{ "specVersion": "2.0.0", "specDate": "2026-08-10", "changelog": [ { "version": "1.0", "date": "2025-08-29", "label": "Historical conceptual publication", "summary": "Original CSM publication. Four governance domains and sixteen original components.", "added": [ "Four governance domains: Enterprise, Project, Code, UX", "Sixteen original components (four per domain)", "Cross-domain handoff visibility concept", "Implementation guidance (assessment, pilot, scale)", "Proportionality concept" ], "unchanged": [] }, { "version": "2.0.0", "date": "2026-08-10", "label": "Current specification", "summary": "Formalizes CSM into a deterministic governance operating model with machine-readable contracts.", "added": [ "Two-axis operating architecture (Domains x Execution Functions)", "Governance Contract schema for every component", "Objective rules vs human judgment points", "Determinism contract", "Explicit state model (requirement, domain, system)", "Evidence schema with versioning", "Decision record schema", "Exception contract with expiration", "Formal handoff contracts", "Reassessment engine with deterministic triggers", "Component dependency graph", "4x6 operational mapping", "Governance depth / proportionality profiles", "Semantic versioning (spec, policy, assessment)", "Machine-readable specification design", "Informative NIST/ISO crosswalk" ], "unchanged": [ "Four governance domains: Enterprise, Project, Code, UX", "Sixteen original components and their names", "Original provenance and publication reference", "Proportionality principle", "Handoff visibility as core value" ] } ], "domains": [ { "id": "ENT", "displayName": "CSM-Enterprise", "shortName": "Enterprise", "tagline": "Establish the decision context before individual projects improvise it.", "centralQuestion": "Who has authority, who owns the outcome and risk, and what organizational boundaries apply?", "componentIds": [ "ENT-POLICY", "ENT-RISK", "ENT-DATA", "ENT-MANDATE" ] }, { "id": "PRJ", "displayName": "CSM-Project", "shortName": "Project", "tagline": "Make scaling an explicit governance decision.", "centralQuestion": "What evidence should justify continuing, changing, scaling or stopping an AI initiative?", "componentIds": [ "PRJ-BUSINESS", "PRJ-TESTING", "PRJ-SCALE", "PRJ-PLAYBOOK" ] }, { "id": "CODE", "displayName": "CSM-Code", "shortName": "Code", "tagline": "AI-generated code is still organizationally accountable code.", "centralQuestion": "How should software engineering governance change when AI contributes to implementation?", "componentIds": [ "CODE-STANDARDS", "CODE-SECURITY", "CODE-HUMAN", "CODE-TRACE" ] }, { "id": "UX", "displayName": "CSM-UX", "shortName": "UX", "tagline": "Governance reaches the people relying on the system.", "centralQuestion": "What do humans need to understand, supervise, challenge and appropriately use AI-supported outcomes?", "componentIds": [ "UX-IMPACT", "UX-EXPLAIN", "UX-CAPABILITY", "UX-ADOPTION" ] } ], "components": [ { "id": "ENT-POLICY", "domain": "ENT", "name": "Policy Framework", "description": "AI ethics standards and organizational policies that account for system behavior which may differ from conventional software." }, { "id": "ENT-RISK", "domain": "ENT", "name": "Risk Assessment", "description": "Risk evaluation that accounts for system behavior which may change over time, including model updates, provider changes, or data drift." }, { "id": "ENT-DATA", "domain": "ENT", "name": "Data Stewardship", "description": "Governance for datasets that influence ongoing AI behavior, including training data, retrieval sources and operational data." }, { "id": "ENT-MANDATE", "domain": "ENT", "name": "Strategic Mandate", "description": "Organizational authority and strategic alignment that defines why AI systems are being deployed and what boundaries apply." }, { "id": "PRJ-BUSINESS", "domain": "PRJ", "name": "Business Case Definition", "description": "What problem or value is being tested. The business case defines the hypothesis an AI initiative is evaluating." }, { "id": "PRJ-TESTING", "domain": "PRJ", "name": "Controlled Testing", "description": "What must be learned before scale. Testing designed to answer specific governance and performance questions." }, { "id": "PRJ-SCALE", "domain": "PRJ", "name": "Scale Decision Framework", "description": "What evidence justifies broader commitment. Defined criteria for deciding whether to proceed, change or stop." }, { "id": "PRJ-PLAYBOOK", "domain": "PRJ", "name": "Playbook Documentation", "description": "What decisions and learning need to survive beyond the pilot team. Documentation that transfers knowledge to operational owners." }, { "id": "CODE-STANDARDS", "domain": "CODE", "name": "Development Standards", "description": "Engineering standards that account for AI-assisted development, including review requirements and quality expectations." }, { "id": "CODE-SECURITY", "domain": "CODE", "name": "Security Protocols", "description": "Security practices that address AI-generated code, including vulnerability scanning and dependency verification." }, { "id": "CODE-HUMAN", "domain": "CODE", "name": "Human Oversight", "description": "Human review of AI-assisted contributions proportionate to risk and consequence." }, { "id": "CODE-TRACE", "domain": "CODE", "name": "Traceability Logging", "description": "Records that provide appropriate provenance for AI-assisted changes where risk warrants it." }, { "id": "UX-IMPACT", "domain": "UX", "name": "Impact Analysis", "description": "Assessment of how AI-supported outcomes affect individuals, groups and workflows." }, { "id": "UX-EXPLAIN", "domain": "UX", "name": "Explainability Design", "description": "Design choices that help users understand system behavior, limitations and appropriate reliance." }, { "id": "UX-CAPABILITY", "domain": "UX", "name": "Capability Development", "description": "Training and skill development that enables users to effectively supervise and interact with AI systems." }, { "id": "UX-ADOPTION", "domain": "UX", "name": "Adoption Measurement", "description": "Monitoring of how AI systems are actually used, including feedback and complaints." } ], "executionFunctions": [ { "id": "EF1-PURPOSE", "name": "Purpose, Scope & Accountability", "question": "What is the system for, who is accountable, and what boundaries apply?", "description": "Establishes the intended purpose, scope, ownership and accountability boundaries for the AI system." }, { "id": "EF2-MAPPING", "name": "System, Data & Dependency Mapping", "question": "What components, data and dependencies comprise the system?", "description": "Maps the system architecture, data sources, model providers, tools and integrations." }, { "id": "EF3-RISK", "name": "Risk, Evaluation & Monitoring", "question": "What risks exist and how are they evaluated and monitored?", "description": "Identifies, evaluates and continuously monitors risks including drift, performance and security." }, { "id": "EF4-DELIVERY", "name": "Controlled Delivery & Change", "question": "How are changes controlled and delivered?", "description": "Governs the delivery pipeline, change management, testing gates and deployment controls." }, { "id": "EF5-OVERSIGHT", "name": "Human Oversight, Feedback & Learning", "question": "How do humans oversee, provide feedback and learn from the system?", "description": "Ensures human oversight mechanisms, feedback channels and organizational learning loops." }, { "id": "EF6-COMPLIANCE", "name": "Compliance, Evidence & Assurance", "question": "What evidence demonstrates governance and what compliance obligations apply?", "description": "Collects, organizes and produces evidence for governance assurance and regulatory obligations." } ], "governanceContracts": [ { "id": "ENT-POLICY", "version": "2.0.0", "domain": "ENT", "name": "Policy Framework", "purpose": "Ensure AI ethics standards and organizational policies account for system behavior that may differ from conventional software.", "coreQuestion": "Are there organizational AI policies that apply to this system, and do they account for adaptive or probabilistic behavior?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI-enabled systems." } ], "requiredInputs": [ { "id": "aiPolicyDocumented", "label": "AI policy documented", "type": "boolean", "required": true, "description": "Whether organizational AI policies exist and are documented." }, { "id": "policyAddressesAdaptiveBehavior", "label": "Policy addresses adaptive behavior", "type": "boolean", "required": true, "description": "Whether policies account for AI behavior that may change over time." }, { "id": "accountableOwner", "label": "Accountable owner", "type": "string", "required": true, "description": "Named individual accountable for the system." } ], "optionalInputs": [ { "id": "policyVersion", "label": "Policy version", "type": "string", "required": false, "description": "Version of the organizational policy applied." }, { "id": "policyReviewDate", "label": "Policy review date", "type": "date", "required": false, "description": "Date of last policy review." } ], "objectiveRules": [ { "id": "ENT-POLICY-R1", "description": "AI policy must be documented.", "condition": "aiPolicyDocumented === true", "passState": "SATISFIED", "failState": "BLOCKED", "blocking": true }, { "id": "ENT-POLICY-R2", "description": "Policy must address adaptive/probabilistic behavior.", "condition": "policyAddressesAdaptiveBehavior === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false }, { "id": "ENT-POLICY-R3", "description": "Accountable owner must be assigned.", "condition": "accountableOwner exists and is non-empty", "passState": "SATISFIED", "failState": "BLOCKED", "blocking": true } ], "humanJudgmentPoints": [ { "id": "ENT-POLICY-HJ1", "question": "Is the use ethically acceptable within organizational values?", "description": "Ethical acceptability cannot be computed from facts alone.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": false }, { "id": "ENT-POLICY-HJ2", "question": "Does a specific legal obligation apply to this use?", "description": "Legal applicability requires interpretation of regulations against system context.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": true } ], "requiredDecisions": [ { "id": "ENT-POLICY-D1", "question": "Is the use ethically acceptable?", "decisionType": "human_approval", "blocking": true }, { "id": "ENT-POLICY-D2", "question": "Does a specific legal obligation apply?", "decisionType": "legal_review", "blocking": true } ], "requiredEvidence": [ { "id": "ENT-POLICY-E1", "label": "AI policy document", "description": "Documented organizational AI policy.", "evidenceType": "document", "required": true, "expiresByDefault": false }, { "id": "ENT-POLICY-E2", "label": "Accountable owner assignment", "description": "Record of accountable owner assignment.", "evidenceType": "record", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "AI Governance Lead", "Policy Owner" ], "accountableRole": "AI Governance Lead", "outputs": [ "Policy applicability determination", "Accountable owner assignment", "Ethical acceptability decision", "Legal applicability determination" ], "blockingConditions": [ "No AI policy documented", "No accountable owner assigned" ], "allowedExceptions": { "allowedReasons": [ "Policy under development with interim controls", "Legacy system with equivalent controls" ], "requiresCompensatingControls": true, "maxDurationDays": 90, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "AI Governance Lead", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "PRJ", "targetComponent": "PRJ-BUSINESS", "requiredOutputs": [ "policyBoundaries", "accountableOwner" ] } ], "handoffOutputs": [ "policyBoundaries", "accountableOwner", "ethicalAcceptabilityDecision" ], "reassessmentTriggers": [ "TRIGGER-USE-CHANGE", "TRIGGER-JURISDICTION-CHANGE", "TRIGGER-POLICY-CHANGE", "TRIGGER-OWNER-CHANGE" ], "executionFunctionMappings": [ "EF1-PURPOSE", "EF6-COMPLIANCE" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [] }, { "id": "ENT-RISK", "version": "2.0.0", "domain": "ENT", "name": "Risk Assessment", "purpose": "Evaluate risks that account for AI system behavior which may change over time, including model updates, provider changes, or data drift.", "coreQuestion": "Has a risk assessment been performed that accounts for adaptive AI behavior and temporal change?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI-enabled systems." } ], "requiredInputs": [ { "id": "riskAssessmentCompleted", "label": "Risk assessment completed", "type": "boolean", "required": true, "description": "Whether a risk assessment has been performed." }, { "id": "riskAssessmentAddressesDrift", "label": "Assessment addresses drift", "type": "boolean", "required": true, "description": "Whether the assessment considers model/behavioral drift." }, { "id": "riskAssessmentDate", "label": "Risk assessment date", "type": "date", "required": true, "description": "Date the risk assessment was performed." } ], "optionalInputs": [ { "id": "riskRegisterEntry", "label": "Risk register entry", "type": "string", "required": false, "description": "Identifier in organizational risk register." } ], "objectiveRules": [ { "id": "ENT-RISK-R1", "description": "Risk assessment must be completed.", "condition": "riskAssessmentCompleted === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "ENT-RISK-R2", "description": "Assessment must address drift/temporal change.", "condition": "riskAssessmentAddressesDrift === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [ { "id": "ENT-RISK-HJ1", "question": "Is the residual risk acceptable?", "description": "Residual risk acceptance requires human judgment about risk tolerance.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": true } ], "requiredDecisions": [ { "id": "ENT-RISK-D1", "question": "Is residual risk acceptable?", "decisionType": "risk_acceptance", "blocking": true } ], "requiredEvidence": [ { "id": "ENT-RISK-E1", "label": "Risk assessment document", "description": "Documented risk assessment.", "evidenceType": "document", "required": true, "expiresByDefault": true, "defaultExpiryDays": 365 } ], "responsibleRoles": [ "Risk Manager", "AI Governance Lead" ], "accountableRole": "AI Governance Lead", "outputs": [ "Risk assessment", "Residual risk acceptance decision", "Risk register entry" ], "blockingConditions": [ "No risk assessment completed for an INTENSIVE-profile system" ], "allowedExceptions": { "allowedReasons": [ "Risk assessment in progress with interim risk controls" ], "requiresCompensatingControls": true, "maxDurationDays": 60, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "AI Governance Lead", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "PRJ", "targetComponent": "PRJ-TESTING", "requiredOutputs": [ "riskContext", "identifiedRisks" ] } ], "handoffOutputs": [ "riskContext", "identifiedRisks" ], "reassessmentTriggers": [ "TRIGGER-USE-CHANGE", "TRIGGER-SECURITY-INCIDENT", "TRIGGER-DRIFT", "TRIGGER-USER-HARM", "TRIGGER-POLICY-CHANGE" ], "executionFunctionMappings": [ "EF3-RISK", "EF1-PURPOSE" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [] }, { "id": "ENT-DATA", "version": "2.0.0", "domain": "ENT", "name": "Data Stewardship", "purpose": "Govern datasets that influence ongoing AI behavior, including training data, retrieval sources and operational data.", "coreQuestion": "Are data sources that influence AI behavior identified, owned and governed?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI-enabled systems that use or produce data." } ], "requiredInputs": [ { "id": "dataSourcesIdentified", "label": "Data sources identified", "type": "boolean", "required": true, "description": "Whether all data sources are identified and documented." }, { "id": "dataOwnersAssigned", "label": "Data owners assigned", "type": "boolean", "required": true, "description": "Whether each data source has an assigned owner/steward." }, { "id": "dataSensitivityClassified", "label": "Data sensitivity classified", "type": "boolean", "required": true, "description": "Whether data sensitivity has been classified." } ], "optionalInputs": [ { "id": "dataLineageDocumented", "label": "Data lineage documented", "type": "boolean", "required": false, "description": "Whether data lineage is documented." } ], "objectiveRules": [ { "id": "ENT-DATA-R1", "description": "Data sources must be identified.", "condition": "dataSourcesIdentified === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "ENT-DATA-R2", "description": "Each data source must have an assigned owner.", "condition": "dataOwnersAssigned === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false }, { "id": "ENT-DATA-R3", "description": "Data sensitivity must be classified.", "condition": "dataSensitivityClassified === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "ENT-DATA-E1", "label": "Data source inventory", "description": "Inventory of data sources with owners and classifications.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Data Steward", "Data Governance Lead" ], "accountableRole": "Data Governance Lead", "outputs": [ "Data source inventory", "Data ownership assignments", "Data sensitivity classifications" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Data inventory in progress with critical sources identified" ], "requiresCompensatingControls": true, "maxDurationDays": 90, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Data Governance Lead", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "PRJ", "requiredOutputs": [ "dataOwnership", "dataSensitivityClassifications" ] } ], "handoffOutputs": [ "dataOwnership", "dataSensitivityClassifications" ], "reassessmentTriggers": [ "TRIGGER-DATA-CHANGE", "TRIGGER-PROVIDER-CHANGE", "TRIGGER-POLICY-CHANGE" ], "executionFunctionMappings": [ "EF2-MAPPING", "EF6-COMPLIANCE" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [] }, { "id": "ENT-MANDATE", "version": "2.0.0", "domain": "ENT", "name": "Strategic Mandate", "purpose": "Define organizational authority and strategic alignment that establishes why AI systems are deployed and what boundaries apply.", "coreQuestion": "Is there a documented strategic mandate with a named accountable owner and defined boundaries?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI-enabled systems." } ], "requiredInputs": [ { "id": "strategicMandateDocumented", "label": "Strategic mandate documented", "type": "boolean", "required": true, "description": "Whether a strategic mandate exists." }, { "id": "accountableOwner", "label": "Accountable owner", "type": "string", "required": true, "description": "Named individual accountable for the system." }, { "id": "mandateBoundaries", "label": "Mandate boundaries", "type": "string", "required": true, "description": "Defined boundaries on what the system may and may not do." } ], "optionalInputs": [], "objectiveRules": [ { "id": "ENT-MANDATE-R1", "description": "Strategic mandate must be documented.", "condition": "strategicMandateDocumented === true", "passState": "SATISFIED", "failState": "BLOCKED", "blocking": true }, { "id": "ENT-MANDATE-R2", "description": "Accountable owner must be assigned.", "condition": "accountableOwner exists and is non-empty", "passState": "SATISFIED", "failState": "BLOCKED", "blocking": true }, { "id": "ENT-MANDATE-R3", "description": "Mandate boundaries must be defined.", "condition": "mandateBoundaries exists and is non-empty", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "ENT-MANDATE-E1", "label": "Strategic mandate document", "description": "Documented strategic mandate with owner and boundaries.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Executive Sponsor", "AI Governance Lead" ], "accountableRole": "Executive Sponsor", "outputs": [ "Strategic mandate", "Accountable owner assignment", "Boundary definitions" ], "blockingConditions": [ "No strategic mandate documented", "No accountable owner assigned" ], "allowedExceptions": { "allowedReasons": [ "Mandate under executive review with interim authorization" ], "requiresCompensatingControls": true, "maxDurationDays": 30, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Executive Sponsor", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "PRJ", "targetComponent": "PRJ-BUSINESS", "requiredOutputs": [ "intendedPurpose", "accountableOwner", "strategicMandate" ] } ], "handoffOutputs": [ "intendedPurpose", "accountableOwner", "strategicMandate" ], "reassessmentTriggers": [ "TRIGGER-OWNER-CHANGE", "TRIGGER-USE-CHANGE", "TRIGGER-POLICY-CHANGE" ], "executionFunctionMappings": [ "EF1-PURPOSE" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [] }, { "id": "PRJ-BUSINESS", "version": "2.0.0", "domain": "PRJ", "name": "Business Case Definition", "purpose": "Define what problem or value is being tested. The business case defines the hypothesis an AI initiative is evaluating.", "coreQuestion": "Is there a documented business case with success criteria and risk-benefit evaluation?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI initiatives." } ], "requiredInputs": [ { "id": "businessCaseDocumented", "label": "Business case documented", "type": "boolean", "required": true, "description": "Whether a business case exists." }, { "id": "successCriteriaDefined", "label": "Success criteria defined", "type": "boolean", "required": true, "description": "Whether measurable success criteria exist." }, { "id": "riskBenefitEvaluated", "label": "Risk-benefit evaluated", "type": "boolean", "required": true, "description": "Whether risk-benefit has been evaluated." } ], "optionalInputs": [ { "id": "hypothesisStatement", "label": "Hypothesis statement", "type": "string", "required": false, "description": "Explicit hypothesis being tested." } ], "objectiveRules": [ { "id": "PRJ-BUSINESS-R1", "description": "Business case must be documented.", "condition": "businessCaseDocumented === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "PRJ-BUSINESS-R2", "description": "Success criteria must be defined.", "condition": "successCriteriaDefined === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [ { "id": "PRJ-BUSINESS-HJ1", "question": "Does the business benefit justify the risk?", "description": "Risk-benefit justification requires human judgment about value and tolerance.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": true } ], "requiredDecisions": [ { "id": "PRJ-BUSINESS-D1", "question": "Does the business benefit justify the risk?", "decisionType": "risk_acceptance", "blocking": true } ], "requiredEvidence": [ { "id": "PRJ-BUSINESS-E1", "label": "Business case document", "description": "Documented business case with success criteria.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Product Manager", "Project Lead" ], "accountableRole": "Product Manager", "outputs": [ "Business case", "Success criteria", "Risk-benefit decision" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Business case under development with interim scope" ], "requiresCompensatingControls": false, "maxDurationDays": 30, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Product Manager", "requiresRationale": true, "requiresEvidence": false, "requiresCompensatingControls": false }, "handoffTargets": [ { "targetDomain": "CODE", "targetComponent": "CODE-STANDARDS", "requiredOutputs": [ "approvedUseCase", "businessSuccessCriteria", "applicableConstraints" ] } ], "handoffOutputs": [ "approvedUseCase", "businessSuccessCriteria", "applicableConstraints" ], "reassessmentTriggers": [ "TRIGGER-USE-CHANGE", "TRIGGER-SCOPE-EXPANSION" ], "executionFunctionMappings": [ "EF1-PURPOSE", "EF3-RISK" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "ENT-MANDATE", "ENT-POLICY" ] }, { "id": "PRJ-TESTING", "version": "2.0.0", "domain": "PRJ", "name": "Controlled Testing", "purpose": "Define what must be learned before scale. Testing designed to answer specific governance and performance questions.", "coreQuestion": "Is there a controlled testing plan that addresses identified risks and success criteria?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI initiatives." } ], "requiredInputs": [ { "id": "testingPlanDocumented", "label": "Testing plan documented", "type": "boolean", "required": true, "description": "Whether a testing plan exists." }, { "id": "testingAddressesRisks", "label": "Testing addresses risks", "type": "boolean", "required": true, "description": "Whether testing addresses identified risks." }, { "id": "testingResultsRecorded", "label": "Testing results recorded", "type": "boolean", "required": true, "description": "Whether testing results are recorded." } ], "optionalInputs": [ { "id": "testingEnvironment", "label": "Testing environment", "type": "string", "required": false, "description": "Description of testing environment." } ], "objectiveRules": [ { "id": "PRJ-TESTING-R1", "description": "Testing plan must be documented.", "condition": "testingPlanDocumented === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "PRJ-TESTING-R2", "description": "Testing must address identified risks.", "condition": "testingAddressesRisks === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false }, { "id": "PRJ-TESTING-R3", "description": "Testing results must be recorded.", "condition": "testingResultsRecorded === true", "passState": "SATISFIED", "failState": "IN_PROGRESS", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "PRJ-TESTING-E1", "label": "Testing plan", "description": "Documented testing plan with risk coverage.", "evidenceType": "document", "required": true, "expiresByDefault": false }, { "id": "PRJ-TESTING-E2", "label": "Testing results", "description": "Recorded testing results.", "evidenceType": "document", "required": true, "expiresByDefault": true, "defaultExpiryDays": 365 } ], "responsibleRoles": [ "QA Lead", "Project Lead" ], "accountableRole": "Project Lead", "outputs": [ "Testing plan", "Testing results", "Risk coverage analysis" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Testing in progress with interim results" ], "requiresCompensatingControls": true, "maxDurationDays": 60, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Project Lead", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "PRJ", "targetComponent": "PRJ-SCALE", "requiredOutputs": [ "evaluationCriteria", "testingResults" ] } ], "handoffOutputs": [ "evaluationCriteria", "testingResults" ], "reassessmentTriggers": [ "TRIGGER-MODEL-CHANGE", "TRIGGER-CONFIG-CHANGE", "TRIGGER-DATA-CHANGE", "TRIGGER-EVAL-FAILURE", "TRIGGER-DRIFT" ], "executionFunctionMappings": [ "EF3-RISK", "EF4-DELIVERY" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "ENT-RISK" ] }, { "id": "PRJ-SCALE", "version": "2.0.0", "domain": "PRJ", "name": "Scale Decision Framework", "purpose": "Define what evidence justifies broader commitment. Defined criteria for deciding whether to proceed, change or stop.", "coreQuestion": "Is there a documented scale decision with explicit criteria and evidence?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI initiatives approaching scale decisions." } ], "requiredInputs": [ { "id": "scaleCriteriaDocumented", "label": "Scale criteria documented", "type": "boolean", "required": true, "description": "Whether scale decision criteria are documented." }, { "id": "scaleDecisionMade", "label": "Scale decision made", "type": "boolean", "required": true, "description": "Whether a scale decision has been made." }, { "id": "scaleDecisionEvidence", "label": "Scale decision evidence", "type": "string", "required": true, "description": "Evidence supporting the scale decision." } ], "optionalInputs": [], "objectiveRules": [ { "id": "PRJ-SCALE-R1", "description": "Scale criteria must be documented.", "condition": "scaleCriteriaDocumented === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "PRJ-SCALE-R2", "description": "Scale decision must be made with evidence.", "condition": "scaleDecisionMade === true AND scaleDecisionEvidence exists", "passState": "SATISFIED", "failState": "IN_PROGRESS", "blocking": false } ], "humanJudgmentPoints": [ { "id": "PRJ-SCALE-HJ1", "question": "Should the system proceed to scale?", "description": "Scale decision requires human judgment about whether evidence is sufficient.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": true } ], "requiredDecisions": [ { "id": "PRJ-SCALE-D1", "question": "Should the system proceed to scale?", "decisionType": "human_approval", "blocking": true } ], "requiredEvidence": [ { "id": "PRJ-SCALE-E1", "label": "Scale decision document", "description": "Documented scale decision with criteria and evidence.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Project Lead", "Executive Sponsor" ], "accountableRole": "Executive Sponsor", "outputs": [ "Scale decision", "Scale criteria", "Decision rationale" ], "blockingConditions": [ "Scale decision attempted before testing is complete (dependency on PRJ-TESTING)" ], "allowedExceptions": { "allowedReasons": [ "Limited scale with enhanced monitoring" ], "requiresCompensatingControls": true, "maxDurationDays": 90, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Executive Sponsor", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "PRJ", "targetComponent": "PRJ-PLAYBOOK", "requiredOutputs": [ "scaleDecision", "releaseExpectations" ] } ], "handoffOutputs": [ "scaleDecision", "releaseExpectations", "scaleDecisionCriteria" ], "reassessmentTriggers": [ "TRIGGER-SCOPE-EXPANSION", "TRIGGER-EVAL-FAILURE", "TRIGGER-DRIFT" ], "executionFunctionMappings": [ "EF4-DELIVERY" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "PRJ-TESTING", "PRJ-BUSINESS" ] }, { "id": "PRJ-PLAYBOOK", "version": "2.0.0", "domain": "PRJ", "name": "Playbook Documentation", "purpose": "Define what decisions and learning need to survive beyond the pilot team. Documentation that transfers knowledge to operational owners.", "coreQuestion": "Is there a playbook that transfers pilot decisions, learning and operational requirements to ongoing owners?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI initiatives transitioning to operations." } ], "requiredInputs": [ { "id": "playbookDocumented", "label": "Playbook documented", "type": "boolean", "required": true, "description": "Whether a playbook exists." }, { "id": "playbookIncludesDecisions", "label": "Playbook includes decisions", "type": "boolean", "required": true, "description": "Whether the playbook documents key decisions." }, { "id": "operationalOwnersIdentified", "label": "Operational owners identified", "type": "boolean", "required": true, "description": "Whether operational owners are identified." } ], "optionalInputs": [], "objectiveRules": [ { "id": "PRJ-PLAYBOOK-R1", "description": "Playbook must be documented.", "condition": "playbookDocumented === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "PRJ-PLAYBOOK-R2", "description": "Playbook must include key decisions.", "condition": "playbookIncludesDecisions === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false }, { "id": "PRJ-PLAYBOOK-R3", "description": "Operational owners must be identified.", "condition": "operationalOwnersIdentified === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "PRJ-PLAYBOOK-E1", "label": "Playbook document", "description": "Documented playbook with decisions and operational requirements.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Project Lead", "Operations Lead" ], "accountableRole": "Project Lead", "outputs": [ "Playbook", "Operational owner assignments", "Decision log" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Playbook in development with interim handover notes" ], "requiresCompensatingControls": false, "maxDurationDays": 30, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Project Lead", "requiresRationale": true, "requiresEvidence": false, "requiresCompensatingControls": false }, "handoffTargets": [ { "targetDomain": "ENT", "requiredOutputs": [ "lessonsRequiringEnterpriseChange", "discoveredDependencies" ] } ], "handoffOutputs": [ "lessonsRequiringEnterpriseChange", "discoveredDependencies", "operationalRequirements" ], "reassessmentTriggers": [ "TRIGGER-DECOMMISSION", "TRIGGER-POLICY-CHANGE" ], "executionFunctionMappings": [ "EF5-OVERSIGHT", "EF6-COMPLIANCE" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [] }, { "id": "CODE-STANDARDS", "version": "2.0.0", "domain": "CODE", "name": "Development Standards", "purpose": "Engineering standards that account for AI-assisted development, including review requirements and quality expectations.", "coreQuestion": "Are there development standards that address AI-assisted code generation, review and quality?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all systems where AI assists code generation or modification." } ], "requiredInputs": [ { "id": "aiAssistedDevStandardsDocumented", "label": "AI-assisted dev standards documented", "type": "boolean", "required": true, "description": "Whether standards for AI-assisted development exist." }, { "id": "reviewRequirementsDefined", "label": "Review requirements defined", "type": "boolean", "required": true, "description": "Whether review requirements for AI-generated code are defined." } ], "optionalInputs": [ { "id": "allowedTools", "label": "Allowed AI tools", "type": "array", "required": false, "description": "List of approved AI development tools." } ], "objectiveRules": [ { "id": "CODE-STANDARDS-R1", "description": "AI-assisted development standards must be documented.", "condition": "aiAssistedDevStandardsDocumented === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "CODE-STANDARDS-R2", "description": "Review requirements for AI-generated code must be defined.", "condition": "reviewRequirementsDefined === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "CODE-STANDARDS-E1", "label": "Development standards document", "description": "Documented standards for AI-assisted development.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Engineering Lead", "Tech Lead" ], "accountableRole": "Engineering Lead", "outputs": [ "Development standards", "Review requirements", "Allowed tools list" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Standards under development with interim review process" ], "requiresCompensatingControls": true, "maxDurationDays": 60, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Engineering Lead", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "CODE", "targetComponent": "CODE-HUMAN", "requiredOutputs": [ "reviewRequirements" ] } ], "handoffOutputs": [ "reviewRequirements", "qualityExpectations" ], "reassessmentTriggers": [ "TRIGGER-TOOL-AUTHORITY-CHANGE", "TRIGGER-POLICY-CHANGE" ], "executionFunctionMappings": [ "EF4-DELIVERY" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "PRJ-BUSINESS" ] }, { "id": "CODE-SECURITY", "version": "2.0.0", "domain": "CODE", "name": "Security Protocols", "purpose": "Security practices that address AI-generated code, including vulnerability scanning and dependency verification.", "coreQuestion": "Are security protocols in place that address AI-generated code vulnerabilities and dependencies?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all systems where AI assists code generation or modification." } ], "requiredInputs": [ { "id": "securityScanningActive", "label": "Security scanning active", "type": "boolean", "required": true, "description": "Whether automated security scanning is active." }, { "id": "dependencyVerificationProcess", "label": "Dependency verification process", "type": "boolean", "required": true, "description": "Whether dependency verification is performed." }, { "id": "securityReviewArtifact", "label": "Security review artifact", "type": "boolean", "required": true, "description": "Whether a security review artifact exists." } ], "optionalInputs": [], "objectiveRules": [ { "id": "CODE-SECURITY-R1", "description": "Security scanning must be active.", "condition": "securityScanningActive === true", "passState": "SATISFIED", "failState": "BLOCKED", "blocking": true }, { "id": "CODE-SECURITY-R2", "description": "Dependency verification must be performed.", "condition": "dependencyVerificationProcess === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false }, { "id": "CODE-SECURITY-R3", "description": "Security review artifact must exist.", "condition": "securityReviewArtifact === true", "passState": "SATISFIED", "failState": "BLOCKED", "blocking": true } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "CODE-SECURITY-E1", "label": "Security scan results", "description": "Results of automated security scans.", "evidenceType": "document", "required": true, "expiresByDefault": true, "defaultExpiryDays": 90 }, { "id": "CODE-SECURITY-E2", "label": "Security review document", "description": "Documented security review.", "evidenceType": "document", "required": true, "expiresByDefault": true, "defaultExpiryDays": 180 } ], "responsibleRoles": [ "Security Engineer", "Engineering Lead" ], "accountableRole": "Engineering Lead", "outputs": [ "Security scan results", "Security review", "Dependency verification results" ], "blockingConditions": [ "No security scanning active", "No security review artifact for INTENSIVE-profile systems" ], "allowedExceptions": { "allowedReasons": [ "Scanning being configured with interim manual review" ], "requiresCompensatingControls": true, "maxDurationDays": 30, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Engineering Lead", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "UX", "requiredOutputs": [ "securityTestResults", "knownLimitations" ] } ], "handoffOutputs": [ "securityTestResults", "knownLimitations" ], "reassessmentTriggers": [ "TRIGGER-SECURITY-INCIDENT", "TRIGGER-NEW-INTEGRATION", "TRIGGER-DEPENDENCY-CHANGE", "TRIGGER-MODEL-CHANGE" ], "executionFunctionMappings": [ "EF3-RISK", "EF4-DELIVERY" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "CODE-STANDARDS" ] }, { "id": "CODE-HUMAN", "version": "2.0.0", "domain": "CODE", "name": "Human Oversight", "purpose": "Human review of AI-assisted contributions proportionate to risk and consequence.", "coreQuestion": "Is there a defined human review process for AI-assisted contributions proportionate to risk?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all systems where AI assists code generation or modification." } ], "requiredInputs": [ { "id": "humanReviewProcessDefined", "label": "Human review process defined", "type": "boolean", "required": true, "description": "Whether a human review process for AI-assisted code is defined." }, { "id": "reviewProportionateToRisk", "label": "Review proportionate to risk", "type": "boolean", "required": true, "description": "Whether review depth scales with risk." } ], "optionalInputs": [], "objectiveRules": [ { "id": "CODE-HUMAN-R1", "description": "Human review process must be defined.", "condition": "humanReviewProcessDefined === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "CODE-HUMAN-R2", "description": "Review must be proportionate to risk.", "condition": "reviewProportionateToRisk === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [ { "id": "CODE-HUMAN-HJ1", "question": "Is the human oversight proportionate for this system risk profile?", "description": "Proportionality assessment requires judgment about risk and oversight adequacy.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": false } ], "requiredDecisions": [ { "id": "CODE-HUMAN-D1", "question": "Is human oversight proportionate?", "decisionType": "human_approval", "blocking": false } ], "requiredEvidence": [ { "id": "CODE-HUMAN-E1", "label": "Review process document", "description": "Documented human review process.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Engineering Lead", "Senior Developer" ], "accountableRole": "Engineering Lead", "outputs": [ "Human review process", "Review proportionality assessment" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Process under definition with interim pairwise review" ], "requiresCompensatingControls": true, "maxDurationDays": 30, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Engineering Lead", "requiresRationale": true, "requiresEvidence": false, "requiresCompensatingControls": true }, "handoffTargets": [], "handoffOutputs": [ "oversightProcessSummary" ], "reassessmentTriggers": [ "TRIGGER-TOOL-AUTHORITY-CHANGE", "TRIGGER-SCOPE-EXPANSION" ], "executionFunctionMappings": [ "EF5-OVERSIGHT" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "CODE-STANDARDS" ] }, { "id": "CODE-TRACE", "version": "2.0.0", "domain": "CODE", "name": "Traceability Logging", "purpose": "Records that provide appropriate provenance for AI-assisted changes where risk warrants it.", "coreQuestion": "Is there traceability logging that records AI-assisted changes with appropriate provenance?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all systems where AI assists code generation or modification." } ], "requiredInputs": [ { "id": "traceabilityLoggingActive", "label": "Traceability logging active", "type": "boolean", "required": true, "description": "Whether traceability logging is active." }, { "id": "aiAssistedChangesTracked", "label": "AI-assisted changes tracked", "type": "boolean", "required": true, "description": "Whether AI-assisted changes are tracked in logs." } ], "optionalInputs": [ { "id": "logRetentionDays", "label": "Log retention (days)", "type": "number", "required": false, "description": "Retention period for traceability logs." } ], "objectiveRules": [ { "id": "CODE-TRACE-R1", "description": "Traceability logging must be active.", "condition": "traceabilityLoggingActive === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "CODE-TRACE-R2", "description": "AI-assisted changes must be tracked.", "condition": "aiAssistedChangesTracked === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "CODE-TRACE-E1", "label": "Traceability log configuration", "description": "Configuration showing logging is active and what is tracked.", "evidenceType": "record", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "Engineering Lead", "DevOps Lead" ], "accountableRole": "Engineering Lead", "outputs": [ "Traceability logs", "AI-assisted change records" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Logging being configured with interim manual tracking" ], "requiresCompensatingControls": true, "maxDurationDays": 30, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Engineering Lead", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [], "handoffOutputs": [ "traceabilityRecords" ], "reassessmentTriggers": [ "TRIGGER-TOOL-AUTHORITY-CHANGE", "TRIGGER-POLICY-CHANGE" ], "executionFunctionMappings": [ "EF6-COMPLIANCE", "EF2-MAPPING" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "CODE-STANDARDS" ] }, { "id": "UX-IMPACT", "version": "2.0.0", "domain": "UX", "name": "Impact Analysis", "purpose": "Assessment of how AI-supported outcomes affect individuals, groups and workflows.", "coreQuestion": "Has an impact analysis been performed for affected individuals and groups?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI-enabled systems that produce outputs affecting humans." } ], "requiredInputs": [ { "id": "impactAnalysisCompleted", "label": "Impact analysis completed", "type": "boolean", "required": true, "description": "Whether an impact analysis has been performed." }, { "id": "affectedStakeholdersIdentified", "label": "Affected stakeholders identified", "type": "boolean", "required": true, "description": "Whether affected stakeholders are identified." } ], "optionalInputs": [ { "id": "impactSeverity", "label": "Impact severity", "type": "enum", "required": false, "description": "Assessed severity of impact (low/medium/high)." } ], "objectiveRules": [ { "id": "UX-IMPACT-R1", "description": "Impact analysis must be completed.", "condition": "impactAnalysisCompleted === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "UX-IMPACT-R2", "description": "Affected stakeholders must be identified.", "condition": "affectedStakeholdersIdentified === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "UX-IMPACT-E1", "label": "Impact analysis document", "description": "Documented impact analysis with stakeholder identification.", "evidenceType": "document", "required": true, "expiresByDefault": true, "defaultExpiryDays": 365 } ], "responsibleRoles": [ "UX Researcher", "Product Manager" ], "accountableRole": "Product Manager", "outputs": [ "Impact analysis", "Stakeholder map", "Impact severity assessment" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Impact analysis in progress with preliminary findings" ], "requiresCompensatingControls": true, "maxDurationDays": 60, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Product Manager", "requiresRationale": true, "requiresEvidence": true, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "UX", "targetComponent": "UX-EXPLAIN", "requiredOutputs": [ "impactFindings", "stakeholderNeeds" ] } ], "handoffOutputs": [ "impactFindings", "stakeholderNeeds" ], "reassessmentTriggers": [ "TRIGGER-USE-CHANGE", "TRIGGER-SCOPE-EXPANSION", "TRIGGER-USER-HARM", "TRIGGER-POLICY-CHANGE" ], "executionFunctionMappings": [ "EF3-RISK" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [] }, { "id": "UX-EXPLAIN", "version": "2.0.0", "domain": "UX", "name": "Explainability Design", "purpose": "Design choices that help users understand system behavior, limitations and appropriate reliance.", "coreQuestion": "Does the system provide explanations appropriate for user understanding and appropriate reliance?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI-enabled systems that produce outputs for human users." } ], "requiredInputs": [ { "id": "explainabilityDesigned", "label": "Explainability designed", "type": "boolean", "required": true, "description": "Whether explainability has been designed." }, { "id": "limitationsCommunicated", "label": "Limitations communicated", "type": "boolean", "required": true, "description": "Whether system limitations are communicated to users." } ], "optionalInputs": [], "objectiveRules": [ { "id": "UX-EXPLAIN-R1", "description": "Explainability must be designed.", "condition": "explainabilityDesigned === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "UX-EXPLAIN-R2", "description": "Limitations must be communicated.", "condition": "limitationsCommunicated === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [ { "id": "UX-EXPLAIN-HJ1", "question": "Is the explanation adequate for affected users?", "description": "Explanation adequacy depends on user context, system impact and audience.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": false } ], "requiredDecisions": [ { "id": "UX-EXPLAIN-D1", "question": "Is the explanation adequate?", "decisionType": "human_approval", "blocking": false } ], "requiredEvidence": [ { "id": "UX-EXPLAIN-E1", "label": "Explainability design document", "description": "Documented explainability design decisions.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "UX Designer", "Product Manager" ], "accountableRole": "Product Manager", "outputs": [ "Explainability design", "Limitation disclosures", "Explanation adequacy decision" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Explainability under design with interim disclaimers" ], "requiresCompensatingControls": true, "maxDurationDays": 60, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Product Manager", "requiresRationale": true, "requiresEvidence": false, "requiresCompensatingControls": true }, "handoffTargets": [ { "targetDomain": "UX", "targetComponent": "UX-CAPABILITY", "requiredOutputs": [ "explanationDesign", "userUnderstandingRequirements" ] } ], "handoffOutputs": [ "explanationDesign", "userUnderstandingRequirements" ], "reassessmentTriggers": [ "TRIGGER-USE-CHANGE", "TRIGGER-MODEL-CHANGE", "TRIGGER-DRIFT" ], "executionFunctionMappings": [ "EF5-OVERSIGHT" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "UX-IMPACT" ] }, { "id": "UX-CAPABILITY", "version": "2.0.0", "domain": "UX", "name": "Capability Development", "purpose": "Training and skill development that enables users to effectively supervise and interact with AI systems.", "coreQuestion": "Is there a capability development plan that prepares users to supervise and interact with the AI system?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all AI-enabled systems requiring user supervision." } ], "requiredInputs": [ { "id": "capabilityPlanDocumented", "label": "Capability plan documented", "type": "boolean", "required": true, "description": "Whether a capability development plan exists." }, { "id": "trainingProvided", "label": "Training provided", "type": "boolean", "required": true, "description": "Whether training has been provided to users." } ], "optionalInputs": [], "objectiveRules": [ { "id": "UX-CAPABILITY-R1", "description": "Capability plan must be documented.", "condition": "capabilityPlanDocumented === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "UX-CAPABILITY-R2", "description": "Training must be provided.", "condition": "trainingProvided === true", "passState": "SATISFIED", "failState": "IN_PROGRESS", "blocking": false } ], "humanJudgmentPoints": [ { "id": "UX-CAPABILITY-HJ1", "question": "Is the training adequate for the system risk profile?", "description": "Training adequacy depends on system complexity and user context.", "requiredOutput": "APPROVE", "requiresReviewer": true, "requiresRationale": true, "requiresEvidence": false } ], "requiredDecisions": [ { "id": "UX-CAPABILITY-D1", "question": "Is training adequate?", "decisionType": "human_approval", "blocking": false } ], "requiredEvidence": [ { "id": "UX-CAPABILITY-E1", "label": "Capability plan", "description": "Documented capability development plan.", "evidenceType": "document", "required": true, "expiresByDefault": false }, { "id": "UX-CAPABILITY-E2", "label": "Training materials", "description": "Training materials and delivery records.", "evidenceType": "document", "required": true, "expiresByDefault": true, "defaultExpiryDays": 365 } ], "responsibleRoles": [ "Training Lead", "Product Manager" ], "accountableRole": "Product Manager", "outputs": [ "Capability plan", "Training materials", "Training adequacy decision" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Training under development with interim guidance" ], "requiresCompensatingControls": true, "maxDurationDays": 60, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Product Manager", "requiresRationale": true, "requiresEvidence": false, "requiresCompensatingControls": true }, "handoffTargets": [], "handoffOutputs": [ "capabilityRequirements" ], "reassessmentTriggers": [ "TRIGGER-USE-CHANGE", "TRIGGER-MODEL-CHANGE" ], "executionFunctionMappings": [ "EF5-OVERSIGHT" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "UX-EXPLAIN" ] }, { "id": "UX-ADOPTION", "version": "2.0.0", "domain": "UX", "name": "Adoption Measurement", "purpose": "Monitoring of how AI systems are actually used, including feedback and complaints.", "coreQuestion": "Is adoption being measured with feedback and complaint channels in place?", "applicability": [ { "field": "systemId", "operator": "exists", "description": "Applies to all deployed AI-enabled systems." } ], "requiredInputs": [ { "id": "adoptionMetricsDefined", "label": "Adoption metrics defined", "type": "boolean", "required": true, "description": "Whether adoption metrics are defined." }, { "id": "feedbackChannelExists", "label": "Feedback channel exists", "type": "boolean", "required": true, "description": "Whether a user feedback channel exists." }, { "id": "complaintChannelExists", "label": "Complaint channel exists", "type": "boolean", "required": true, "description": "Whether a complaint channel exists." } ], "optionalInputs": [ { "id": "adoptionDataCollected", "label": "Adoption data collected", "type": "boolean", "required": false, "description": "Whether adoption data has been collected." } ], "objectiveRules": [ { "id": "UX-ADOPTION-R1", "description": "Adoption metrics must be defined.", "condition": "adoptionMetricsDefined === true", "passState": "SATISFIED", "failState": "REQUIRED", "blocking": false }, { "id": "UX-ADOPTION-R2", "description": "Feedback channel must exist.", "condition": "feedbackChannelExists === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false }, { "id": "UX-ADOPTION-R3", "description": "Complaint channel must exist.", "condition": "complaintChannelExists === true", "passState": "SATISFIED", "failState": "PARTIAL", "blocking": false } ], "humanJudgmentPoints": [], "requiredDecisions": [], "requiredEvidence": [ { "id": "UX-ADOPTION-E1", "label": "Adoption metrics definition", "description": "Defined adoption metrics and measurement approach.", "evidenceType": "document", "required": true, "expiresByDefault": false } ], "responsibleRoles": [ "UX Researcher", "Product Manager" ], "accountableRole": "Product Manager", "outputs": [ "Adoption metrics", "Feedback channel", "Complaint channel", "Adoption data" ], "blockingConditions": [], "allowedExceptions": { "allowedReasons": [ "Metrics being defined with interim manual collection" ], "requiresCompensatingControls": false, "maxDurationDays": 30, "requiresAccountableApprover": true }, "exceptionApproval": { "approverRole": "Product Manager", "requiresRationale": true, "requiresEvidence": false, "requiresCompensatingControls": false }, "handoffTargets": [ { "targetDomain": "PRJ", "targetComponent": "PRJ-BUSINESS", "requiredOutputs": [ "userFeedback", "usageFindings", "escalationData" ] } ], "handoffOutputs": [ "userFeedback", "usageFindings", "escalationData" ], "reassessmentTriggers": [ "TRIGGER-DRIFT", "TRIGGER-USER-HARM" ], "executionFunctionMappings": [ "EF3-RISK", "EF5-OVERSIGHT" ], "sourceProvenance": "Original CSM publication, August 29, 2025. V2 contract formalized 2026-08-10.", "dependencies": [ "UX-IMPACT" ] } ], "operationalMapping": [ { "componentId": "ENT-POLICY", "executionFunctionId": "EF1-PURPOSE", "relevance": "Policy defines purpose boundaries and accountability expectations." }, { "componentId": "ENT-POLICY", "executionFunctionId": "EF6-COMPLIANCE", "relevance": "Policy establishes compliance obligations and evidence expectations." }, { "componentId": "ENT-RISK", "executionFunctionId": "EF3-RISK", "relevance": "Risk assessment identifies and evaluates risks requiring monitoring." }, { "componentId": "ENT-RISK", "executionFunctionId": "EF1-PURPOSE", "relevance": "Risk context informs purpose and scope boundaries." }, { "componentId": "ENT-DATA", "executionFunctionId": "EF2-MAPPING", "relevance": "Data stewardship requires mapping data sources and their governance." }, { "componentId": "ENT-DATA", "executionFunctionId": "EF6-COMPLIANCE", "relevance": "Data governance evidence supports compliance assurance." }, { "componentId": "ENT-MANDATE", "executionFunctionId": "EF1-PURPOSE", "relevance": "Strategic mandate defines purpose, authority and accountability." }, { "componentId": "PRJ-BUSINESS", "executionFunctionId": "EF1-PURPOSE", "relevance": "Business case defines the specific purpose and scope being tested." }, { "componentId": "PRJ-BUSINESS", "executionFunctionId": "EF3-RISK", "relevance": "Business case includes risk-benefit evaluation." }, { "componentId": "PRJ-TESTING", "executionFunctionId": "EF3-RISK", "relevance": "Controlled testing evaluates risks and performance before scale." }, { "componentId": "PRJ-TESTING", "executionFunctionId": "EF4-DELIVERY", "relevance": "Testing gates control delivery decisions." }, { "componentId": "PRJ-SCALE", "executionFunctionId": "EF4-DELIVERY", "relevance": "Scale decision is a delivery gate controlling broader deployment." }, { "componentId": "PRJ-PLAYBOOK", "executionFunctionId": "EF5-OVERSIGHT", "relevance": "Playbook transfers learning to operational owners for oversight." }, { "componentId": "PRJ-PLAYBOOK", "executionFunctionId": "EF6-COMPLIANCE", "relevance": "Playbook documentation serves as compliance evidence." }, { "componentId": "CODE-STANDARDS", "executionFunctionId": "EF4-DELIVERY", "relevance": "Development standards control how code is delivered and reviewed." }, { "componentId": "CODE-SECURITY", "executionFunctionId": "EF3-RISK", "relevance": "Security protocols address risks in AI-assisted code." }, { "componentId": "CODE-SECURITY", "executionFunctionId": "EF4-DELIVERY", "relevance": "Security scanning gates control delivery." }, { "componentId": "CODE-HUMAN", "executionFunctionId": "EF5-OVERSIGHT", "relevance": "Human oversight of AI-assisted development is a direct oversight function." }, { "componentId": "CODE-TRACE", "executionFunctionId": "EF6-COMPLIANCE", "relevance": "Traceability logging produces compliance evidence for AI-assisted changes." }, { "componentId": "CODE-TRACE", "executionFunctionId": "EF2-MAPPING", "relevance": "Traceability records map AI-assisted changes to review and approval." }, { "componentId": "UX-IMPACT", "executionFunctionId": "EF3-RISK", "relevance": "Impact analysis identifies risks to affected individuals and groups." }, { "componentId": "UX-EXPLAIN", "executionFunctionId": "EF5-OVERSIGHT", "relevance": "Explainability design enables effective human oversight." }, { "componentId": "UX-CAPABILITY", "executionFunctionId": "EF5-OVERSIGHT", "relevance": "Capability development builds human oversight capacity." }, { "componentId": "UX-ADOPTION", "executionFunctionId": "EF3-RISK", "relevance": "Adoption measurement detects misuse, drift and emerging risks." }, { "componentId": "UX-ADOPTION", "executionFunctionId": "EF5-OVERSIGHT", "relevance": "Adoption data feeds feedback and learning loops." } ], "handoffContracts": [ { "id": "HANDOFF-ENT-PRJ", "fromDomain": "ENT", "toDomain": "PRJ", "name": "Enterprise to Project", "requiredFields": [ "intendedPurpose", "accountableOwner", "policyBoundaries", "riskContext", "dataOwnership", "strategicMandate" ], "description": "Policy and risk boundaries become project requirements." }, { "id": "HANDOFF-PRJ-CODE", "fromDomain": "PRJ", "toDomain": "CODE", "name": "Project to Code", "requiredFields": [ "approvedUseCase", "businessSuccessCriteria", "evaluationCriteria", "releaseExpectations", "applicableConstraints", "scaleDecisionCriteria" ], "description": "Acceptance criteria and approved assumptions become implementation constraints." }, { "id": "HANDOFF-CODE-UX", "fromDomain": "CODE", "toDomain": "UX", "name": "Code to UX / Operations", "requiredFields": [ "implementationVersion", "validatedBehavior", "knownLimitations", "securityTestResults", "monitoringSignals", "fallbackBehavior" ], "description": "Actual system behavior and limitations shape user interaction and oversight." }, { "id": "HANDOFF-UX-PRJ", "fromDomain": "UX", "toDomain": "PRJ", "name": "UX to Project", "requiredFields": [ "userFeedback", "usageFindings", "operatorIssues", "incidentSignals", "usabilityFailures", "escalationData" ], "description": "User feedback and operational behavior trigger product/project reassessment." }, { "id": "HANDOFF-PRJ-ENT", "fromDomain": "PRJ", "toDomain": "ENT", "name": "Project to Enterprise", "requiredFields": [ "newRisks", "policyGaps", "incidents", "strategicChanges", "discoveredDependencies", "lessonsRequiringEnterpriseChange" ], "description": "Incidents, lessons and newly discovered risks may require policy or risk updates." } ], "reassessmentTriggers": [ { "id": "TRIGGER-USE-CHANGE", "label": "Intended-use change", "description": "The intended purpose of the system has changed.", "affectedDomains": [ "ENT", "PRJ", "UX" ], "affectedComponents": [ "ENT-MANDATE", "ENT-POLICY", "PRJ-BUSINESS", "UX-IMPACT", "UX-EXPLAIN" ] }, { "id": "TRIGGER-SCOPE-EXPANSION", "label": "Scope expansion", "description": "The system scope has expanded beyond the approved use case.", "affectedDomains": [ "ENT", "PRJ", "CODE" ], "affectedComponents": [ "ENT-MANDATE", "PRJ-BUSINESS", "PRJ-SCALE", "CODE-STANDARDS" ] }, { "id": "TRIGGER-OWNER-CHANGE", "label": "Accountable-owner change", "description": "The accountable owner has changed.", "affectedDomains": [ "ENT" ], "affectedComponents": [ "ENT-MANDATE", "ENT-POLICY", "ENT-RISK" ] }, { "id": "TRIGGER-MODEL-CHANGE", "label": "Model change", "description": "The AI model has been changed or materially updated.", "affectedDomains": [ "PRJ", "CODE", "UX" ], "affectedComponents": [ "PRJ-TESTING", "CODE-SECURITY", "CODE-TRACE", "UX-EXPLAIN" ] }, { "id": "TRIGGER-PROVIDER-CHANGE", "label": "Model-provider change", "description": "The model provider has changed.", "affectedDomains": [ "ENT", "PRJ", "CODE" ], "affectedComponents": [ "ENT-DATA", "ENT-RISK", "PRJ-TESTING", "CODE-SECURITY" ] }, { "id": "TRIGGER-CONFIG-CHANGE", "label": "Material prompt/configuration change", "description": "Material prompt or configuration changes affect system behavior.", "affectedDomains": [ "PRJ", "CODE" ], "affectedComponents": [ "PRJ-TESTING", "CODE-STANDARDS" ] }, { "id": "TRIGGER-DATA-CHANGE", "label": "Major dataset or RAG-source change", "description": "Training data, retrieval sources or operational data have materially changed.", "affectedDomains": [ "ENT", "PRJ" ], "affectedComponents": [ "ENT-DATA", "ENT-RISK", "PRJ-TESTING" ] }, { "id": "TRIGGER-TOOL-AUTHORITY-CHANGE", "label": "Tool/agent authority change", "description": "The tools or authority granted to an agent have changed.", "affectedDomains": [ "PRJ", "CODE", "UX" ], "affectedComponents": [ "PRJ-BUSINESS", "CODE-STANDARDS", "CODE-HUMAN", "UX-IMPACT" ] }, { "id": "TRIGGER-NEW-INTEGRATION", "label": "New integration", "description": "A new integration has been added to the system.", "affectedDomains": [ "PRJ", "CODE" ], "affectedComponents": [ "PRJ-TESTING", "CODE-SECURITY", "CODE-TRACE" ] }, { "id": "TRIGGER-DEPENDENCY-CHANGE", "label": "Material dependency change", "description": "A material dependency has changed or been removed.", "affectedDomains": [ "CODE" ], "affectedComponents": [ "CODE-SECURITY", "CODE-TRACE" ] }, { "id": "TRIGGER-SECURITY-INCIDENT", "label": "Significant security incident", "description": "A significant security incident has occurred.", "affectedDomains": [ "ENT", "CODE" ], "affectedComponents": [ "ENT-RISK", "ENT-POLICY", "CODE-SECURITY", "CODE-TRACE" ] }, { "id": "TRIGGER-EVAL-FAILURE", "label": "Significant evaluation failure", "description": "A significant evaluation failure has been detected.", "affectedDomains": [ "PRJ", "CODE" ], "affectedComponents": [ "PRJ-TESTING", "PRJ-SCALE", "CODE-STANDARDS" ] }, { "id": "TRIGGER-DRIFT", "label": "Material drift", "description": "Material model or behavioral drift has been detected.", "affectedDomains": [ "PRJ", "UX" ], "affectedComponents": [ "PRJ-TESTING", "UX-ADOPTION", "UX-EXPLAIN" ] }, { "id": "TRIGGER-USER-HARM", "label": "User harm/complaint pattern", "description": "A pattern of user harm or complaints has been identified.", "affectedDomains": [ "UX", "PRJ", "ENT" ], "affectedComponents": [ "UX-IMPACT", "UX-ADOPTION", "PRJ-BUSINESS", "ENT-RISK" ] }, { "id": "TRIGGER-JURISDICTION-CHANGE", "label": "Jurisdiction/regulatory-context change", "description": "The regulatory or jurisdictional context has changed.", "affectedDomains": [ "ENT" ], "affectedComponents": [ "ENT-POLICY", "ENT-RISK", "ENT-MANDATE" ] }, { "id": "TRIGGER-POLICY-CHANGE", "label": "Major organizational policy change", "description": "Organizational AI governance policy has materially changed.", "affectedDomains": [ "ENT", "PRJ", "CODE", "UX" ], "affectedComponents": [ "ENT-POLICY", "ENT-RISK", "PRJ-BUSINESS", "CODE-STANDARDS", "UX-IMPACT" ] }, { "id": "TRIGGER-EXCEPTION-EXPIRY", "label": "Approved exception expiry", "description": "An approved exception has expired or is about to expire.", "affectedDomains": [ "ENT", "PRJ", "CODE", "UX" ], "affectedComponents": [] }, { "id": "TRIGGER-DECOMMISSION", "label": "Retirement/decommissioning", "description": "The system is being retired or decommissioned.", "affectedDomains": [ "ENT", "PRJ" ], "affectedComponents": [ "ENT-MANDATE", "PRJ-PLAYBOOK" ] } ], "componentDependencies": [ { "component": "PRJ-SCALE", "dependsOn": "PRJ-TESTING", "rule": "Scale decision should not become READY if required controlled testing is incomplete." }, { "component": "PRJ-SCALE", "dependsOn": "PRJ-BUSINESS", "rule": "Scale decision requires an approved business case." }, { "component": "CODE-HUMAN", "dependsOn": "CODE-STANDARDS", "rule": "Human oversight requirements depend on applicable development standards." }, { "component": "CODE-SECURITY", "dependsOn": "CODE-STANDARDS", "rule": "Security protocols operate within defined development standards." }, { "component": "CODE-TRACE", "dependsOn": "CODE-STANDARDS", "rule": "Traceability logging follows defined standards for what must be traced." }, { "component": "UX-EXPLAIN", "dependsOn": "UX-IMPACT", "rule": "Explainability design depends on impact analysis to determine what must be explained." }, { "component": "UX-CAPABILITY", "dependsOn": "UX-EXPLAIN", "rule": "Capability development depends on what users need to understand (from explainability design)." }, { "component": "UX-ADOPTION", "dependsOn": "UX-IMPACT", "rule": "Adoption measurement references impact analysis for what constitutes concerning usage." }, { "component": "PRJ-BUSINESS", "dependsOn": "ENT-MANDATE", "rule": "Business case should align with strategic mandate." }, { "component": "PRJ-BUSINESS", "dependsOn": "ENT-POLICY", "rule": "Business case must operate within policy boundaries." }, { "component": "PRJ-TESTING", "dependsOn": "ENT-RISK", "rule": "Controlled testing should address identified risks." }, { "component": "CODE-STANDARDS", "dependsOn": "PRJ-BUSINESS", "rule": "Development standards should reflect approved use case constraints." } ], "stateModel": { "requirementStates": { "NOT_ASSESSED": "No evaluation has been performed for this requirement.", "NOT_APPLICABLE": "The requirement has been evaluated and determined not to apply to this system context.", "REQUIRED": "The requirement applies and has not yet been satisfied. Work has not begun.", "IN_PROGRESS": "The requirement applies and work is underway but not complete.", "SATISFIED": "All applicable objective rules pass and required evidence exists.", "PARTIAL": "Some but not all required evidence or rules are satisfied.", "BLOCKED": "A blocking condition exists that prevents progress.", "EXCEPTION_APPROVED": "An approved exception covers this requirement. The exception has a valid expiration.", "HUMAN_REVIEW_REQUIRED": "A human judgment point has been reached and requires explicit review.", "REASSESSMENT_REQUIRED": "A reassessment trigger has fired for this requirement." }, "domainStates": { "NOT_STARTED": "No applicable components have been assessed.", "IN_PROGRESS": "At least one applicable component is assessed but not all are satisfied or validly excepted.", "READY_FOR_HANDOFF": "All applicable required components are satisfied or validly excepted and no human review remains.", "BLOCKED": "At least one applicable blocking component is BLOCKED.", "REASSESSMENT_REQUIRED": "At least one applicable component requires reassessment." }, "systemStates": { "ASSESSMENT_INCOMPLETE": "One or more applicable components have not been assessed.", "GOVERNANCE_BLOCKED": "One or more applicable components are BLOCKED.", "HUMAN_DECISION_REQUIRED": "One or more human judgment points require explicit review.", "READY_FOR_GOVERNANCE_DECISION": "All applicable components are satisfied, validly excepted, or not applicable. No blockers or human reviews remain. A human authority may record an approval decision.", "REASSESSMENT_REQUIRED": "One or more reassessment triggers have fired." } }, "governanceDepth": { "levels": { "BASELINE": "Minimum governance for all AI-enabled systems. Universal requirements apply.", "ENHANCED": "Additional requirements activated by organization-defined factors beyond baseline.", "INTENSIVE": "Maximum governance depth for systems with significant consequential, safety, or regulatory exposure." }, "proportionalityFactors": [ { "id": "consequential-decisions", "label": "Consequential decisions", "description": "System outputs influence decisions affecting individuals rights, opportunities, or wellbeing.", "recommendedDepth": "INTENSIVE" }, { "id": "external-customer-impact", "label": "External customer impact", "description": "System interacts with or produces outputs for external customers.", "recommendedDepth": "ENHANCED" }, { "id": "sensitive-data", "label": "Sensitive data", "description": "System processes personal, financial, health, or other sensitive data.", "recommendedDepth": "INTENSIVE" }, { "id": "autonomous-action", "label": "Autonomous action", "description": "System can take actions without per-action human approval.", "recommendedDepth": "INTENSIVE" }, { "id": "difficult-to-reverse", "label": "Difficult to reverse", "description": "System actions are difficult or impossible to reverse.", "recommendedDepth": "INTENSIVE" }, { "id": "safety-impact", "label": "Safety impact", "description": "System failure could cause physical or psychological harm.", "recommendedDepth": "INTENSIVE" }, { "id": "significant-financial-impact", "label": "Significant financial impact", "description": "System failure could cause material financial loss.", "recommendedDepth": "ENHANCED" }, { "id": "large-affected-population", "label": "Large affected population", "description": "System affects a large number of individuals.", "recommendedDepth": "ENHANCED" }, { "id": "critical-vendor-dependency", "label": "Critical vendor dependency", "description": "System depends on a third-party provider whose failure would disrupt operations.", "recommendedDepth": "ENHANCED" }, { "id": "external-regulatory-exposure", "label": "External regulatory exposure", "description": "System is subject to specific regulatory requirements (e.g., EU AI Act, NYC LL144).", "recommendedDepth": "INTENSIVE" } ] }, "provenance": { "originalArticleTitle": "Cognitive System Management: A Framework for Enterprise AI Project Governance", "originalAuthor": "Subodh KC", "originalPublication": "AI Governance on Medium", "originalPublicationDate": "2025-08-29", "sourceUrl": "https://medium.com/ai-governance-playbook/cognitive-system-management-a-framework-for-enterprise-ai-project-governance-ee7fc95a07ff", "v2SpecificationDate": "2026-08-10", "v2Label": "CSM 2.0 is a formalization and extension of the original CSM publication. It does not claim the 2025 article contained V2 features.", "determinismPrinciple": "CSM 2.0 makes governance deterministic where objective rules permit and makes human judgment explicit, attributable and traceable where interpretation is required.", "determinismContract": "For a fixed CSM specification version, organizational policy configuration, explicit assessment date and normalized input record, objective CSM evaluation must produce the same computed requirement set and statuses.", "legalDisclaimer": "CSM 2.0 does not produce legal compliance verdicts. It may produce governance requirements, evidence gaps, review requirements, decision records and framework mappings. Legal applicability or legal sufficiency must remain subject to qualified interpretation where needed." }, "determinismBoundary": { "deterministicDecisions": [ "Whether an accountable owner is assigned (ENT-MANDATE)", "Whether a required evidence artifact exists (any component)", "Whether an exception has expired (any component)", "Whether a reassessment trigger has fired (system-wide)", "Whether a dependency is satisfied (component dependency graph)", "Whether evidence has expired (evidence schema)", "Whether a component is applicable based on system context (applicability rules)", "Whether required inputs are present (input validation)", "Whether a domain is ready for handoff (domain state derivation)", "Whether a blocker exists (blocking condition check)" ], "humanJudgmentDecisions": [ "Whether a use is ethically acceptable (ENT-POLICY)", "Whether residual risk is acceptable (ENT-RISK)", "Whether a legal obligation applies (ENT-POLICY)", "Whether an explanation is adequate for affected users (UX-EXPLAIN)", "Whether a business benefit justifies risk (PRJ-BUSINESS)", "Whether a scale decision should proceed (PRJ-SCALE)", "Whether human oversight is proportionate (CODE-HUMAN)", "Whether training is adequate for the system (UX-CAPABILITY)", "Whether an exception should be approved (any component)", "Whether a system is approved for a specific purpose (system-level approval)" ], "forbiddenOutputStates": [ "LEGAL_COMPLIANT", "EU_AI_ACT_COMPLIANT", "COMPLIANT", "SAFE", "TRUSTWORTHY", "CERTIFIED", "AUDIT_PROOF" ], "forbiddenScoreNames": [ "compliance_score", "safety_score", "trust_score", "risk_score" ] }, "nistIsoCrosswalk": { "entries": [ { "csmComponentId": "ENT-POLICY", "csmDomain": "Enterprise", "nistFunction": "Govern", "nistReference": "NIST AI RMF 1.0 - Govern (GV): Policies, procedures, processes, and practices", "isoClause": "Clause 5 - Organizational context, Clause 6 - Planning", "isoReference": "ISO/IEC 42001:2023 - Context and leadership", "relationship": "supports", "notes": "CSM Policy Framework establishes organizational AI policies. NIST Govern and ISO Clauses 5-6 address organizational context and policy establishment." }, { "csmComponentId": "ENT-RISK", "csmDomain": "Enterprise", "nistFunction": "Map", "nistReference": "NIST AI RMF 1.0 - Map (MP): Context and risk identification", "isoClause": "Clause 6.1 - Actions to address risks and opportunities", "isoReference": "ISO/IEC 42001:2023 - Risk-based planning", "relationship": "supports", "notes": "CSM Risk Assessment identifies AI-specific risks. NIST Map and ISO 6.1 address risk identification and treatment." }, { "csmComponentId": "ENT-DATA", "csmDomain": "Enterprise", "nistFunction": "Map", "nistReference": "NIST AI RMF 1.0 - Map (MP.2.2): Data provenance and quality", "isoClause": "Clause 7.3 - Data for AI systems", "isoReference": "ISO/IEC 42001:2023 - Data management", "relationship": "partially-maps", "notes": "CSM Data Stewardship covers data governance. NIST and ISO address data quality and provenance at the system level." }, { "csmComponentId": "ENT-MANDATE", "csmDomain": "Enterprise", "nistFunction": "Govern", "nistReference": "NIST AI RMF 1.0 - Govern (GV.2): Accountability structures", "isoClause": "Clause 5.3 - Roles, responsibilities and authorities", "isoReference": "ISO/IEC 42001:2023 - Leadership and accountability", "relationship": "supports", "notes": "CSM Strategic Mandate defines accountability. NIST and ISO address accountability structures." }, { "csmComponentId": "PRJ-BUSINESS", "csmDomain": "Project", "nistFunction": "Map", "nistReference": "NIST AI RMF 1.0 - Map (MP.1): Context establishment", "isoClause": "Clause 8.1 - Operational planning and control", "isoReference": "ISO/IEC 42001:2023 - AI system operational planning", "relationship": "partially-maps", "notes": "CSM Business Case defines the project hypothesis. NIST Map establishes context. ISO 8.1 addresses operational planning." }, { "csmComponentId": "PRJ-TESTING", "csmDomain": "Project", "nistFunction": "Measure", "nistReference": "NIST AI RMF 1.0 - Measure (MS): Assessing and tracking AI risks", "isoClause": "Clause 8.3 - AI system impact assessment", "isoReference": "ISO/IEC 42001:2023 - Impact assessment and testing", "relationship": "supports", "notes": "CSM Controlled Testing evaluates risks before scale. NIST Measure tracks and assesses. ISO 8.3 requires impact assessment." }, { "csmComponentId": "PRJ-SCALE", "csmDomain": "Project", "nistFunction": "Manage", "nistReference": "NIST AI RMF 1.0 - Manage (MG): Responding to AI risks", "isoClause": "Clause 8.4 - AI system change management", "isoReference": "ISO/IEC 42001:2023 - Change and deployment management", "relationship": "partially-maps", "notes": "CSM Scale Decision is a governance gate. NIST Manage responds to risks. ISO 8.4 addresses change management." }, { "csmComponentId": "PRJ-PLAYBOOK", "csmDomain": "Project", "nistFunction": "Govern", "nistReference": "NIST AI RMF 1.0 - Govern (GV.3): Documentation and transparency", "isoClause": "Clause 7.5 - Documented information", "isoReference": "ISO/IEC 42001:2023 - Documentation requirements", "relationship": "supports", "notes": "CSM Playbook transfers knowledge. NIST and ISO address documentation and transparency." }, { "csmComponentId": "CODE-STANDARDS", "csmDomain": "Code", "nistFunction": "Manage", "nistReference": "NIST AI RMF 1.0 - Manage (MG.2): Enhancing AI system quality", "isoClause": "Clause 8.2 - AI system development controls", "isoReference": "ISO/IEC 42001:2023 - Development controls", "relationship": "supports", "notes": "CSM Development Standards govern AI-assisted code. NIST and ISO address development controls." }, { "csmComponentId": "CODE-SECURITY", "csmDomain": "Code", "nistFunction": "Measure", "nistReference": "NIST AI RMF 1.0 - Measure (MS.2.8): Security and robustness", "isoClause": "Clause 8.2 - AI system development controls (security)", "isoReference": "ISO/IEC 42001:2023 - Security in development", "relationship": "supports", "notes": "CSM Security Protocols address AI-generated code vulnerabilities. NIST and ISO address security testing." }, { "csmComponentId": "CODE-HUMAN", "csmDomain": "Code", "nistFunction": "Manage", "nistReference": "NIST AI RMF 1.0 - Manage (MG.3): Human-AI configuration", "isoClause": "Clause 8.3 - Human oversight", "isoReference": "ISO/IEC 42001:2023 - Human oversight requirements", "relationship": "supports", "notes": "CSM Human Oversight ensures proportionate review. NIST and ISO address human-AI configuration and oversight." }, { "csmComponentId": "CODE-TRACE", "csmDomain": "Code", "nistFunction": "Measure", "nistReference": "NIST AI RMF 1.0 - Measure (MS.2.10): Tracking and logging", "isoClause": "Clause 7.5 - Documented information (records)", "isoReference": "ISO/IEC 42001:2023 - Records and traceability", "relationship": "supports", "notes": "CSM Traceability Logging records AI-assisted changes. NIST and ISO address logging and records." }, { "csmComponentId": "UX-IMPACT", "csmDomain": "UX", "nistFunction": "Map", "nistReference": "NIST AI RMF 1.0 - Map (MP.3): Potential impacts", "isoClause": "Clause 8.3 - AI system impact assessment", "isoReference": "ISO/IEC 42001:2023 - Impact assessment", "relationship": "supports", "notes": "CSM Impact Analysis assesses effects on individuals. NIST Map addresses potential impacts. ISO 8.3 requires impact assessment." }, { "csmComponentId": "UX-EXPLAIN", "csmDomain": "UX", "nistFunction": "Manage", "nistReference": "NIST AI RMF 1.0 - Manage (MG.3.2): Transparency and explainability", "isoClause": "Clause 8.5 - Transparency and information for users", "isoReference": "ISO/IEC 42001:2023 - Transparency requirements", "relationship": "supports", "notes": "CSM Explainability Design addresses user understanding. NIST and ISO address transparency." }, { "csmComponentId": "UX-CAPABILITY", "csmDomain": "UX", "nistFunction": "Govern", "nistReference": "NIST AI RMF 1.0 - Govern (GV.4): Workforce development", "isoClause": "Clause 7.2 - Competence and training", "isoReference": "ISO/IEC 42001:2023 - Competence requirements", "relationship": "partially-maps", "notes": "CSM Capability Development builds user skills. NIST addresses workforce. ISO addresses competence and training." }, { "csmComponentId": "UX-ADOPTION", "csmDomain": "UX", "nistFunction": "Measure", "nistReference": "NIST AI RMF 1.0 - Measure (MS.3): Feedback and monitoring", "isoClause": "Clause 9.1 - Monitoring, measurement, analysis and evaluation", "isoReference": "ISO/IEC 42001:2023 - Monitoring and evaluation", "relationship": "supports", "notes": "CSM Adoption Measurement monitors usage and feedback. NIST Measure addresses monitoring. ISO 9.1 requires monitoring." } ], "disclaimer": "This crosswalk is informative. It does not constitute equivalence, certification, or a compliance guarantee. CSM 2.0 is an independent governance methodology. NIST AI RMF and ISO/IEC 42001 are separate frameworks with their own scopes, definitions and requirements. Organizations seeking certification or compliance with NIST or ISO should consult the original standards and qualified assessors." } }