> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/assurance/ai-governance.md).

# AI Governance

Govern AI use cases, data purposes, approvals, and lifecycle decisions.

**Open this area:** In the CORTEX menu, select **Assurance & governance → AI use cases**.

Record accountable owners, configuration identity, separate dataset purposes, and reviewed lifecycle decisions.

**Who uses this:** Analyst, Reviewer, Administrator.\
**Open in CORTEX:** `/governance/ai`.\
**In-app guide:** `/help?topic=ai-governance`.

**Expected result:** A retained AI proposal and independent decision identify the exact configuration and data scope assessed by the responsible owners.

## Before you start

* Select the intended workspace and obtain the explicit AI capability. Editing and review need Manager workspace authority; ordinary material, requirement, and profile permissions remain necessary.
* Load configured runtimes in the proposal form and apply the intended connection's actual model, configuration, and prompt identity. Supply real supplier constraints and limitations. A hosted configuration fingerprint must not be described as a verified model digest.
* Gather accountable, oversight, and dataset owners; permitted-use evidence; assessment decisions; and actual review dates. Protect the record at handling that covers its complete contents.

## What to do

{% stepper %}
{% step %}

## Save a scoped proposal

Open AI use cases and register a use case. Work through **Purpose and owners**, **Configured runtime**, **Data purposes**, **Risk and transparency**, then **Review and save**.

Required fields are marked and each step shows missing inputs and red or green status as values change. Continue only when the current step is valid.

The prerequisite panel identifies the configured runtime, Ready material, and owners still needed. Resolve people by their exact registered email; the page displays their shared name and never grants access.
{% endstep %}

{% step %}

## Resolve each data purpose

Choose the current requirement and 1–16 ready retained material extraction versions for generation, evaluation, or training.

Resolve exact source revision/hash and historical acquisition decision/hash with ordinary source and authority-case read access. Those decisions confer no new AI purpose.

Record the data owner's permitted-use evidence and quality limitations. Generation permission never implies training permission.
{% endstep %}

{% step %}

## Prepare processing decisions

Save the proposal first if its processing decisions do not yet exist.

On its detail page, choose **Prepare processing** for the relevant purpose. Apply current AI resources to the processing form, complete actual legal and privacy fields, and obtain independent processing review.

Reassess the AI use case to select that exact approved activity. No legal basis is inferred.
{% endstep %}

{% step %}

## Record risk and transparency decisions

For privacy, fairness, foreseeable harm, human oversight, and security, retain an owner, rationale, decision reference, and actual UTC review date.

An explicit non-applicability decision also needs evidence. Record reasoned ATRS applicability or exemption.

Required transparency includes separately reviewed public purpose, oversight, and limitations.
{% endstep %}

{% step %}

## Obtain independent AI review

A separately authorised reviewer who has edited no draft and is not an accountable, oversight, or dataset owner selects an approved profile, records external approval evidence, and enters actual effective, review, and expiry dates.

Unresolved assessments, absent processing decisions, stale datasets, or due reviews prevent approval.
{% endstep %}

{% step %}

## Reassess or stop use

Any amendment creates a new draft and clears approval.

Suspend with a reason for a concern or material change; reinstatement requires reassessment and fresh independent approval. Retirement is final for this record.

Keep rollback and retirement plans current, and create a successor where needed.
{% endstep %}

{% step %}

## Review affected generated origins

Use **Find affected generations** on the use-case detail, selecting all configurations or an exact retained configuration.

Open an origin to inspect its hashes, dataset references, captured limitations, and review history. **Find affected Products** opens ordinary Product search for this exact origin in any retained revision; inspect affected revisions and follow each original's sanitised derivatives.

Product and full source access remain required.

An AI editor records the actual effect and accountable next action against the current lifecycle decision. **Refresh decision and reviews** preserves entered notes after a conflict.

This does not approve a product, recall a release, or prove that a draft was received or saved.
{% endstep %}

{% step %}

## Report and contain a material failure

Use **Report an AI error (new tab)** from the origin, Product draft/history, or News result.

Read captured limitations and select an eligible Security manager; the report retains exact generation and configuration references with the assigned owner.

A Security manager with AI lifecycle approval authority can suspend the complete affected use case and retain mitigation. If incident saving conflicts after the stop, inspect current state, refresh, and retry; suspension remains effective.

Incident resolution does not reinstate AI, approve a Product, or grant dissemination authority. Reassessment requires new evidence and fresh independent approval.
{% endstep %}

{% step %}

## Inspect retained evidence and prepare transparency

History preserves each attributed revision and hash.

An authorised exporter can prepare a JSON transparency draft only for a current unrestricted approval with ATRS required. It contains the reviewed public fields and revision evidence, excludes internal owners/configuration/datasets, and must be reviewed against the required template before any authorised publication.
{% endstep %}
{% endstepper %}

## Check the result

* Are model identity and precision honest and tied to the configured connection?
* Is every intended data purpose separately assessed?
* Do exact datasets and processing resources match?
* Are assessment owners, evidence, and review dates current?
* Is the independent reviewer eligible?
* Does the record's handling cover every retained detail?

## If you get stuck

<details>

<summary>Why can I save but not approve a proposal?</summary>

A draft can await its separate processing decisions. Approval requires complete current assessments, transparency scope, independent reviewer, approved profile, exact accessible datasets, and a current automated-processing decision for every data purpose.

</details>

<details>

<summary>Why has the dataset scope changed?</summary>

A source, requirement, extraction, or publication may have changed or become unavailable. Resolve the actual current scope, reassess the processing decision, and submit a new AI draft. Do not copy a historical approval.

</details>

<details>

<summary>Why is legacy custody unassessed?</summary>

Older material may lack a retained acquisition decision. Its history stays readable, but new AI approval/use needs exact source and authority provenance.

Ask the owner to arrange appropriately authorised material through ordinary acquisition and reassess the manifest; never substitute a newer source version or invent a past approval.

</details>

<details>

<summary>Does a saved training manifest start model training?</summary>

No. It records proposed scope and owner evidence only. It neither starts training nor permits another data purpose.

</details>

<details>

<summary>Why is a public transparency draft unavailable?</summary>

Check export permission, current approval and dates, ATRS applicability, and record handling. Any classification, compartment, or caveat blocks this public projection; review through the information owner.

</details>

## Responsibility and limits

* Read, edit, approve, use, and transparency export are separate explicit capabilities. Workspace roles constrain existing grants; they do not create them.
* Report drafts and News triage require matching current Generation approval and an exact independently reviewed evaluation result, and retain immutable origins. Open Evaluation suites, runs, and independent reviews on the use-case page; after suspension, new run evidence must postdate the stop. News uses an explicitly acquired Ready batch, never refreshed live input. Changing runtime or data requires reassessment; applying a runtime clears prior processing selections.
* A draft still needs exact runtime identity, at least one current requirement and Ready material scope, all assessment owners and review dates, and the change, rollback, and retirement plans. Separate processing approvals and resolved risk decisions are needed for approval, not for saving the proposal. A failed validation or conflict preserves the entered draft. Compare the current record before reloading. An uncertain registration can be retried with the same values on the same page.
* Access loss clears sensitive page content. Suspension, retirement, and later amendments preserve earlier records; they neither erase data nor retrospectively authorise outputs.
* Transparency export does not declassify content, publish externally, or provide a complete official ATRS submission. Restricted cases need a separately reviewed public record through the information owner.

## Reference and scope

F24 responsible AI lifecycle. Organisational approval, legal applicability, and actual risk evidence remain owner decisions; this register does not establish model accuracy or collection powers.

## Related workflows

* [Evaluate AI and restore suspended use](broken://pages/391a874ae052db4fcb4ee584bd7dc26eead47228)
* [Record and manage a defensive security incident](broken://pages/686a1f32f9bd42ca2b59d170632ad3d57be6a73e)
* [Review a model-assisted first draft from CSV](file:///7397340/product/ai-drafts.md)
* [Record processing purposes and privacy applicability](broken://pages/d290389040afc56efcecf55b7fc2e72ff1dc1dee)
* [Preserve an exact revision and manage holds](broken://pages/0185ca5a2331760fb4c59665b8dde7f4d80e0fc6)
* [Maintain a system control and evidence baseline](broken://pages/699956df97c18fc4ddd8894884fea67a7b6e90ce)
* [Record UK processing paths and approved uses](broken://pages/d1a5ce8a791f7e21103f6f699e97b63ddcffb253)
* [Find evidence and select exact retained passages](file:///7397340/analyse/memory.md)
* [Manage accounts, grants and workspace membership](broken://pages/99c8701bc497eefb32769b668198b1f9f5fc6a93)