How we work
The AGORA framework
The methodological backing of the consulting work: a catalogue of controls, a maturity model and evidence criteria. It is not a product sold separately, nor a substitute for professional judgement.
What it is for
Why governing AI is not slowing it down
Governing is not putting up barriers: it is being able to answer three questions at any moment. Where AI is being used, who authorised each use, and what happens if a decision goes wrong. Without those answers, scaling means carrying a risk nobody measured.
Most organisations do not have a technology problem. They have a traceability problem: tools that arrived through different areas, criteria that vary by whoever decides, and no evidence that the controls written in a document are actually operating.
It turns a general discussion about AI into a concrete list of decisions, owners and evidence. In an organisation where AI is already used without a policy, it establishes what to resolve first and what demonstrates that it has been resolved.
Explore the framework
Each tab answers one question. What is published is the architecture and the logic; the full control catalogue is working material.
- ArchitectureHow the catalogue is organised
- ControlsWhat a control is, with an example
- Maturity G0–G3How to read the level
- Risk and proportionalityWhat applies to each organisation
- EvidenceWhat counts as proof
- PlatformWhat it does and does not do
What gets evaluated
The catalogue is organised in two parts. Twelve transversal chapters that apply to any organisation, and eleven sector modules activated by context. Together they make up the 325 controls.
Transversal chapters
12 chapters · 170 controls
Apply to any organisation.
Sector modules
11 modules · 155 controls
Activated by context.
Illustrative example. One module activated for an organisation's context.
Sector modules the catalogue covers
- Justice and the legal system
- Health and life sciences
- Financial services
- Education and training
- Public sector and administration
- Industry and manufacturing
- Commerce and retail
- Energy and utilities
- Employment and human resources
- Media and communications
- Security and border control
No organisation activates all eleven. They are selected by context, and the cross-cutting chapters cover what no module names.
From requirement to control, with ownership and evidence
A structured methodology designed to turn AI governance requirements into actionable controls, ownership and evidence.
- 325 mapped controls
- ISO/IEC 42001
- EU AI Act
- NIST AI RMF
The catalogue was built on ISO/IEC 42001, the EU AI Act and NIST AI RMF, and organises controls by category with risk weighting. Its size does not imply that all of them apply to every organisation: selection is proportional to context, data types and the possible consequences of an error.
- Control
- A verifiable practice, with an owner and associated evidence.
- Evidence
- The document or record showing the control operates, not merely that it was drafted.
- Owner
- The person or area accountable for the control, identified in a matrix.
- Sector modules
- Thematic adaptations of the catalogue to specific contexts.
See how a control readsC-103 · Risk-based system prioritisation
Illustrative example · one control from the catalogue · Level G1
- The problem it addresses
- Trying to govern every system at once, with small teams, ends up governing all of them badly.
- The action it requires
- Sequence the rollout of controls across the portfolio by risk level, so the most exposed systems are governed first.
- The role accountable
- The AI Committee. The framework requires it to be active from level G1 onward, which is where this control sits.
- The evidence that allows review
- A prioritisation matrix covering the full inventory, recalculated whenever a system changes use.
Every one of the 325 reads this way. No organisation applies them all: selection is proportional to context and risk.
Four maturity levels
The G0–G3 scale describes capabilities, not a grade. Placing an organisation at a level is a starting point for decisions, not a result to publish.
G0 Informal
AI is used in a fragmented way, without policy or oversight. The main risk is exposing information in uncontrolled tools.
Typical evidenceNo systematic evidence: the first step is a base policy and an inventory.
G1 Defined
An approved leadership policy exists and a decision body has been constituted. Use cases are inventoried and classified by risk.
Typical evidenceConstitution record of the decision body and a register of use cases.
G2 Managed
Privacy and security controls are integrated into the development and procurement cycle. Impact assessments are carried out systematically.
Typical evidenceImpact assessments and technical documentation per critical system.
G3 Optimised
Governance is part of how the organisation works, with recurring external review and continuous improvement.
Typical evidenceTransparency reports and results of external reviews.
The level is not a grade or a ranking. It describes the state governance is in today and what evidence would be needed to hold the next level. An honest G1 is more useful than a G3 declared without backing.
How proportionality works
No organisation applies all 325. Applying them all would be as useless as applying none: effort spreads thin and the controls that matter sit at the same level as those that do not apply.
Selection depends on three things: the sector, which activates its module or not; the type of data the system touches; and the possible consequences of an error for the affected person. An assistant that drafts internal notes and one that sets a credit limit do not get the same treatment, even on the same technique.
What counts as evidence
A self-assessment is not an audit or a certification. The framework organises the preparation; independent verification, where it applies, is carried out by a qualified third party.
- A register of AI systems in use, with owner and risk classification.
- An approved policy, with date, scope and the body that approved it.
- An impact assessment for a system, with identified risks and their treatment.
- A record of vendor reviews and of the results delivered.
The platform's role
AGORA has a platform that organises follow-up of the work: control status, associated evidence and pending reviews. It is a tool supporting the consulting work.
- It does not replace professional work or issue automatic conclusions.
- It is not offered as a self-service product with public sign-up.
- Its use within an engagement is defined by scope, not by default.
The framework's master document is internal and is not published. What this page describes is its structure and function, not its full content.
How it connects to delivery
This framework says what needs to be governed. It does not say how a project is executed: that is the AGORA Delivery Framework, where data governance, risk and responsible AI are three of the five dimensions crossing every phase. Keeping them separate avoids the most common outcome: a policy nobody executes, or a delivery nobody can audit.
Explore the methodology →See the three models in How we work →
Explore the 4-week assessment
The assessment applies the framework to your organisation and delivers the observed maturity level, with its evidence. It is not a certification.