{
  "notice": "Illustrative mapping from the AI Governance Engineer Body of Knowledge v0.5.0 (not a claim of conformity)",
  "version": "0.5.0",
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "schemaVersion": 1,
  "schema": "https://aigovernanceengineer.com/api/v1/schemas/patterns.json",
  "self": "https://aigovernanceengineer.com/api/v1/patterns.json",
  "source": "https://aigovernanceengineer.com/patterns",
  "citation": {
    "title": "AI Governance Engineering: The Thesis & Body of Knowledge",
    "authors": [
      "Jorge García Aibar"
    ],
    "parentDoi": "https://doi.org/10.5281/zenodo.22956197",
    "conceptDoi": "https://doi.org/10.5281/zenodo.22857084"
  },
  "patterns": [
    {
      "id": "pattern-policy-card",
      "slug": "policy-card",
      "title": "Policy Card",
      "layer": 1,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 9",
        "ISO/IEC 42001",
        "NIST AI RMF (Govern)",
        "CSA AICM",
        "OWASP Agentic ASI02/ASI03"
      ],
      "url": "https://aigovernanceengineer.com/patterns/policy-card",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-policy-card",
      "obligations": [
        "AIGE-OBL-EUAIA-ART9",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-CSA-AICM",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-eval-gate-in-ci",
      "slug": "eval-gate-in-ci",
      "title": "Eval Gate in CI",
      "layer": 3,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 15, Art. 55",
        "ISO/IEC 42001",
        "NIST AI RMF (Measure)",
        "OWASP Agentic ASI01/ASI02"
      ],
      "url": "https://aigovernanceengineer.com/patterns/eval-gate-in-ci",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-eval-gate-in-ci",
      "obligations": [
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-EUAIA-ART55",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-adversarial-red-team-suite",
      "slug": "adversarial-red-team-suite",
      "title": "Adversarial Red-Team Suite",
      "layer": 3,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 9, Art. 15, Art. 55 (GPAI)",
        "ISO/IEC 42001",
        "NIST AI RMF (Measure)",
        "OWASP Agentic ASI01/ASI02"
      ],
      "url": "https://aigovernanceengineer.com/patterns/adversarial-red-team-suite",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-adversarial-red-team-suite",
      "obligations": [
        "AIGE-OBL-EUAIA-ART9",
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-EUAIA-ART55",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-agent-registry",
      "slug": "agent-registry",
      "title": "Agent Registry",
      "layer": 2,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 49/71, Art. 11",
        "ISO/IEC 42001",
        "NIST AI RMF (Map)",
        "CSA AICM",
        "OWASP Agentic ASI10"
      ],
      "url": "https://aigovernanceengineer.com/patterns/agent-registry",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-agent-registry",
      "obligations": [
        "AIGE-OBL-EUAIA-ART11",
        "AIGE-OBL-EUAIA-ART49-71",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-CSA-AICM",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-aibom",
      "slug": "aibom",
      "title": "AIBOM",
      "layer": 2,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 11, Art. 53 (GPAI documentation)",
        "ISO/IEC 42001",
        "NIST AI RMF (Map)",
        "CSA AICM"
      ],
      "url": "https://aigovernanceengineer.com/patterns/aibom",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-aibom",
      "obligations": [
        "AIGE-OBL-EUAIA-ART11",
        "AIGE-OBL-EUAIA-ART53",
        "AIGE-OBL-EUAIA-ART53-1C",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-CSA-AICM"
      ]
    },
    {
      "id": "pattern-model-card-as-control-evidence",
      "slug": "model-card-as-control-evidence",
      "title": "Model Card as Control Evidence",
      "layer": 2,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 11, Art. 13 (transparency)",
        "ISO/IEC 42001, ISO/IEC 42005",
        "NIST AI RMF (Map, Measure)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/model-card-as-control-evidence",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-model-card-as-control-evidence",
      "obligations": [
        "AIGE-OBL-EUAIA-ART11",
        "AIGE-OBL-EUAIA-ART13",
        "AIGE-OBL-ISO42005-IA",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-NISTRMF-MEASURE"
      ]
    },
    {
      "id": "pattern-continuous-assurance-telemetry",
      "slug": "continuous-assurance-telemetry",
      "title": "Continuous Assurance Telemetry",
      "layer": 5,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 72",
        "ISO/IEC 42001",
        "NIST AI RMF (Manage, Govern)",
        "CSA AICM"
      ],
      "url": "https://aigovernanceengineer.com/patterns/continuous-assurance-telemetry",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-continuous-assurance-telemetry",
      "obligations": [
        "AIGE-OBL-EUAIA-ART72",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-CSA-AICM"
      ]
    },
    {
      "id": "pattern-runtime-guardrail",
      "slug": "runtime-guardrail",
      "title": "Runtime Guardrail",
      "layer": 4,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 14, Art. 15",
        "ISO/IEC 42001",
        "NIST AI RMF (Manage)",
        "OWASP Agentic ASI02/ASI03"
      ],
      "url": "https://aigovernanceengineer.com/patterns/runtime-guardrail",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-runtime-guardrail",
      "obligations": [
        "AIGE-OBL-EUAIA-ART14",
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-kill-switch--circuit-breaker",
      "slug": "kill-switch-circuit-breaker",
      "title": "Kill Switch / Circuit Breaker",
      "layer": 4,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 14, Art. 15",
        "ISO/IEC 42001",
        "NIST AI RMF (Manage)",
        "CSA AICM",
        "OWASP Agentic ASI02/ASI10"
      ],
      "url": "https://aigovernanceengineer.com/patterns/kill-switch-circuit-breaker",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-kill-switch--circuit-breaker",
      "obligations": [
        "AIGE-OBL-EUAIA-ART14",
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-CSA-AICM",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-incident-pipeline",
      "slug": "incident-pipeline",
      "title": "Incident Pipeline",
      "layer": 5,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 72, Art. 73, Art. 55 (GPAI)",
        "ISO/IEC 42001",
        "NIST AI RMF (Manage)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/incident-pipeline",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-incident-pipeline",
      "obligations": [
        "AIGE-OBL-EUAIA-ART55",
        "AIGE-OBL-EUAIA-ART72",
        "AIGE-OBL-EUAIA-ART73",
        "AIGE-OBL-EUAIA-ART73-6",
        "AIGE-OBL-NISTRMF-MANAGE"
      ]
    },
    {
      "id": "pattern-fria-as-code",
      "slug": "fria-as-code",
      "title": "FRIA-as-Code",
      "layer": 1,
      "secondaryLayer": 2,
      "mapsTo": [
        "EU AI Act Art. 27 (FRIA), Art. 9",
        "GDPR Art. 35 (DPIA)",
        "ISO/IEC 42005",
        "NIST AI RMF (Map)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/fria-as-code",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-fria-as-code",
      "obligations": [
        "AIGE-OBL-EUAIA-ART9",
        "AIGE-OBL-EUAIA-ART27",
        "AIGE-OBL-GDPR-ART35-36",
        "AIGE-OBL-ISO42005-IA",
        "AIGE-OBL-NISTRMF-MAP"
      ]
    },
    {
      "id": "pattern-framework-crosswalk",
      "slug": "framework-crosswalk",
      "title": "Framework Crosswalk",
      "layer": 1,
      "secondaryLayer": 5,
      "mapsTo": [
        "EU AI Act (cross-cutting)",
        "ISO/IEC 42001",
        "NIST AI RMF (Govern)",
        "CSA AICM",
        "OWASP Agent Control Standard"
      ],
      "url": "https://aigovernanceengineer.com/patterns/framework-crosswalk",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-framework-crosswalk",
      "obligations": [
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-CSA-AICM",
        "AIGE-OBL-OWASP-ACS"
      ]
    },
    {
      "id": "pattern-machine-readable-evidence-oscal",
      "slug": "machine-readable-evidence-oscal",
      "title": "Machine-Readable Evidence (OSCAL)",
      "layer": 5,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 12, Art. 17, Art. 72",
        "ISO/IEC 42001",
        "NIST AI RMF (Manage, Govern)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/machine-readable-evidence-oscal",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-machine-readable-evidence-oscal",
      "obligations": [
        "AIGE-OBL-EUAIA-ART12",
        "AIGE-OBL-EUAIA-ART17",
        "AIGE-OBL-EUAIA-ART17-1M",
        "AIGE-OBL-EUAIA-ART72",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MANAGE"
      ]
    },
    {
      "id": "pattern-agent-identity--scoped-credentials",
      "slug": "agent-identity-scoped-credentials",
      "title": "Agent Identity & Scoped Credentials",
      "layer": 4,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 12, Art. 14, Art. 15",
        "ISO/IEC 42001",
        "NIST AI RMF (Manage)",
        "CSA AICM",
        "OWASP Agentic ASI03"
      ],
      "url": "https://aigovernanceengineer.com/patterns/agent-identity-scoped-credentials",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-agent-identity--scoped-credentials",
      "obligations": [
        "AIGE-OBL-EUAIA-ART12",
        "AIGE-OBL-EUAIA-ART14",
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-CSA-AICM",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-human-in-the-loop-gate",
      "slug": "human-in-the-loop-gate",
      "title": "Human-in-the-loop Gate",
      "layer": 4,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 14",
        "ISO/IEC 42001",
        "NIST AI RMF (Manage)",
        "OWASP Agentic ASI02"
      ],
      "url": "https://aigovernanceengineer.com/patterns/human-in-the-loop-gate",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-human-in-the-loop-gate",
      "obligations": [
        "AIGE-OBL-EUAIA-ART14",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-shadow-ai-discovery",
      "slug": "shadow-ai-discovery",
      "title": "Shadow-AI Discovery",
      "layer": 2,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 49/71",
        "ISO/IEC 42001",
        "NIST AI RMF (Map)",
        "CSA AICM",
        "OWASP Agentic ASI10"
      ],
      "url": "https://aigovernanceengineer.com/patterns/shadow-ai-discovery",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-shadow-ai-discovery",
      "obligations": [
        "AIGE-OBL-EUAIA-ART49-71",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-CSA-AICM",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    },
    {
      "id": "pattern-vendor--model-due-diligence-gate",
      "slug": "vendor-model-due-diligence-gate",
      "title": "Vendor / Model Due-Diligence Gate",
      "layer": 2,
      "secondaryLayer": 5,
      "mapsTo": [
        "EU AI Act Art. 25 (value-chain responsibilities), Art. 26 (deployer duties), Art. 27 (FRIA), Art. 53 (GPAI documentation)",
        "ISO/IEC 42001 Annex A.10",
        "GPAI Code of Practice",
        "NIST AI RMF (Map, Govern)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/vendor-model-due-diligence-gate",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-vendor--model-due-diligence-gate",
      "obligations": [
        "AIGE-OBL-EUAIA-ART25",
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-EUAIA-ART27",
        "AIGE-OBL-EUAIA-ART53",
        "AIGE-OBL-EUAIA-ART53-1C",
        "AIGE-OBL-ISO42001-A10",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MAP"
      ]
    },
    {
      "id": "pattern-use-case-intake--risk-tiering",
      "slug": "use-case-intake-risk-tiering",
      "title": "Use-Case Intake & Risk Tiering",
      "layer": 1,
      "secondaryLayer": 2,
      "mapsTo": [
        "EU AI Act Art. 3(12), Art. 5, Art. 6(3)–(4), Art. 49(2), Annex III",
        "ISO/IEC 42001 A.5.2, A.9.4",
        "NIST AI RMF (Govern 1.3, 1.6; Map 1.1, 1.5, 5.1)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/use-case-intake-risk-tiering",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-use-case-intake--risk-tiering",
      "obligations": [
        "AIGE-OBL-EUAIA-ART3-1",
        "AIGE-OBL-EUAIA-ART5",
        "AIGE-OBL-EUAIA-ART6",
        "AIGE-OBL-EUAIA-ART6-3",
        "AIGE-OBL-EUAIA-ART49-71",
        "AIGE-OBL-ISO42001-A5",
        "AIGE-OBL-ISO42001-A9",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MAP"
      ]
    },
    {
      "id": "pattern-ai-threat-model",
      "slug": "ai-threat-model",
      "title": "AI Threat Model",
      "layer": 1,
      "secondaryLayer": 3,
      "mapsTo": [
        "EU AI Act Art. 15(5), Art. 55(1)(d)",
        "ISO/IEC 42001 A.6.2.2, A.6.2.4",
        "NIST AI RMF (Map 5.1; Measure 2.7)",
        "OWASP LLM01:2026, LLM05:2026",
        "OWASP Agentic ASI02/ASI03/ASI04",
        "MITRE ATLAS"
      ],
      "url": "https://aigovernanceengineer.com/patterns/ai-threat-model",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-ai-threat-model",
      "obligations": [
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-EUAIA-ART55",
        "AIGE-OBL-ISO42001-A6",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-OWASP-AGENTIC",
        "AIGE-OBL-OWASP-LLM"
      ]
    },
    {
      "id": "pattern-training-data-rights-ledger",
      "slug": "training-data-rights-ledger",
      "title": "Training-Data Rights Ledger",
      "layer": 2,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 10(2)(b), Art. 53(1)(c)–(d)",
        "Directive (EU) 2019/790 Art. 4(3)",
        "GDPR Art. 5(1)(b), Art. 6(4)",
        "ISO/IEC 42001 A.7.3, A.7.5",
        "NIST AI RMF (Govern 6.1; Map 4.1)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/training-data-rights-ledger",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-training-data-rights-ledger",
      "obligations": [
        "AIGE-OBL-EUAIA-ART10",
        "AIGE-OBL-EUAIA-ART53",
        "AIGE-OBL-EUAIA-ART53-1C",
        "AIGE-OBL-GDPR-ART5-1B",
        "AIGE-OBL-DSM-ART4-3",
        "AIGE-OBL-ISO42001-A7",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MAP"
      ]
    },
    {
      "id": "pattern-dataset-admission-gate",
      "slug": "dataset-admission-gate",
      "title": "Dataset Admission Gate",
      "layer": 1,
      "secondaryLayer": 2,
      "mapsTo": [
        "EU AI Act Art. 10(2)–(4), Art. 4a",
        "GDPR Art. 5(1)(b), Art. 6(4)",
        "ISO/IEC 42001 A.7.2, A.7.4, A.7.5, A.7.6",
        "NIST AI RMF (Map 2.3, 4.1)",
        "OWASP LLM05:2026"
      ],
      "url": "https://aigovernanceengineer.com/patterns/dataset-admission-gate",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-dataset-admission-gate",
      "obligations": [
        "AIGE-OBL-EUAIA-ART4A",
        "AIGE-OBL-EUAIA-ART10",
        "AIGE-OBL-GDPR-ART5-1B",
        "AIGE-OBL-ISO42001-A7",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-OWASP-LLM"
      ]
    },
    {
      "id": "pattern-fairness-eval-suite",
      "slug": "fairness-eval-suite",
      "title": "Fairness Eval Suite",
      "layer": 3,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 10(2)(f)–(g), Art. 13(3)(b)(v), Art. 15(4), Art. 4a",
        "NYC Local Law 144",
        "29 CFR 1607.4(D)",
        "ISO/IEC 42001 A.5.4, A.6.2.4",
        "ISO/IEC TR 24027",
        "NIST AI RMF (Measure 2.11)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/fairness-eval-suite",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-fairness-eval-suite",
      "obligations": [
        "AIGE-OBL-EUAIA-ART4A",
        "AIGE-OBL-EUAIA-ART10",
        "AIGE-OBL-EUAIA-ART13",
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-ISO42001-A5",
        "AIGE-OBL-ISO42001-A6",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-USNYC-LL144",
        "AIGE-OBL-USFED-TITLE7-703K"
      ]
    },
    {
      "id": "pattern-explanation-artefact",
      "slug": "explanation-artefact",
      "title": "Explanation Artefact",
      "layer": 4,
      "secondaryLayer": 5,
      "mapsTo": [
        "EU AI Act Art. 86, Art. 26(11), Art. 13(3)(b)(iv)",
        "GDPR Art. 15(1)(h), Art. 22",
        "Regulation B (12 CFR 1002.9)",
        "ISO/IEC 42001 A.8.2",
        "NIST AI RMF (Measure 2.8, 2.9)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/explanation-artefact",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-explanation-artefact",
      "obligations": [
        "AIGE-OBL-EUAIA-ART13",
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-EUAIA-ART86",
        "AIGE-OBL-GDPR-ART15-1H",
        "AIGE-OBL-GDPR-ART22",
        "AIGE-OBL-ISO42001-A8",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-USFED-REGB-1002-9"
      ]
    },
    {
      "id": "pattern-model-artefact-integrity",
      "slug": "model-artefact-integrity",
      "title": "Model Artefact Integrity",
      "layer": 2,
      "secondaryLayer": 4,
      "mapsTo": [
        "EU AI Act Art. 15(5), Art. 55(1)(d)",
        "ISO/IEC 42001 A.6.2.5, A.10.3",
        "NIST AI RMF (Govern 6.1; Manage 3.2; Measure 2.7)",
        "OWASP LLM04:2026",
        "OWASP Agentic ASI04",
        "MITRE ATLAS"
      ],
      "url": "https://aigovernanceengineer.com/patterns/model-artefact-integrity",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-model-artefact-integrity",
      "obligations": [
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-EUAIA-ART55",
        "AIGE-OBL-ISO42001-A6",
        "AIGE-OBL-ISO42001-A10",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-OWASP-AGENTIC",
        "AIGE-OBL-OWASP-LLM"
      ]
    },
    {
      "id": "pattern-claims-substantiation-gate",
      "slug": "claims-substantiation-gate",
      "title": "Claims Substantiation Gate",
      "layer": 5,
      "secondaryLayer": 3,
      "mapsTo": [
        "EU AI Act Art. 3(12), Art. 13(3)(b)(ii), Art. 15(3)",
        "FTC Act s. 5",
        "Directive 2005/29/EC Art. 5",
        "DMCC Act 2024 s. 225",
        "ISO/IEC 42001 A.8.2, A.8.5",
        "NIST AI RMF (Measure 2.3, 2.5)"
      ],
      "url": "https://aigovernanceengineer.com/patterns/claims-substantiation-gate",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-claims-substantiation-gate",
      "obligations": [
        "AIGE-OBL-EUAIA-ART3-1",
        "AIGE-OBL-EUAIA-ART13",
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-UCPD-ART5-7",
        "AIGE-OBL-ISO42001-A8",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-USFED-FTC-S5",
        "AIGE-OBL-UK-DMCC-S225"
      ]
    },
    {
      "id": "pattern-decision-notice--contest-path",
      "slug": "decision-notice-contest-path",
      "title": "Decision Notice & Contest Path",
      "layer": 4,
      "secondaryLayer": 5,
      "mapsTo": [
        "EU AI Act Art. 26(11), Art. 86",
        "GDPR Art. 13(2)(f), Art. 15(1)(h), Art. 22",
        "UK GDPR Arts. 22A–22D",
        "ECOA / Regulation B 12 CFR 1002.9",
        "ISO/IEC 42001 A.8.2, A.9.2",
        "NIST AI RMF MEASURE 3.3, MANAGE 4.1, MAP 3.5"
      ],
      "url": "https://aigovernanceengineer.com/patterns/decision-notice-contest-path",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-decision-notice--contest-path",
      "obligations": [
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-EUAIA-ART86",
        "AIGE-OBL-GDPR-ART13-14",
        "AIGE-OBL-GDPR-ART15-1H",
        "AIGE-OBL-GDPR-ART22",
        "AIGE-OBL-ISO42001-A8",
        "AIGE-OBL-ISO42001-A9",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-USFED-REGB-1002-9",
        "AIGE-OBL-UK-ADM"
      ]
    },
    {
      "id": "pattern-rights-requests-against-models",
      "slug": "rights-requests-against-models",
      "title": "Rights Requests Against Models",
      "layer": 2,
      "secondaryLayer": 5,
      "mapsTo": [
        "GDPR Art. 12(3), Arts. 15–17, Art. 21",
        "EU AI Act Art. 26(6)",
        "ISO/IEC 42001 A.7",
        "NIST AI RMF MEASURE 2.10, GOVERN 1.1",
        "OWASP LLM02:2026"
      ],
      "url": "https://aigovernanceengineer.com/patterns/rights-requests-against-models",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-rights-requests-against-models",
      "obligations": [
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-GDPR-ART15-17-21",
        "AIGE-OBL-ISO42001-A7",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-OWASP-LLM"
      ]
    },
    {
      "id": "pattern-sanctioned-ai-gateway",
      "slug": "sanctioned-ai-gateway",
      "title": "Sanctioned AI Gateway",
      "layer": 4,
      "secondaryLayer": 2,
      "mapsTo": [
        "EU AI Act Art. 4",
        "GDPR Art. 5(1)(c)",
        "ISO/IEC 42001 A.2, A.9.2, A.10.3",
        "NIST AI RMF GOVERN 2.2, GOVERN 6.1, MANAGE 3.1",
        "OWASP LLM02:2026"
      ],
      "url": "https://aigovernanceengineer.com/patterns/sanctioned-ai-gateway",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-sanctioned-ai-gateway",
      "obligations": [
        "AIGE-OBL-EUAIA-ART4",
        "AIGE-OBL-GDPR-ART25",
        "AIGE-OBL-ISO42001-A2",
        "AIGE-OBL-ISO42001-A9",
        "AIGE-OBL-ISO42001-A10",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-OWASP-LLM"
      ]
    },
    {
      "id": "pattern-staged-rollout-with-rollback-criteria",
      "slug": "staged-rollout-rollback-criteria",
      "title": "Staged Rollout with Rollback Criteria",
      "layer": 4,
      "secondaryLayer": null,
      "mapsTo": [
        "EU AI Act Art. 26(5), Art. 60",
        "ISO/IEC 42001 A.6.2.5, A.6.2.6",
        "NIST AI RMF MANAGE 1.1, MEASURE 2.3, MANAGE 2.4"
      ],
      "url": "https://aigovernanceengineer.com/patterns/staged-rollout-rollback-criteria",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-staged-rollout-with-rollback-criteria",
      "obligations": [
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-EUAIA-ART60",
        "AIGE-OBL-ISO42001-A6",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-NISTRMF-MANAGE"
      ]
    },
    {
      "id": "pattern-drift--fairness-monitor",
      "slug": "drift-fairness-monitor",
      "title": "Drift & Fairness Monitor",
      "layer": 4,
      "secondaryLayer": 5,
      "mapsTo": [
        "EU AI Act Art. 4a, Art. 15(4), Art. 26(5), Art. 72",
        "NYC Local Law 144",
        "ISO/IEC 42001 A.5.4, A.6.2.6",
        "NIST AI RMF MEASURE 2.4, MEASURE 2.11, MEASURE 3.1, MANAGE 4.1"
      ],
      "url": "https://aigovernanceengineer.com/patterns/drift-fairness-monitor",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-drift--fairness-monitor",
      "obligations": [
        "AIGE-OBL-EUAIA-ART4A",
        "AIGE-OBL-EUAIA-ART15",
        "AIGE-OBL-EUAIA-ART15-4",
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-EUAIA-ART72",
        "AIGE-OBL-ISO42001-A5",
        "AIGE-OBL-ISO42001-A6",
        "AIGE-OBL-NISTRMF-MEASURE",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-USNYC-LL144"
      ]
    },
    {
      "id": "pattern-downstream-use-register",
      "slug": "downstream-use-register",
      "title": "Downstream Use Register",
      "layer": 2,
      "secondaryLayer": 1,
      "mapsTo": [
        "EU AI Act Art. 3(13), Art. 9(2)(b), Art. 25(1)(c), Art. 50(2)",
        "ISO/IEC 42001 A.8.2, A.9.4, A.10.4",
        "NIST AI RMF MAP 1.1, MAP 3.3, MANAGE 1.4",
        "OWASP LLM10:2026, OWASP Agentic ASI08"
      ],
      "url": "https://aigovernanceengineer.com/patterns/downstream-use-register",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-downstream-use-register",
      "obligations": [
        "AIGE-OBL-EUAIA-ART3-1",
        "AIGE-OBL-EUAIA-ART9",
        "AIGE-OBL-EUAIA-ART25",
        "AIGE-OBL-EUAIA-ART50",
        "AIGE-OBL-ISO42001-A8",
        "AIGE-OBL-ISO42001-A9",
        "AIGE-OBL-ISO42001-A10",
        "AIGE-OBL-NISTRMF-MAP",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-OWASP-AGENTIC",
        "AIGE-OBL-OWASP-LLM"
      ]
    },
    {
      "id": "pattern-disclosure--notification-pipeline",
      "slug": "disclosure-notification-pipeline",
      "title": "Disclosure & Notification Pipeline",
      "layer": 5,
      "secondaryLayer": 2,
      "mapsTo": [
        "EU AI Act Art. 26(5), Art. 26(7), Art. 26(11), Art. 50",
        "GDPR Art. 33, Art. 34",
        "Korea AI Basic Act Art. 31",
        "ISO/IEC 42001 A.8.2, A.8.3, A.8.4, A.8.5",
        "NIST AI RMF MANAGE 4.3, GOVERN 4.2, GOVERN 5.1"
      ],
      "url": "https://aigovernanceengineer.com/patterns/disclosure-notification-pipeline",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-disclosure--notification-pipeline",
      "obligations": [
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-EUAIA-ART50",
        "AIGE-OBL-GDPR-ART33-34",
        "AIGE-OBL-ISO42001-A8",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-KR-ART31-1",
        "AIGE-OBL-KR-ART31-2"
      ]
    },
    {
      "id": "pattern-deactivation-localisation--retirement-runbook",
      "slug": "deactivation-localisation-retirement-runbook",
      "title": "Deactivation, Localisation & Retirement Runbook",
      "layer": 4,
      "secondaryLayer": 2,
      "mapsTo": [
        "EU AI Act Art. 5, Art. 18, Art. 20, Art. 26(5), Art. 26(6), Art. 79",
        "ISO/IEC 42001 A.6.2.5, A.6.2.6",
        "NIST AI RMF GOVERN 1.7, MANAGE 2.4, MANAGE 4.1",
        "OWASP Agentic ASI10"
      ],
      "url": "https://aigovernanceengineer.com/patterns/deactivation-localisation-retirement-runbook",
      "section": "https://aigovernanceengineer.com/bok/patterns#pattern-deactivation-localisation--retirement-runbook",
      "obligations": [
        "AIGE-OBL-EUAIA-ART5",
        "AIGE-OBL-EUAIA-ART18",
        "AIGE-OBL-EUAIA-ART20",
        "AIGE-OBL-EUAIA-ART26",
        "AIGE-OBL-EUAIA-ART26-2",
        "AIGE-OBL-EUAIA-ART26-4",
        "AIGE-OBL-EUAIA-ART26-5",
        "AIGE-OBL-EUAIA-ART26-6",
        "AIGE-OBL-EUAIA-ART26-7",
        "AIGE-OBL-EUAIA-ART26-11",
        "AIGE-OBL-ISO42001-A6",
        "AIGE-OBL-NISTRMF-GOVERN",
        "AIGE-OBL-NISTRMF-MANAGE",
        "AIGE-OBL-OWASP-AGENTIC"
      ]
    }
  ]
}