A customized, framework-mapped AI Management System control library, versioned and maintained in the open. This is the control set behind the live AIMS governance dashboard at jamesgrc.com/aims (the dashboard runs on synthetic data).
The control library, split into ten domains aligned to ISO/IEC 42001 and core AI-governance themes.
| File | Domain |
|---|---|
Domain1_Govern.md |
Govern — AI policy & accountability |
Domain2_Context.md |
Organisational Context |
Domain3_Risk.md |
AI Risk Management |
Domain4_Impact.md |
AI Impact Assessment |
Domain5_Data.md |
Data Governance |
Domain6_Lifecycle.md |
AI System Lifecycle |
Domain7_Trust.md |
Trustworthy AI |
Domain8_Human.md |
Human Oversight |
Domain9_Transparency.md |
Transparency |
Domain10_ThirdParty.md |
Third-Party AI |
Within each domain, controls are grouped into categories (e.g. GOV.PO — AI Policy) and given a unique ID (e.g. GOV.PO-01). Every control documents:
- Applies To — the assets, records, and entities in scope
- Control Details — the implementation requirements
- Control Mapping — the authoritative standards, regulations, and frameworks the control satisfies (ISO/IEC 42001, NIST AI RMF, EU AI Act, OECD AI Principles, and others)
AIMS References.md — the consolidated source list: every authoritative reference cited across the domain control mappings. Exported from the dashboard's References tab.
ISO/IEC 42001 · ISO/IEC 23894 · NIST AI RMF (AI 100-1) · EU AI Act · EU GDPR · EU NIS 2 · OECD AI Principles · OWASP AI Exchange / AISVS / Agentic AI Top 10 · NIST SSDF (SP 800-218 / 218A) · UK NCSC Secure AI Guidelines · CSA AI Controls Matrix (AICM) — among others; see AIMS References.md for the full list.
A reference and portfolio artifact demonstrating a standards-based, measurable approach to AI governance — not a turnkey policy pack. Controls are written to be assessed and matured on a regular cadence, and to be evidenced to auditors, executives, and a board. Coverage addresses both third-party/acquired and internally developed AI.