Why linked AI governance

Why linked AI governance

The other concepts in this bundle describe what AI-LinkMO is made of. This one records why it is shaped that way, as docs/architecture.md explains it.

The problem: governance kept in documents

AI governance today mostly lives in PDFs and spreadsheets. That causes three problems:

• Frameworks multiply. NIST AI RMF, the EU AI Act, ISO/IEC 42001, FINOS AIGF, the OWASP LLM Top 10 and SR 11-7 each have their own vocabulary for overlapping risks and controls.
• Mapping is manual. To answer “which of our controls satisfy both NIST and the EU AI Act?”, an analyst builds a crosswalk spreadsheet by hand. It is slow to make, and it is stale the moment a framework updates.
• Governance and engineering do not share a language. Compliance teams work in policy clauses, and engineers work in pipelines and APIs. Nothing traces a regulatory obligation to a deployed control.

The knowledge already exists in the frameworks. What is missing is the catalogue: one model in which a risk, a control and the clause that requires it are each one record with one identifier. With that catalogue, the question above is a query rather than a quarter’s work, and the answer is the same whoever asks it and however they ask.

One model, four doors

AI-LinkMO closes that gap with one linked data model. The model is a LinkML ontology of risks, controls, obligations, taxonomies, models, evaluations and incidents. AI-LinkMO exposes it through four DevSecOps-ready access patterns, the four doors, so that every stakeholder gets the same model in the form they can use:

• the CLI, for engineers and CI/CD pipelines;
• the FastAPI backend, for system integrators and GRC tools;
• the Svelte web UI, for risk, compliance and business stakeholders;
• the Neo4j graph database, for analysts and data scientists.

Why the shared ontology matters

Every door is generated from the same ontology: the CLI, the API, the web UI and the schema. That is why a risk identifier means the same thing everywhere, and why the traceability is auditable.

The couplet at the top of the README describes the shape of the work. Search out the frameworks. Show no favour among them, with one ontology and one identifier for each thing. Consult them against each other, which is what a crosswalk is. Then act, from a terminal, a pipeline, a browser or a graph query.

Bring your own data extends the same model to an organisation’s own policies, taxonomies and controls. They live in the same model as the open frameworks, so one query spans public regulation and private practice.