Strategic

Layer 6 decides whether and why. It decides nothing about how.

The boundary most often crossed in practice, and it runs downward rather than upward. Every other layer in this framework has a seam where it accumulates authority belonging above it. Layer 6 has the opposite problem. It cedes authority it holds.

The mechanism is ordinary. The Portfolio Board funds initiatives. Initiatives get delivered. Someone then writes a strategy document describing what the organization is doing with AI, and it describes the sum of what was already funded. The strategy is coherent, accurate and entirely retrospective. It directed nothing.

An organization in this condition has a Layer 5 that sets strategy through funding decisions and a Layer 6 that documents it afterward. Nobody chose this and it is difficult to see from inside, because the strategy document exists and reads well.

The closure is the same shape used at Layer 5. A funding decision requires a traceable strategic outcome as an entry condition. The Portfolio Board still decides what gets funded and when, which is its competence. It cannot fund toward an outcome nobody stated.

Input 10 is the one that makes this layer a governance layer rather than a planning function. Strategy set without a view of the organization’s governance maturity produces commitments the other five layers cannot support.

Output 2 is what makes the framework operable as a plan rather than as a description. An organization that states a target maturity per layer has converted a governance model into a roadmap. One that does not has six layers and no destination.

Three allocations carry the weight of this layer.

Triggers. Two decisions in this layer previously stated a cycle and no event.

L6-04, set the model sourcing posture and concentration limit. Fires when the Layer 4 aggregate exposure assessment reports concentration above the stated limit. On admission of a model from a provider not currently in the estate.

L6-05, accept the aggregate work reallocation position. Fires when cumulative reallocation crosses the workforce reallocation materiality threshold published at Layer 4 §5A. That threshold previously existed with nothing firing against it.

L6-04 and the Layer 4 aggregate exposure acceptance form a control loop, and it is intentional. The assessment triggers posture revision; the posture sets the limit that triggers the assessment.

The decision not to use AI is a recorded decision. Under the proportionality rule it is documented at a level matching its materiality, and for most capabilities that is a short entry. It is recorded because an organization that never documents restraint cannot distinguish between a capability it examined and rejected and one it never considered. The first is judgment. The second is a gap. From the outside they look identical, and after eighteen months they look identical from the inside too.

Aggregate reallocation can remove the competence oversight depends on. A function that no longer performs a task cannot competently review a system doing it, and EU AI Act Article 26(2) requires that competence in anyone assigned human oversight. Layer 5 sets AI literacy requirements per role and nothing else connects the two, so an organization can satisfy the literacy requirement with training while quietly removing the experience that made the training meaningful. Acceptance of a position under this decision re-triggers L5-10.

Maturity targets are set here, per layer. This is the decision that turns AI9GM from a description into something an organization can be measured against. It also constrains ambition honestly: a strategy requiring level 4 Control cannot be approved by an organization sitting at level 1 without the row below.

Proceeding past a maturity gap is permitted and must be named. Organizations will pursue AI capabilities their governance cannot yet support, and a framework that forbids it will be ignored rather than followed. The requirement is that the gap is stated in the approval and carries a remediation plan bound to the same decision. The failure this prevents is not ambition. It is ambition that nobody wrote down as a risk.

Scoping. Organization-level artifacts are required from the stated maturity level. System-level artifacts are required per AI system, model, interface or event according to the condition stated. Artifacts in bold are part of the Level 2 minimum. See the minimum viable set document for what this amounts to at small scale.

The capability decision register is the artifact nobody has. Organizations keep records of what they decided to build. Almost none keep records of what they decided not to build, which means the reasoning is lost, the same proposal returns every eighteen months, and the organization relearns the same conclusion at full cost.

Revenue, market position and competitive measures are excluded. All are outcomes the strategy pursues rather than measures of whether this layer is governed.

Two gaps this crosswalk exposes. No instrument requires an organization to record a decision not to use AI. Every framework listed governs the AI an organization has. None creates a record of the AI it considered and declined, which means restraint leaves no evidence and cannot be distinguished from inattention.

No instrument makes governance capability a precondition of strategic ambition. Each specifies what good governance looks like. None requires an organization to state what governance capability its strategy needs, or to name the gap when it proceeds without it. The maturity target and the gap approval at section 5 are AI9GM’s, and together they are the mechanism that connects the strategic layer to the five beneath it rather than leaving it as an aspiration on top.

The distance between levels 2 and 3 is the largest in the framework, and it is almost entirely about sequence. At level 2 the strategy describes what was funded. At level 3 the funding requires a strategy to point at. No new capability is needed. The order of two existing activities has to be reversed, and that is harder than it sounds because it means the Portfolio Board has to decline a good proposal that serves no stated outcome.