replaced?
- 05
Does the cited authority govern this actor, system, place, activity, and time?
- 06
What evidence proves that the authority was current at the decision boundary?
Publication, recognition, or institutional importance does not automatically establish binding force. The user must preserve the legal, regulatory, contractual, professional, or organizational path that gives this instrument effect.
Questions that connect the instrument to the governed matter
- 01
Which jurisdiction or institutional boundary governs the matter?
- 02
What actor role is being evaluated: provider, deployer, owner, operator, reviewer, or authority?
- 03
Which lifecycle stage or operational event triggered review?
- 04
Which system, environment, process, population, or consequence is within scope?
- 05
What exemptions, thresholds, transition periods, or sector overlays may alter applicability?
- 06
What unresolved facts require HOLD or ESCALATE rather than assumption?
Authority, scope, evidence, and route are sufficiently resolved.
Material evidence or applicability facts remain missing.
The proposed reliance conflicts with the verified authority boundary.
Competent legal, technical, professional, or regulatory review is required.
What a defensible reliance record should preserve
- 01
What primary source was inspected?
- 02
What version, date, edition, or official publication identifier was preserved?
- 03
What evidence connects the instrument to the specific governed route?
- 04
What continuity records show that the evidence remained intact and attributable?
- 05
What limitations, conflicts, or unverified dependencies remain?
- 06
What outcome evidence will be preserved after execution?
Official text, publication page, issuing authority, and stable source reference.
Edition, amendment, publication date, effective date, and adoption state.
The legal, regulatory, contractual, professional, or organizational basis for reliance.
Jurisdiction, actor, lifecycle stage, system, sector, thresholds, and exclusions.
The specific provisions, controls, or expectations connected to the governed route.
ALLOW, HOLD, DENY, or ESCALATE with reasons and unresolved evidence.
What technical or institutional action was actually enforced or prevented.
The resulting state, observed consequence, limitations, and future reliance boundary.
Common ways governance records are overstated
A recognizable title is treated as sufficient authority without verifying edition, issuer, status, scope, or source.
A framework, standard, principle, or guidance document is described as law without a separate adoption or contractual basis.
An instrument from one jurisdiction is used as though it directly governs another place, actor, or public authority.
A newer publication is assumed to control even though an older edition remains the legally adopted or contractually incorporated version.
The existence of an instrument is mistaken for proof that every requirement applies to the present system or action.
A secondary summary, article, checklist, or vendor interpretation replaces inspection of the controlling source.
Similarity between two instruments is presented as equivalence without preserving differences in authority, scope, and evidence.
The record stops at policy interpretation and preserves no evidence of what was executed or what consequence followed.
Related governance records
Related records may support, implement, overlap with, or differ from this instrument. Relationship does not establish equivalence.
Learn how to read governance instruments without overstating them
The Academy separates recognition from authority, authority from applicability, applicability from admissibility, and admissibility from executed outcome. That separation is essential when governance claims may bind consequence to reality.
Distinguish laws, regulations, standards, frameworks, principles, guidance, and architectures.
Identify how an instrument acquires binding, contractual, professional, or voluntary force.
Resolve actor, system, jurisdiction, lifecycle, threshold, exemption, and sector questions.
Preserve source identity, version continuity, requirement mappings, determinations, and outcomes.