The Doctrine Card

Everything this programme rests on, on one page, taken from the book. Print it and keep it in the folder you take to the steering committee. The evidence contract, the internal tiers and the ninety-day sequence are the author’s proposed management methods, not recognised certification schemes or legal categories.

Five approvals that must remain distinct

#	Approval
1	Purpose approval
2	Permission to use data
3	Technical readiness
4	Authority to affect the business process
5	Acceptance of residual risk

One signatory may hold several roles in a small organisation, but the evidence for each decision should remain explicit. Specify the authority for temporary containment and the authority for permanent withdrawal — preserve the right to stop.

The evidence contract

Element	What it holds
The claim	The relevant action and outcome, written so that it could be shown to be wrong
The evidence	What has been demonstrated, fitted to plausible harm, autonomy, scale and difficulty of detecting error
The decision rule	Pre-specified metric, evaluation population and comparison, with uncertainty reported
The validity boundary	Where the approval holds — and the defeats that would invalidate it

Evidence states: absent · supplied · checked · challenged · accepted for a defined claim. Possession of a document is not assurance.

Risk classification that does not average away harm

Internal tier	Typical decision boundary	Minimum governance response
Restricted	Prohibited use or uncontrolled severe consequence	Decline use or redesign the boundary
High	Serious harm, consequential personal decisions or material autonomous action	Domain review, independent validation, tested containment and explicit acceptance
Moderate	Reversible operational influence within bounded authority	Documented evaluation, owner, monitoring and change control
Limited	Public-information drafting with no external action	Approved tool, user guidance and ordinary information controls

Use escalation rules before scores. These tiers are the author’s internal proposal, not the EU categories, and an internal low-risk label cannot exempt a system from applicable law.

The board’s questions

Which systems can materially affect people, money, assets or obligations? What evidence supports their use? Which controls failed during the period? Which risk decisions require board authority? And where does management lack visibility? Report counts with their denominators.

The first ninety days

Period	What it establishes
Days 1–30	The boundary: a written mandate, accountable executive and operational stop authority; consequential uses discovered first; one or two deployments walked through; tiers, escalation rules, approval roles and a short intake route
Days 31–60	Evidence and controls: evidence contracts, evaluation protocols, release records and change classes, review capacity, fallback and containment, vendor decisions, a containment drill
Days 61–90	Release narrowly and inspect: evaluations against pre-specified rules; approve, restrict or decline; the first management and board report with exceptions and evidence gaps; independent assurance walks through one outcome and one control

The ninety-day review asks whether the organisation can identify its consequential uses, reconstruct an approval, show operating controls, contain a failure and report a limitation honestly.

The 20 sessions and the plan they build

#	Session	Plan section
1	The Decision That Requires Governance	Section 1 — The AI decision our company faces, the claim, the permission sought and the counterfactual.
2	Accountability and Executive Authority	Section 2 — Who owns, approves, accepts risk and can stop the system.
3	An Evidence Contract for Every Deployment	Section 3 — The evidence contract: falsifiable claims, evidence states and release controls.
4	Value Without Exaggerated Promises, and Risk Classification	Section 4 — The incremental value case and the risk classification, with escalation rules.
5	Map Obligations, and Standards as Evidence Architecture	Section 5 — Our obligation map and the assurance crosswalk we will actually evidence.
6	Inventory, Data and Lifecycle Control	Section 6 — Our AI inventory, data provenance and change triggers.
7	The Target, the Metrics and the Cost of Error	Section 7 — The target definition and the cost of each kind of error for our system.
8	Statistical Uncertainty and Calibration	Section 8 — How uncertain our evidence is and how uncertainty enters the workflow.
9	Distribution Shift and Fairness	Section 9 — Our revalidation triggers, safe degradation and fairness trade-off.
10	Explanation, Causation and the Claim of Business Improvement	Section 10 — What would prove our claimed business improvement, and what would not.
11	Evaluate the Generative System and Control Its Knowledge	Section 11 — The task distribution, groundedness test and document-control boundary for our assistant.
12	Agents, Authority and Adversarial Security	Section 12 — The agent's enforceable authority and the security tests it must pass.
13	Privacy and the Industrial Engineering Boundary	Section 13 — Privacy controls and the advisory-versus-control boundary for any plant-facing use.
14	Human Oversight and Buying AI	Section 14 — Review capacity, contestability and the vendor evidence we will demand.
15	Monitoring, Incidents and Independent Assurance	Section 15 — Our incident response, restart rule and assurance sample.
16	A Release Decision for Predictive Maintenance	Section 16 — Our release decision written in the form of the completed case.
17	A Release Decision for a Regulatory Assistant	Section 17 — The system card and release record for our system.
18	Portfolio Control and the Board Report	Section 18 — The board pack: counts with denominators, metrics and portfolio limits.
19	Capability Maturity, the Culture of Correction and What Remains Unresolved	Section 19 — Role literacy, the acceptable use policy and the limits we will state honestly.
20	The First Ninety Days	Section 20 — The assembled, signed 90-Day AI Governance Plan with its executive summary.

ERW CommandGovernance · built on The Intelligent AI Governance — An Operating Doctrine for Responsible AI Leadership and Technical Assurance by Ritchie Wingo. Leadership training, not legal, technical-assurance or investment advice. Back to the programme home →

THE INTELLIGENT AI GOVERNANCE LEADERSHIP PROGRAMME

Separate the claim from the permission.