← All domains
Domain 09 · Domains 8–9
Governance, Oversight & Continuous Review
The governance body, risk tiering, system inventory, agentic AI, incident response, and continuous review — the foundation established first.
Key AI risks
▹Ungoverned AI proliferation across the institution
▹Agentic systems acting autonomously without oversight
▹No shared risk-tiering standard or system inventory
▹Fragmented ownership leaving shared risks unassigned
Governed through the RMF Playbook
Each function pairs the outcome to reach for this domain (the Playbook's About) with the Playbook's suggested actions.
Govern
Establish the body, charter, and accountability that hold the whole AI-governance system together.
Playbook · suggested actions
Charter the governance body and the incident-response process.
Map
Maintain the shared risk-tiering standard and system inventory that let the institution see all of its AI.
Playbook · suggested actions
Maintain the risk-tiering standard and the AI system inventory.
Measure
Track risk, review policy, and assess whether governance capacity and resourcing are keeping pace.
Playbook · suggested actions
Keep a risk register and run annual policy and resourcing reviews.
Manage
Respond to incidents, govern autonomous systems, and coordinate the risks that cross domains.
Playbook · suggested actions
Respond to incidents and govern agentic and cross-domain risks.
Worked case studies · the RMF Playbook applied
10 scenarios
Each step is a Playbook suggested action for that function; the evidence line is the transparency & documentation you keep.
An agentic AI proposal reaches the governance body
AI Governance Body · agentic AI review
IT proposes an autonomous agent that can take actions directly inside the student information system.
Govern
Apply the AI governance charter, the incident-response policy, and the agentic-AI standard.
Map
The risk-tiering standard classifies the agent as consequential; log it in the AI system inventory.
Measure
Add it to the risk register and run the annual review plus enablement and equity-resourcing checks.
Manage
Require human-in-the-loop approval, hard action boundaries, an escalation path, and cost governance.
Outcome — The agent is approved with strict action boundaries and a kill-switch, and is tracked in the inventory.
Evidence: Risk-register entry + agentic-AI review record
Chartering the AI governance body
Cabinet · governance charter
The institution has scattered AI efforts but no standing body to govern them.
Govern
Adopt an AI governance charter defining authority, membership, and scope.
Map
Map the domains and stakeholders the body must cover, including students.
Measure
Set the cadence and metrics the body will report on.
Manage
Stand up the body and begin its review cycle.
Outcome — A cross-functional body owns AI governance with clear authority.
Evidence: Approved charter + membership roster
Building the AI system inventory
Governance · inventory
No one can say how many AI systems the institution actually runs.
Govern
Adopt the system-inventory standard defining what each entry captures.
Map
Discover deployed systems and record purpose, owner, data, and risk tier.
Measure
Check inventory completeness against procurement and deployment records.
Manage
Make inventory entry a required step in approval, maintained by Domain 5.
Outcome — The institution can see all its AI in one authoritative inventory.
Evidence: System inventory + entry-at-approval rule
Setting the risk-tiering standard
Governance · risk tiering
Governance intensity is applied unevenly because there is no shared risk definition.
Govern
Adopt the three-tier risk standard as institutional policy.
Map
Define what makes a system assistive, operational, or consequential.
Measure
Classify existing systems and validate the tiers.
Manage
Apply tier-appropriate governance and revisit borderline cases.
Outcome — Every system gets governance proportional to its actual stakes.
Evidence: Risk-tiering standard + classified inventory
Responding to an AI incident
Governance · incident response
An AI system exposes data or produces a harmful decision and must be handled fast.
Govern
The incident-response policy defines roles and escalation.
Map
Scope the incident — systems, data, and people affected.
Measure
Assess impact and root cause.
Manage
Contain, remediate, notify, and feed lessons into policy.
Outcome — The incident is contained and drives durable improvements.
Evidence: Incident report + corrective actions
The annual policy review cycle
Governance · continuous review
AI policies risk going stale as the technology and law move quickly.
Govern
The review standard requires an annual policy review.
Map
Identify which policies, standards, and guidelines are due.
Measure
Assess policy adequacy against new risks and rules.
Manage
Update on appropriate cycles — guidelines fast, policies deliberately.
Outcome — Governance stays current without freezing on a single snapshot.
Evidence: Review record + updated policy set
Horizon scanning and innovation intake
Governance · emerging tech
New AI tools arrive faster than governance can react, and staff want a way in.
Govern
Establish a horizon-scanning and innovation-intake process.
Map
Capture proposed new tools and emerging risks.
Measure
Triage submissions by risk for governance review.
Manage
Route promising, low-risk ideas to pilots and flag risks upward.
Outcome — The institution welcomes innovation without ungoverned surprises.
Evidence: Intake log + horizon-scan summary
Orchestrating shadow-AI remediation
Governance · cross-domain
Shadow AI keeps surfacing and no single office owns the end-to-end response.
Govern
Domain 9 owns orchestration of the shadow-AI response.
Map
Discovery (Domain 5) surfaces tools; classify and escalate.
Measure
Track incidence, exposure, and remediation across domains.
Manage
Coordinate Domain 5 discovery, Domain 7 vendor remediation, and reporting.
Outcome — Shadow AI is handled end-to-end instead of falling between offices.
Evidence: Shadow-AI register + coordination record
AI cost and license governance
Governance · financial sustainability
AI spend and licenses are proliferating with no central view of cost.
Govern
AI financial-sustainability governance covers licenses and consumption.
Map
Inventory enterprise licenses and API/token consumption.
Measure
Track total cost of ownership and chargeback across units.
Manage
Consolidate licenses and report cost in the annual leadership review.
Outcome — AI spend is visible, consolidated, and sustainable.
Evidence: Cost review + license consolidation plan
Board reporting on AI risk posture
Governance · leadership reporting
Leadership and the board need a clear, honest picture of AI governance maturity.
Govern
The charter requires an annual report to leadership and the board.
Map
Assemble posture across domains — risks, adequacy, and resourcing.
Measure
Assess governance, enablement, and equity resourcing against need.
Manage
Report candidly and secure decisions on gaps.
Outcome — Leadership governs AI with a clear, honest view of risk and readiness.
Evidence: Annual governance report + board minutes
Risk-tier examples
Consequential
Agentic AI taking autonomous action — Domain 9 owns the risk-tiering and inventory standards that classify it.
Tools & artifacts
AI governance charter
AI risk register
Risk-tiering standard
AI system inventory
Incident-response plan
Key controls & instruments
AI governance charter
Institutional AI risk-tiering standard
AI system inventory standard
Agentic AI governance standard & incident response