What is a governance framework
Outcomes the governing body holds management to account against
A governance framework is the set of outcomes against which a governing body holds management to account. It does not redefine governance. It states how those outcomes are tested in operation. It is not a tool. It is not a process model. It is not a management system. It is the test the management system is built to meet.
This distinction is the one most often collapsed. "AI governance" is used to mean a policy pack, a model inventory, an ethics principle and a workflow, sometimes in the same sentence. Those are management artefacts. Governance is the system by which the governing body exercises ethical and effective leadership. The framework is how that duty is made testable for the organisation's use of AI.
The four outcomes
DP Services treats the outcomes as results against which leadership is judged, not as a list of tools. Applied to AI, they are an ethical culture; sustainable performance and value creation through strategic objectives and organisational purpose; adequate and effective control by the governing body of AI resources and risks; and trust in the organisation, its reputation and its legitimacy.
Ethical culture is tested by whether responsible-AI policy is approved, known and used; whether incentives and escalation support that policy; and whether exceptions, incidents and misuse are handled in line with stated values rather than only after the fact.
Sustainable performance and value creation is tested by whether AI use is tied to organisational purpose and strategic objectives; whether the portfolio of AI uses is known and prioritised; and whether expected value is recorded and compared with realised value, including the cost of risk, change and recovery.
Adequate and effective control is tested by whether the governing body can see the estate of AI uses; whether risk is assessed against law, frameworks and internal policy and treated inside the organisation's business-risk profile; whether third-party and embedded AI sit in the same control system; and whether controls operate at runtime, not only as documents.
Trust, reputation and legitimacy are tested by whether decisions leave named work products; whether accountability remains visible across legal-entity boundaries; and whether one set of processes can satisfy more than one obligation without a parallel paper framework.
Evaluate, direct, monitor
The governing body steers the system by evaluating stakeholder needs, conditions and options; setting direction through prioritisation and decision-making; and monitoring performance and compliance against agreed objectives. That is the ISO/IEC 38500 and ISO/IEC 38507 formulation as well. Management executes. The governing body does not.
Accountability for the use of AI remains with the governing body. It cannot be assigned to a model, a vendor or a management tool. Software may execute delegated controls. It does not take that accountability. A framework that cannot say who evaluates, who directs and who monitors, for a named system, is a slogan.
An outcome is developed when the governing body can answer the matching question from artefacts, not when the outcome has been declared. Culture: what behaviour do we require, and what happened the last time it was breached? Performance: which AI uses serve which objective, and did they create the value we claimed? Control: what is in production, who owns it, and which controls ran? Legitimacy: what evidence would we hand a regulator, and who is accountable if several entities own the stack? Until those answers exist, the outcome is declared, not developed.
What the framework does not do
The framework does not replace law, standards or internal policy. Those instruments are mapped onto the process model and, where used, applied through the platform. The framework does not assign the Tuesday task. It does not hold the incident clock. It does not approve the stage gate. Those are management. A framework that tries to be a process model becomes a long policy. A process model that tries to be a framework loses the test of success.
The framework also does not scale by being rewritten for each system. The outcomes stay the same. Design factors set how deep each process goes. A low-risk internal copilot does not need the same build-and-run intensity as a system that changes a customer outcome. Culture without control is a statement. Control without value is bureaucracy. Value without legitimacy is a risk to the licence to operate. The four are developed together, at different depth.
How DP Services uses it
On the DP Services model there are three layers and one accountability model. The governing body sets outcomes. Control Objectives for AI Systems (AICOB) turns those outcomes into assigned processes, controls, measures and assurance. The platform applies the model to live AI uses and keeps the evidence. Select outcomes first, then the process model, then software. A platform without agreed outcomes implements activity with no test of success.
The board workbenches on the governance framework are the operational form of the governing-body walk: purpose and values, leadership, value generation, oversight. Each takes one named system through a structured account the board can keep. They are not the management system. They are how the framework is tested against a real subject.