AI Governance Engineer
GitHub

The Body of Knowledge

Why this book exists, who it is for and how to use it: the first attempt to write down how to engineer the governance of AI systems.

Version 0.5.0: 24 chapters in five parts, from the definition to the law. Read them in order or start from the part you need. New to the field? Begin with the AI governance guide: the definition, the main frameworks and examples.

Reading minutes per chapterThe chapters of the Body of Knowledge in order, grouped by part, each bar its reading time in minutes.The discipline00 Preface: 8 min00 Preface801 Definition: 14 min01 Definition1402 Why Now: 19 min02 Why Now1903 Values & Principles: 16 min03 Values & Principles1604 The Stack: 32 min04 The Stack3205 Patterns: 17 min05 Patterns1706 The Role: 17 min06 The Role1707 Maturity Model: 14 min07 Maturity Model14Reference08 Regulatory Map: 110 min08 Regulatory Map11009 Glossary: 144 min09 Glossary14410 Reading List: 29 min10 Reading List29Foundations11 AI Defined: 50 min11 AI Defined5012 Governance Program: 44 min12 Governance Program4413 Risk Management: 43 min13 Risk Management43The lifecycle14 Development: 60 min14 Development6015 Deployment: 60 min15 Deployment6016 Fairness & XAI: 55 min16 Fairness & XAI5517 Incidents: 47 min17 Incidents4723 AI Agents: 54 min23 AI Agents54Law and standards18 EU AI Act: 45 min18 EU AI Act4519 Privacy & AI: 51 min19 Privacy & AI5120 Existing Law: 57 min20 Existing Law5721 AI Laws Worldwide: 67 min21 AI Laws Worldwide6722 Principles & Standards: 53 min22 Principles & Standards53
Reading minutes per chapterThe chapters of the Body of Knowledge in order, grouped by part, each bar its reading time in minutes.The disciplineReferenceFoundationsThe lifecycleLaw and standards00 Preface: 8 min80001 Definition: 14 min140102 Why Now: 19 min190203 Values & Principles: 16 min160304 The Stack: 32 min320405 Patterns: 17 min170506 The Role: 17 min170607 Maturity Model: 14 min140708 Regulatory Map: 110 min1100809 Glossary: 144 min1440910 Reading List: 29 min291011 AI Defined: 50 min501112 Governance Program: 44 min441213 Risk Management: 43 min431314 Development: 60 min601415 Deployment: 60 min601516 Fairness & XAI: 55 min551617 Incidents: 47 min471723 AI Agents: 54 min542318 EU AI Act: 45 min451819 Privacy & AI: 51 min511920 Existing Law: 57 min572021 AI Laws Worldwide: 67 min672122 Principles & Standards: 53 min5322
The book at a glance 24 chapters in five parts, about 1106 minutes of reading in all; each bar is one chapter's reading time. Select a bar to open the chapter.
Data table
Reading minutes per chapter
PartChapterMinutes
The discipline00 Preface8
The discipline01 Definition14
The discipline02 Why Now19
The discipline03 Values & Principles16
The discipline04 The Stack32
The discipline05 Patterns17
The discipline06 The Role17
The discipline07 Maturity Model14
Reference08 Regulatory Map110
Reference09 Glossary144
Reference10 Reading List29
Foundations11 AI Defined50
Foundations12 Governance Program44
Foundations13 Risk Management43
The lifecycle14 Development60
The lifecycle15 Deployment60
The lifecycle16 Fairness & XAI55
The lifecycle17 Incidents47
The lifecycle23 AI Agents54
Law and standards18 EU AI Act45
Law and standards19 Privacy & AI51
Law and standards20 Existing Law57
Law and standards21 AI Laws Worldwide67
Law and standards22 Principles & Standards53

The discipline

Chapters 00–07

What AI governance engineering is, why it is forming now, and how it is built, staffed and measured.

  1. 00 8 min Preface Why this book exists, who it is for and how to use it: the first attempt to write down how to engineer the governance of AI systems.
  2. 01 14 min Definition AI governance engineering is the application of engineering practice (systems thinking, product thinking and code) to the governance of AI systems.
  3. 02 19 min Why Now AI governance engineering is forming now: the object changed shape, the market began hiring for engineering and the law began asking for engineered evidence.
  4. 03 16 min Values & Principles The eight values and six principles of the Thesis, each expanded with what it means in practice and the anti-pattern it rejects.
  5. 04 32 min The Stack The reference architecture: five layers that answer the three questions, where evidence is produced at the bottom and proven at the top.
  6. 05 17 min Patterns A catalogue of reusable AI governance engineering patterns, each named to a layer of the stack, in the CSIRO Responsible AI Pattern Catalogue structure.
  7. 06 17 min The Role The AI governance engineer as a concrete role, defined by the workflows it owns and the evidence it produces, not by the certifications on its holder.
  8. 07 14 min Maturity Model A ladder from paper to production (Documented, Inventoried, Tested, Enforced, Continuous), where each level is proven by what the running systems show.

Reference

Chapters 08–10

The indexes the rest of the book points into: the regulatory map, the glossary and the reading list.

  1. 08 110 min Regulatory Map The reverse index of every "Maps to" line in the book: for each obligation, the engineering artefact that satisfies or supports it and its stack layer.
  2. 09 144 min Glossary The canonical definitions for the book: every term defined once, alphabetically, and cross-referenced to the chapter that treats it in full.
  3. 10 29 min Reading List The sources that formed the discipline, curated and annotated, each with a verified URL and a one-line note on why it matters.

Foundations

Chapters 11–13

What counts as an AI system, how an organisation runs its governance program and where risk management sits.

  1. 11 50 min AI Defined What an AI system is for governance: the definitions that set scope, the kinds of AI and the traits that break classic governance, each tied to a control.
  2. 12 44 min Governance Program An AI governance program is the organisation governed as a system: people hold duties, a committee decides what gates cannot, and policies compile into gates.
  3. 13 43 min Risk Management Risk management is the loop that tells every other control how hard to bite: identify, assess, treat, monitor, with the risk register as its evidence.

The lifecycle

Chapters 14–17, 23

Governing a system from use case to retirement: development, deployment, fairness, incidents and agents.

  1. 14 60 min Development Development is governed when every build decision, from use case to release, leaves a record a gate reads, so the pipeline compiles the technical file.
  2. 15 60 min Deployment Governing the run: deciding to use an AI system, choosing, contracting, going live, operating and retiring it, each step leaving evidence a control fired.
  3. 16 55 min Fairness & XAI Fairness and explainability become controls only when measured, gated and filed as evidence; this chapter maps each technique to its stack layer and legal hook.
  4. 17 47 min Incidents AI incident management turns a runtime signal into a classified, contained, reported and explained event, with its cause fed back into the controls.
  5. 23 54 min AI Agents Governing AI agents: registry, identity and short-lived credentials, tool permissions, human checkpoints, guardrails, kill switches, memory and delegation.

Law and standards

Chapters 18–22

The EU AI Act, data protection, the law that already applies, AI laws worldwide, and the principles and standards.

  1. 18 45 min EU AI Act The EU AI Act as amended by the Digital Omnibus, read end to end: scope, risk ladder, roles, duties and the date each duty applies.
  2. 19 51 min Privacy & AI Data protection law already binds every AI system that touches personal data; this chapter turns its duties into artefacts, stack layers and evidence.
  3. 20 57 min Existing Law Copyright, anti-discrimination, consumer-protection and product-liability law already bind AI systems; each duty maps to an evidence artefact and a stack layer.
  4. 21 67 min AI Laws Worldwide AI-specific law outside the EU, from Korea's Basic Act to US state statutes and voluntary frameworks, dated and mapped to the artefacts that evidence it.
  5. 22 53 min Principles & Standards Principles say what good looks like and standards say how to show it; this chapter maps each instrument to the stack layer and evidence that answer it.

Building this month

stop shipping documents, start shipping controls

  1. 04 The Stack
  2. 05 Patterns
  3. 14 Development
  4. 15 Deployment
  5. 17 Incidents

Assuring & advising

extend the threat model to models and agents

  1. 13 Risk Management
  2. 16 Fairness & XAI
  3. 18 EU AI Act
  4. 08 Regulatory Map
  5. 07 Maturity Model

New to the discipline

the founding text, in order

  1. 00 Preface
  2. 01 Definition
  3. 11 AI Defined
  4. 12 Governance Program
  5. 06 The Role
  6. → The learning path
Reading paths Three routes through the Body of Knowledge, one per reader, each reaching into the foundations, the lifecycle and the law. Pick your column and start at its first node. Drawn from chapter 00.