GAO AI Accountability Framework principle 1: governance
Clear goals, roles and delegation of authority, values, a multidisciplinary workforce, stakeholder involvement and an AI-specific risk management plan, plus documented technical specifications, compliance with applicable law and transparency to external stakeholders
AIGE-OBL-USGAO-GOV. Drawn from chapter 08.
Text alternative
- Clause: GAO AI Accountability, principle 1, practices 1.1….
- Duty holder: Federal agencies and other….
- Applies from: 2021-06-30, Voluntary.
- Artefact: Registry entry with owner….
- Layers: Layer 01, Layer 02, Layer 05.
- Evidence record: Evidence record v1.
- Record schema: Evidence record.
- The same topic in 26 other frameworks; the crosswalk section below links each clause.
Data table: the dates
| Date | Step | Detail |
|---|---|---|
| 2021-06-30 | Voluntary | Non-binding audit framework; published 2021-06-30 |
- Id
AIGE-OBL-USGAO-GOV- Instrument
- GAO AI Accountability Framework (GAO-21-519SP) framework
- Clause
- principle 1 (governance), practices 1.1 to 1.9
- In scope
- Federal agencies and other entities; auditors and third-party assessors
- Authority
- U.S. Government Accountability Office; inspectors general
- Applies from
- Voluntary · Non-binding audit framework; published 2021-06-30
The artefact that evidences it
Registry entry with owner and intended purpose; RACI; risk register as code; compliance mapping; published system card.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Same crosswalk topic | AI Verify 4.3.1, 4.7.1, 4.2.1, 9.1.1, 9.5.2, 11.2.1, 1.1.6, 1.7.2, 1.1.1, 9.5.3, 5.1.1, 8.4.1 | Core clause |
| Same crosswalk topic | CSA AICM GRC-02, MDS-12, GRC-01, GRC-06, GRC-10, DSP-09, MDS-03, MDS-04, HRS-14, HRS-11, A&A-02, A&A-04 | Core clause |
| Same crosswalk topic | China AI Labelling Label Art. 4, Label Art. 5 | Core clause |
| Same crosswalk topic | China Algo. Rec. AlgoRec Art. 27, AlgoRec Art. 7, AlgoRec Art. 16 | Core clause |
| Same crosswalk topic | China Deep Synthesis DeepSyn Art. 7, DeepSyn Art. 16, DeepSyn Art. 17 | Core clause |
| Same crosswalk topic | China GenAI Measures GenAI Art. 17, GenAI Art. 9, GenAI Art. 12, GenAI Art. 19, GenAI Art. 10 | Core clause |
| Same crosswalk topic | CoE Convention CoE Art. 16, CoE Art. 9, CoE Art. 14(2), CoE Art. 15(2) | Core clause |
| Same crosswalk topic | EU AI Act Art. 9, Art. 3, Art. 17, Art. 4, Art. 87, Art. 27, Art. 11, Art. 13, Art. 53, Art. 50, Art. 86, Art. 18, Art. 43, Art. 53(1)(d), Art. 50(2), 50(4), Art. 26(2), Art. 95(2)(c), Art. 47, Art. 48, Art. 40 | Core clause |
| Same crosswalk topic | G7 Code G7 Action 5, G7 Action 3 | Core clause |
| Same crosswalk topic | GAO AI Accountability 3.5 | Core clause |
| Same crosswalk topic | GDPR Art. 5(2), Art. 35, Art. 36, Arts. 13–14, Art. 30, Art. 39(1)(b), Art. 42 | Core clause |
| Same crosswalk topic | GPAI Code Safety C1, Safety C3, Safety C8, Transparency 1.1, Transparency 1.2 | Core clause |
| Same crosswalk topic | ISO 23894 23894 6.4, 23894 6.5, 23894 6.6 | Core clause |
| Same crosswalk topic | ISO 42001 6.1.2, 6.1.3, 8.2, 8.3, A.6, 6.1.4, 5.1, 5.2, 5.3, A.2, A.3, 9.3, 7.2, 9.2, 10.1, 8.4, A.5, 7.5, A.8, 7.3 | Core clause |
| Same crosswalk topic | ISO 42005 42005 5.8, 42005 6.8, 42005 5.12 | Core clause |
| Same crosswalk topic | ISO 42006 ISO/IEC 42006 | Core clause |
| Same crosswalk topic | Korea AI Act Art. 34(1)(1), Art. 36, Art. 35, Art. 31, Art. 34(1)(2), Art. 33 | Core clause |
| Same crosswalk topic | NIST AI RMF MAP 1, MAP 5, MANAGE 1, GOVERN 1.3, MAP 1.5, MANAGE 1.3, MANAGE 1.4, MEASURE 3, MEASURE 2, GOVERN 1, GOVERN 2, GOVERN 4, GOVERN 5, MAP 3, MEASURE 2.8, MAP 1.6, MEASURE 2.9, GOVERN 2.2, MAP 3.4, MEASURE 1.3 | Core clause |
| Same crosswalk topic | OECD AI Principles OECD 1.5(c), OECD 1.5, OECD 1.3 | Core clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.1, Agentic 2.2.1, Agentic 2.4 | Core clause |
| Same crosswalk topic | Singapore GenAI GenAI 1, GenAI 3, GenAI 9, GenAI 5 | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 2, TC260 Summary table, TC260 5.3.19, TC260 4, TC260 5.3.12, TC260 Appendix 1, TC260 2.2 | Core clause |
| Same crosswalk topic | UK ATRS ATRS 2.5.2, ATRS 2.1, ATRS 2.5.1, ATRS Tier 1, ATRS 2.2, ATRS 2.3.4 | Core clause |
| Same crosswalk topic | prEN 18228 prEN 18228 | Core clause |
| Same crosswalk topic | EN 18286 EN 18286 | Related clause |
| Same crosswalk topic | GB/T 45654 GB/T 45654 Content labelling | Related clause |
Patterns that build it
No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Risk management
- EU AI Act Art. 9 Risk management system (core)
- ISO 42001 6.1.2 AI risk assessment (core)
- ISO 42001 6.1.3 AI risk treatment (core)
- ISO 42001 8.2 AI risk assessment (operation) (core)
- ISO 42001 8.3 AI risk treatment (operation) (core)
- NIST AI RMF MAP 1 MAP 1: Context is established and understood (core)
- NIST AI RMF MAP 5 MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized (core)
- NIST AI RMF MANAGE 1 MANAGE 1: AI risks based on assessments and other analytical output are prioritized, responded to, and managed (core)
- TC260 Framework 3.0 TC260 2 Classification of AI safety risks (core)
- TC260 Framework 3.0 TC260 Summary table Risks × technological × governance measures (core)
- ISO 23894 23894 6.4 Risk assessment (core) (clause not verified)
- ISO 23894 23894 6.5 Risk treatment (core) (clause not verified)
- NIST AI RMF GOVERN 1.3 GOVERN 1.3: Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance (core)
- NIST AI RMF MAP 1.5 MAP 1.5: Organizational risk tolerances are determined and documented (core)
- NIST AI RMF MANAGE 1.3 MANAGE 1.3: Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented (core)
- NIST AI RMF MANAGE 1.4 MANAGE 1.4: Negative residual risks to both downstream acquirers of AI systems and end users are documented (core)
- NIST AI RMF MEASURE 3 MEASURE 3: Mechanisms for tracking identified AI risks over time are in place (core)
- CSA AICM GRC-02 Risk Management Program (core)
- Korea AI Act Art. 34(1)(1) Risk management plan for high-impact AI (core)
- UK ATRS ATRS 2.5.2 Risks and mitigations (core)
- Singapore Agentic Agentic 2.1 Assess and bound the risks upfront (core)
- CoE Convention CoE Art. 16 Risk and impact management framework (core)
- prEN 18228 prEN 18228 AI risk management (draft; supports Art. 9) (core) (clause not verified)
- AI Verify 4.3.1 Safety: assess risks, risk metrics and risk levels of the AI system in each specific use case (core)
- AI Verify 4.7.1 Safety: identify and track residual risk that cannot be measured or mitigated, and assess the organisation's tolerance for it (core)
- ISO 42001 A.6 AI system life cycle
- NIST AI RMF MEASURE 2 MEASURE 2: AI systems are evaluated for trustworthy characteristics
- TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
- China GenAI Measures GenAI Art. 17 Security assessment and algorithm filing
- China Algo. Rec. AlgoRec Art. 27 Security assessment
- EU AI Act Art. 3 Definitions
- ISO 42001 6.1.4 AI system impact assessment
- ISO 23894 23894 6.6 Monitoring and review (clause not verified)
- GPAI Code Safety C1 Commitment 1: Safety and Security Framework
- GPAI Code Safety C3 Commitment 3: Systemic risk analysis
- CSA AICM MDS-12 Open Model Risk Assessment
- OECD AI Principles OECD 1.5(c) Systematic risk management at each lifecycle phase
- AI Verify 4.2.1 Safety: carry out an assessment of materiality on key stakeholders, highlighting the risks of the proposed AI solution
Governance and accountability
- EU AI Act Art. 17 Quality management system (core)
- ISO 42001 5.1 Leadership and commitment (core)
- ISO 42001 5.2 AI policy (core)
- ISO 42001 5.3 Roles, responsibilities and authorities (core)
- ISO 42001 A.2 Policies related to AI (core)
- ISO 42001 A.3 Internal organization (core)
- NIST AI RMF GOVERN 1 GOVERN 1: Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively (core)
- NIST AI RMF GOVERN 2 GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained (core)
- TC260 Framework 3.0 TC260 4 Comprehensive governance measures (core)
- TC260 Framework 3.0 TC260 5.3.12 Traceable chain of responsibility (core)
- China GenAI Measures GenAI Art. 9 Provider responsibility as content producer (core)
- China Algo. Rec. AlgoRec Art. 7 Algorithm-security responsibility system (core)
- China Deep Synthesis DeepSyn Art. 7 Information-security responsibility system (core)
- GDPR Art. 5(2) Accountability (core)
- ISO 42001 9.3 Management review (core) (clause not verified)
- CSA AICM GRC-01 Governance Program Policy and Procedures (core)
- CSA AICM GRC-06 Governance Responsibility Model (core)
- UK ATRS ATRS 2.1 Owner and responsibility (core)
- Singapore GenAI GenAI 1 Accountability (core)
- Singapore Agentic Agentic 2.2.1 Clear allocation of responsibilities within and outside the organisation (core)
- OECD AI Principles OECD 1.5 Accountability (core)
- AI Verify 9.1.1 Accountability: establish policies on the development and use of AI aligned with other organisational policies (core)
- AI Verify 9.5.2 Accountability: clear internal governance mechanisms and roles, including a cross-departmental AI governance committee (core)
- EU AI Act Art. 4 AI literacy
- EU AI Act Art. 87 Reporting of infringements and protection of reporting persons
- ISO 42001 7.2 Competence (clause not verified)
- ISO 42001 9.2 Internal audit (clause not verified)
- ISO 42001 10.1 Continual improvement (clause not verified)
- NIST AI RMF GOVERN 4 GOVERN 4: Organizational teams are committed to a culture that considers and communicates AI risk
- NIST AI RMF GOVERN 5 GOVERN 5: Processes are in place for robust engagement with relevant AI actors
- GPAI Code Safety C8 Commitment 8: Systemic risk responsibility allocation
- Korea AI Act Art. 36 Domestic representative
- CoE Convention CoE Art. 9 Accountability and responsibility
- G7 Code G7 Action 5 Develop, implement and disclose AI governance and risk-management policies
- EN 18286 EN 18286 Quality management system for EU AI Act regulatory purposes
Impact assessment
- EU AI Act Art. 27 Fundamental rights impact assessment for high-risk AI systems (core)
- ISO 42001 6.1.4 AI system impact assessment (core)
- ISO 42001 8.4 AI system impact assessment (operation) (core)
- ISO 42001 A.5 Assessing impacts of AI systems (core)
- NIST AI RMF MAP 3 MAP 3: AI capabilities, targeted usage, goals, and expected benefits and costs are understood (core)
- NIST AI RMF MAP 5 MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized (core)
- TC260 Framework 3.0 TC260 Appendix 1 Grading principles (core)
- China GenAI Measures GenAI Art. 17 Security assessment (core)
- GDPR Art. 35 Data protection impact assessment (core)
- ISO 42005 42005 5.8 Performing the AI system impact assessment (core) (clause not verified)
- ISO 42005 42005 6.8 Actual and reasonably foreseeable impacts (core) (clause not verified)
- CSA AICM GRC-10 AI Impact Assessment (core)
- Korea AI Act Art. 35 Impact assessment (best-effort duty) (core)
- UK ATRS ATRS 2.5.1 Impact assessments (core)
- AI Verify 11.2.1 Inclusive growth, societal and environmental well-being: assess the impact of the AI system on individuals and society (core)
- EU AI Act Art. 9 Risk management system
- TC260 Framework 3.0 TC260 2.2 Safety risks in the application of AI
- GDPR Art. 36 Prior consultation
- ISO 42005 42005 5.12 Monitoring and review (clause not verified)
- CSA AICM DSP-09 Data Protection Impact Assessment
- CoE Convention CoE Art. 16 Risk and impact management framework
- AI Verify 4.2.1 Safety: carry out an assessment of materiality on key stakeholders
Documentation and transparency
- EU AI Act Art. 11 Technical documentation (core)
- EU AI Act Art. 13 Transparency and provision of information to deployers (core)
- EU AI Act Art. 53 Obligations for providers of general-purpose AI models (core)
- ISO 42001 7.5 Documented information (core)
- ISO 42001 A.6 AI system life cycle (core)
- ISO 42001 A.8 Information for interested parties (core)
- China AI Labelling Label Art. 4 Explicit labels for generated content (core)
- China AI Labelling Label Art. 5 Implicit (metadata) labels (core)
- China GenAI Measures GenAI Art. 12 Labelling of generated content (core)
- China Deep Synthesis DeepSyn Art. 16 Implicit technical labels (core)
- China Deep Synthesis DeepSyn Art. 17 Conspicuous labels for confusable content (core)
- GPAI Code Transparency 1.1 Drawing up and keeping up-to-date model documentation (core)
- GDPR Arts. 13–14 Information to be provided to the data subject (core)
- CSA AICM MDS-03 Model Documentation (core)
- Korea AI Act Art. 31 Transparency: prior notice, output labelling, realistic synthetic content (core)
- UK ATRS ATRS Tier 1 Summary information (core)
- Singapore GenAI GenAI 3 Trusted Development and Deployment (core)
- CoE Convention CoE Art. 14(2) Documentation sufficient to contest decisions; complaint to authorities (core)
- OECD AI Principles OECD 1.3 Transparency and explainability (core)
- G7 Code G7 Action 3 Publicly report capabilities, limitations and domains of use (core)
- GAO AI Accountability 3.5 Documentation: document the methods for assessment, performance metrics, and outcomes of the AI system (core)
- AI Verify 1.1.6 Transparency: publicly report accuracy, intended use cases, limitations, risk assessment and mitigations to stakeholders (core)
- AI Verify 1.7.2 Transparency: make model or system cards publicly available where warranted by public interest (core)
- EU AI Act Art. 50 Transparency obligations for providers and deployers of certain AI systems
- NIST AI RMF MAP 1 MAP 1: Context is established and understood
- NIST AI RMF MEASURE 2.8 MEASURE 2.8: Risks associated with transparency and accountability are examined and documented
- China GenAI Measures GenAI Art. 19 Disclosure to regulators
- China Algo. Rec. AlgoRec Art. 16 Notice that recommendation is used
- GB/T 45654 GB/T 45654 Content labelling Generated-content labelling requirements (clause not verified)
- EU AI Act Art. 86 Right to explanation of individual decision-making
- EU AI Act Art. 18 Documentation keeping
- EU AI Act Art. 43 Conformity assessment
- EU AI Act Art. 53(1)(d) Public summary of the content used for training
- EU AI Act Art. 50(2), 50(4) Machine-readable marking of synthetic content; disclosure of deep fakes
- GPAI Code Transparency 1.2 Providing relevant information
- GDPR Art. 30 Records of processing activities
- NIST AI RMF MAP 1.6 MAP 1.6: System requirements are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks
- NIST AI RMF MEASURE 2.9 MEASURE 2.9: The AI model is explained, validated, and documented, and AI system output is interpreted within its context as identified in the MAP function to inform responsible use and governance
- CSA AICM MDS-04 Model Documentation Requirements
- Korea AI Act Art. 34(1)(2) Explanation plan: result, main criteria, training-data overview
- UK ATRS ATRS 2.2 Description and rationale
- CoE Convention CoE Art. 15(2) Notification of interaction with an AI system
- AI Verify 1.1.1 Transparency: design an in-house policy on communication to consumers that articulates the principles for transparency
AI literacy and competence
- EU AI Act Art. 4 AI literacy (core)
- ISO 42001 7.2 Competence (core) (clause not verified)
- NIST AI RMF GOVERN 2.2 GOVERN 2.2: The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements (core)
- CSA AICM HRS-14 AI Competency Training (core)
- Singapore Agentic Agentic 2.4 Enable end-user responsibility (core)
- EU AI Act Art. 26(2) Oversight by people with the competence, training and authority it needs
- EU AI Act Art. 95(2)(c) Codes of conduct: promoting AI literacy
- GDPR Art. 39(1)(b) DPO tasks: awareness-raising and training of staff (clause not verified)
- ISO 42001 7.3 Awareness (clause not verified)
- NIST AI RMF MAP 3.4 MAP 3.4: Processes for operator and practitioner proficiency with AI system performance and trustworthiness, and relevant technical standards and certifications, are defined, assessed, and documented
- CSA AICM HRS-11 Security Awareness Training
- UK ATRS ATRS 2.3.4 Required training
- Singapore GenAI GenAI 9 AI for Public Good
- China GenAI Measures GenAI Art. 10 Guide users to understand and use generative AI rationally
- AI Verify 9.5.3 Accountability: policies, procedures and training so that staff know their duties and the organisation's risk management practices
- AI Verify 5.1.1 Security: training and guidance on AI security risks for all personnel, including developers, system owners and senior leaders
- AI Verify 8.4.1 Data Governance: ensure team competency in data governance roles and responsibilities
Conformity assessment and certification
- EU AI Act Art. 43 Conformity assessment (core)
- ISO 42006 ISO/IEC 42006 Requirements for bodies providing audit and certification of AI management systems (core)
- CSA AICM A&A-02 Independent Assessments (core)
- EU AI Act Art. 47 EU declaration of conformity
- EU AI Act Art. 48 CE marking
- EU AI Act Art. 40 Harmonised standards and standardisation deliverables
- GDPR Art. 42 Certification (clause not verified)
- ISO 42001 9.2 Internal audit (clause not verified)
- NIST AI RMF MEASURE 1.3 MEASURE 1.3: Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates
- CSA AICM A&A-04 Requirements Compliance
- Korea AI Act Art. 33 Confirmation of high-impact AI
- Singapore GenAI GenAI 5 Testing and Assurance
- EN 18286 EN 18286 Quality management system for EU AI Act regulatory purposes
- China GenAI Measures GenAI Art. 17 Security assessment and algorithm filing
Source
Chapter 08, section Federal audit and oversight, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-usgao-gov.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). GAO AI Accountability Framework principle 1: governance (AIGE-OBL-USGAO-GOV). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{GAO AI Accountability Framework principle 1: governance (AIGE-OBL-USGAO-GOV)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov},
note = {Version 0.5.0}
}