WHAT’S INSIDE
A Governance Program Is Not a Collection of Compliance Projects
Organizations building AI governance today face an abundance problem. The NIST AI RMF offers risk functions, ISO/IEC 42001 offers a certifiable management system, the EU AI Act and state law impose obligations, and customers send questionnaires reflecting all of them at once. The common response is to stand up a program per source, and the result is disconnection: inventories that disagree, controls implemented twice, and evidence collected fresh for every audit.
This guide specifies the eight components a complete program must contain, shows how the major frameworks and regulations layer onto them without duplication, and treats at length the two components most often built badly, all unified through the ARISE Framework™. IBM’s 2025 research found that one breached organization in five was compromised through shadow AI that no inventory contained, the exposure a single, current inventory is built to eliminate.
The eight components of a complete program. Eight components recur in every defensible program, each mapped to an ARISE domain: inventory, risk classification, intake and approval, testing and evaluation, runtime controls, monitoring, incident handling, and documentation and evidence.
Layering the frameworks without duplication. How ISO/IEC 42001, the NIST AI RMF, and regulatory obligations occupy distinct layers over one control base, with the ARISE crosswalk recording each control once and mapping it to every clause, subcategory, and article it satisfies.
The inventory and the evidence architecture. The two components most often built badly, treated in depth: a five-register inventory that finally covers shadow AI, prompts, models, and agents, and an evidence architecture that attaches proof to controls so each audit becomes a lookup rather than a fresh scramble.
Appendix A, the program completeness self-assessment. Eleven questions grouped across components, integration, and evidence, where each “no” locates a missing component or a missing connection between them, applied to the program that operates today.
