The Cogent AI Governance Framework
Eight domains that organize everything we do, mapped to the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, and U.S. state AI laws.
Eight Domains
Every assessment, program, and test we deliver is organized around these domains, so results are consistent and comparable across engagements.
Strategy and Accountability
Who owns AI decisions, how they’re made, and how leadership oversees them.
Inventory and Classification
Knowing every AI system and feature in use, and classifying each by risk.
Risk and Impact Assessment
Assessing what each system does, who it affects, and what could go wrong.
Data and Privacy
Controlling what data AI uses, where it goes, and whether its use is lawful.
Testing and Assurance
Independently testing AI for accuracy, fairness, safety, and security.
Vendors and Procurement
Buying AI with the right requirements, contract terms, and oversight.
Monitoring and Incident Response
Watching AI after launch and responding quickly when it fails.
People and Training
Making sure staff know the rules, understand the risks, and know how to use AI well.
How the Domains Map to Leading Frameworks
One program can satisfy several frameworks at once. This table shows where each domain lines up.
| Domain | NIST AI RMF | ISO/IEC 42001 | EU AI Act |
|---|---|---|---|
| Strategy and Accountability | Govern | Clause 5, Leadership | Article 4, AI literacy, and deployer obligations in Article 26 |
| Inventory and Classification | Map | Clause 6.1, Actions to address risks | Article 6, Classification of high-risk systems |
| Risk and Impact Assessment | Map and Measure | Clause 6.1.4, AI system impact assessment | Article 27, Fundamental rights impact assessment |
| Data and Privacy | Map and Manage | Annex A data controls | Data governance duties alongside privacy law |
| Testing and Assurance | Measure | Clause 9, Performance evaluation | Article 9, Risk management for high-risk systems |
| Vendors and Procurement | Govern | Annex A.10, Third-party relationships | Article 26, Obligations of deployers |
| Monitoring and Incident Response | Manage | Clause 10, Improvement | Article 73, Reporting of serious incidents |
| People and Training | Govern | Clause 7.2, Competence | Article 4, AI literacy |
U.S. state AI laws, such as Colorado’s and California’s automated decision rules, map mainly to the Inventory, Risk and Impact Assessment, and Monitoring domains. Our AI Laws by State page tracks them.
How We Use It
Assess
Our readiness assessments and scorecard measure each domain, so you see where you stand.
Build
Our programs, policies, and implementations close the gaps domain by domain.
Verify
Our testing, audits, and continuous assurance confirm each domain works in practice.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.