Control

Layer 4 decides and verifies. It does not build, operate or execute anything it decides about.

The boundary most often crossed in practice. Where Layer 3 is weak, Layer 4 absorbs execution. The risk function starts running model validation because nobody else will, the compliance team builds the evidence pack itself, and the audit function writes the control it later tests.

Each step is well-intentioned and each destroys the separation this layer exists to create. A Layer 4 that produces the evidence it verifies is not governing. It is doing Layer 3’s work with less capability and no independent check.

The separation of build and acceptance convention in section 0.1 of the normative reference applies to this layer in the reverse direction from Layer 3. Layer 3 must not accept. Layer 4 must not build.

Layer 4 is the only layer whose outputs are consumed by all five others. Where Layer 3 is an evidence factory, Layer 4 is the authority source. Every mandatory control, threshold and authorization elsewhere in the framework originates here.

The practical consequence is that a weak Layer 4 does not produce visible failure. It produces five layers operating on their own judgment, each competently, with no shared basis.

Thirty-eight decisions, grouped by class. Grouping rather than trimming is deliberate: this layer holds every authorization the other five exclude, and a reader needs to find the relevant six rather than read all thirty.

L4-AUT-02 and L4-AUT-03 are decided together and neither takes effect without the other. One authorizes what an agent may do in the business; the other certifies how independently it does it. They are held by different roles deliberately, and separating them in time produces an agent authorized to act with no certified autonomy position, or a certified autonomy position for actions nobody authorized.

An autonomy increase that removes a human step is a reallocation of work. Where L4-AUT-03 moves a system from acting on confirmation to acting with notification, or from notification to autonomous, work has moved from a person to a system whether or not anyone described it that way. That triggers L5-12, and without the trigger the aggregate position at L6-05 undercounts by exactly the amount autonomy has advanced.

The last row is a safety valve and it should be used rarely. A domain owner who cannot compel withdrawal holds accountability without authority. A domain owner who compels routinely has replaced the accountable executive.

Triggers. Two decisions in this layer previously stated a review cycle and no event, which made them decisions that get made late or skipped.

L4-CLS-01, publish and revise the delegated band thresholds. Fires on a regulatory change affecting an obligation in the register. On an incident in which a delegated band is implicated. When a band produces an outcome the AI Governance Board would not have accepted, which is the important trigger and the hardest to detect.

L4-RSK-06, accept the aggregate exposure position. Fires when provider concentration crosses the limit set at L6-04. When a new production system enters a data domain that already feeds a stated number of systems. On a provider event affecting the estate: deprecation, material pricing change, safety intervention or extended outage.

L4-RSK-06 and L6-04 form a control loop. The exposure assessment triggers posture revision, and the posture sets the limit that triggers the assessment. This is intentional.

On aggregate exposure. The last row assesses the estate rather than any system in it. It exists because per-system acceptance cannot detect concentration, correlation or cumulative effect, and because no instrument in section 8 requires it. Section 6 states the artifact and its scope.

On convening the AI Risk Committee. The committee arbitrates. It does not hold routine risk acceptance and it does not meet on a calendar. It convenes when any one of the following occurs: a domain owner declines to accept a risk the Business Accountable Executive intends to proceed against; two domain owners reach incompatible positions on the same system; a system at or above materiality requires classification; a domain owner compels withdrawal under section 5.3.

A committee with no trigger acquires routine decisions that belong to named individuals, which is the failure the composite accountability model exists to prevent.

Scoping. Organization-level artifacts are required from the stated maturity level. System-level artifacts are required per AI system, model, interface or event according to the condition stated. Artifacts in bold are part of the Level 2 minimum. See the minimum viable set document for what this amounts to at small scale.

The AI system identifier. The AI system register issues one identifier per governed system. The Layer 1 CMDB and the Layer 3 model registry each carry it as a foreign key on the items belonging to that system. This is what makes quarterly reconciliation possible rather than aspirational. Without a shared key, reconciling three registers means matching on names, and names diverge.

Reconciliation is performed by the Head of Risk as register owner. Internal Audit tests it during the audit cycle rather than performing it, because a function that reconciles its own register cannot verify the result.

The failure it detects runs in both directions. A model in the Layer 3 registry with no AI system identifier is running without accountability. A register entry with no corresponding configuration item may be a governance record for something that is not running at all.

Aggregate exposure assessment. Scope is stated below. Method is not prescribed, because prescribing one now would mean inventing one. The assessment covers, at minimum: provider concentration; correlated failure through shared data; cumulative automated decisioning.

Each is invisible to per-system assessment, and each is where an estate of individually acceptable systems becomes collectively unacceptable.

The AI system register is the artifact everything else depends on. Policy applies to systems. Classification applies to systems. Accountability names a person for a system. Without a register, every other artifact in this table describes something that cannot be enumerated, and the layer governs an estate it cannot list. It is also the artifact most likely to be assumed to exist. Layer 1 holds a CMDB and Layer 3 holds a model registry, and both are frequently mistaken for it. They hold different objects.

The fifth metric is deliberately self-referential. This layer’s most common failure is issuing requirements it never revisits, and no other layer can detect that.

Two gaps this crosswalk exposes. No instrument in the list requires a single named person accountable for the composite decision to deploy and operate an AI system. Each requires roles, responsibilities and defined accountability in general terms. None forces one name against one system. That requirement is AI9GM’s, and it is the requirement most likely to be resisted, because it converts a distributed comfort into an individual exposure.

None governs aggregate exposure. Every instrument assesses AI systems individually. An organization can hold forty systems, each classified correctly, each within domain appetite, each with a valid acceptance, and no view of what they amount to together.

AI9GM v0.9 addresses this with the aggregate exposure assessment at section 6 and the acceptance decision at section 5.4. Scope is stated and method is not prescribed. This is the second contribution the framework makes beyond the instruments it crosswalks against.

The distance between levels 2 and 3 is dominated by two artifacts that do not exist at level 2: the AI system register and the published threshold table. Both are modest documents. Neither is technically difficult. Both require someone to make decisions that have been comfortable to leave open.