Layer 1 of 8, Know what you run

Governance and risk: decide which AI uses are allowed and keep the evidence

This layer is the register, intake and approval workflow and risk assessment that record who owns each AI use, how its risk was judged and what evidence backs that decision.

7 tools + 0 also cover it
Last reviewed October 21, 2026

See the tools How the eight layers work

Executive summary

What it is: This layer is the register, intake and approval workflow and risk assessment that record who owns each AI use, how its risk was judged and what evidence backs that decision.
The risk: AI that nobody approved or owns, risk decisions with no record and AI vendors nobody assessed. When a regulator, customer or auditor asks how an AI system was approved, there is nothing to show.
What to buy or do: Buy or extend an AI governance platform, often shared with privacy and compliance, and require intake and approval for every AI use case. Check which regulations each vendor states it maps; no platform makes you compliant.

Our analysis Our editorial model, not a standard: OWASP, MITRE and NIST did not create or endorse it. Layer placements are our analysis, based on documented capabilities. How the model works.

The question this layer answers

Which AI systems do we run, who approved them, what risk does each carry, and can we prove it?

Budget line
An AI governance, risk and compliance platform, often shared with privacy, legal and compliance.

What it protects against

Our analysis

AI use nobody approved or owns
Risk decisions with no record
Regulatory and contract exposure from missing evidence
Third-party AI vendors nobody assessed
Staff over-trusting AI output because no policy or training says otherwise

Typical controls

Our analysis

Use-case intake and approval workflow
Register of AI systems, owners, data and vendors
Risk assessment and tiering
AI policy library and acceptable-use policy
Mapping to the regulations and standards the vendor states it supports
Evidence collection and audit reports
Vendor AI risk assessment
Staff training

How it maps to standards

Source states means the framework's own text names the control or outcome this layer delivers. Our analysis means we drew the link. OWASP LLM ids are the 2025 edition; the ATLAS hub holds the MITRE data version.

Governance and risk: standards entries, basis, where the source says it and how it applies
Framework	Entry	Basis	Where the source says it	How it applies
OWASP LLM Top 10 (2025)	LLM02 Sensitive Information Disclosure	Source states	Prevention list	Clear policies on data retention and use, and teaching users what not to enter.
OWASP LLM Top 10 (2025)	LLM03 Supply Chain	Source states	Prevention list	Vetting data sources and suppliers with their terms, and auditing licenses on a schedule.
OWASP LLM Top 10 (2025)	LLM04 Data and Model Poisoning	Source states	Prevention list	Vetting data vendors.
OWASP LLM Top 10 (2025)	LLM06 Excessive Agency	Our analysis	Not named by the source	Approval workflows decide which agent uses need human sign-off. OWASP names human approval as an application control, not a governance workflow.
OWASP LLM Top 10 (2025)	LLM09 Misinformation	Source states	Prevention list	Human review for critical content, telling users the limits of AI output, and training users.
OWASP Agentic Top 10 (2026)	ASI08 Cascading Failures (opens in a new tab) OWASP relates it to LLM01, LLM04, LLM06.	Our analysis	Related: description	Some risks stay unmitigated, and the enterprise must check that they are within its overall risk budget.
OWASP Agentic Top 10 (2026)	ASI09 Human-Agent Trust Exploitation (opens in a new tab) OWASP relates it to LLM01, LLM05, LLM06, LLM09.	Source states	Mitigations 5, 8	Training and assessment of the people who oversee agents.
MITRE ATLAS	AML.M0025 Maintain AI Dataset Provenance	Our analysis	Not named by the source	Registers that record datasets and their lineage support provenance. The control itself sits in layer 3.
MITRE ATLAS	AML.T0060 Publish Hallucinated Entities	Our analysis	Not named by the source	A policy for human review of AI output answers published hallucinated entities.
NIST AI RMF	GOVERN Govern (opens in a new tab)	Source states	GOVERN 1.1, 1.2, 1.6, 2.2, 6.1	Legal and regulatory requirements documented, trustworthy AI in policy, an inventory of AI systems, AI risk training and policies for third-party AI risk.
NIST AI RMF	MAP Map (opens in a new tab)	Source states	MAP 1.1	Intended purposes, uses and context-specific laws are documented, which is what a use-case intake collects.
NIST AI RMF	MANAGE Manage (opens in a new tab)	Source states	MANAGE 1.2	Documented AI risks are prioritized by impact, likelihood and resources, which is what risk tiering does.

Tools in this layer (7)

Tools whose category is AI governance, risk & compliance, listed by name. Compare them with Coverage Scores on the Governance hub.

AI Verify

AI Verify Foundation · open-source AI governance testing toolkit
103 GitHub stars as of Oct 21, 2026; last push Mar 23, 2026

Open sourceApache-2.0
Credo AI

Credo AI · AI governance platform

Commercial
Holistic AI

Holistic AI · AI governance and testing platform

Commercial
IBM watsonx.governance

IBM · AI governance and model monitoring product

Commercial
ModelOp Center

ModelOp · AI governance and lifecycle platform

Commercial
OneTrust AI Governance

OneTrust · AI governance product

Commercial
Saidot

Saidot · AI governance platform

Commercial

Also cover this layer (0)

No tool from another category documents a capability in this layer today.

Gaps we can see

Some governance platforms also describe runtime features. Their capabilities carry governance tags, which are not evidence for layers 5, 6 or 7, so we do not place those platforms there.

What this layer will not do

Governance records decisions; it does not enforce them. A register and an approved policy do not block a prompt, mask data or stop an agent, so each decision needs a control in layers 2 to 8. Registers filled in by hand go stale, which is why automated discovery (layer 2) should feed them. A regulatory mapping shows what the vendor says its templates cover, not that an organization meets the rule. Runtime features that some governance platforms sell, such as SDKs or gateway enforcement, are not placed in other layers here, because their tool files tag them as governance capabilities.

Skills and training

NIST AI RMF GOVERN 2.2 expects people who work with AI to receive AI risk management training for their duties. See the courses and certifications we list. They are not scored and sit outside the eight layers.

Related guides

Governance and risk FAQ

Does an AI governance platform make us compliant with the EU AI Act?

No tool makes an organization compliant. Governance platforms state which regulations and standards their templates and mappings cover, and each tool page shows that wording with its source. Compliance still rests on your own assessments, controls and evidence, so treat the vendor's mapping as a starting point and check it with your legal and compliance teams.

What does NIST AI RMF expect from this layer?

Source states: GOVERN 1.6 says mechanisms are in place to inventory AI systems, GOVERN 2.2 says personnel and partners receive AI risk management training, MAP 1.1 covers documenting intended purposes, uses and context-specific laws, and MANAGE 1.2 says treatment of documented AI risks is prioritized by impact, likelihood and available resources. Those are the register, training, intake and risk tiering controls on this page.

Why is governance layer 1?

Our analysis: the other layers use its outputs. Discovery checks the register against what runs in your accounts, testing and guardrails are sized by risk tier, and agent approvals follow the policy set here. NIST AI RMF calls GOVERN a cross-cutting function that is infused throughout AI risk management and enables the other functions.

Who usually owns the governance budget?

Our analysis: the platform is often shared with privacy, legal and compliance teams, while security takes part through vendor AI risk and the AI register. Agree who approves a new AI use case before you buy, because the approval workflow decides how the product is configured.

Framework sources & last reviewed

Last reviewed October 21, 2026. We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.

Drafted with AI assistance; facts checked against primary sources on October 21, 2026.

OWASP Top 10 for LLM Applications 2025 (list page) (1 sources)