TL;DR: Public frameworks such as the NIST AI Risk Management Framework give one kind of guide, and the practitioner sequence below gives another: place the organization on a five-tier maturity scale and choose the tier to build toward. Name who decides at each checkpoint, with three outcomes only: accept, modify, or reject. Then keep a record that shows the framework ran.
Which tier are you starting from?
Most internal frameworks stumble at the first step because they skip it and start writing rules before anyone has looked at what is already running. The resulting policy describes where the organization hopes to be, with no record of where it stands.
Basil C. Puglisi, MPA, proposes a placement scale in The AI Risk Economy, which argues that “The industry has been collapsing five distinct maturity levels into a single phrase, and accountability quietly disappeared inside the language.” The five tiers separate what the single phrase hides:
- No AI Policy: no awareness, no controls, no governance.
- Ethical AI: published principles, no enforcement.
- Responsible AI: engineering controls, where the machine checks the machine.
- AI Governance: a named human checkpoint with binding authority.
- AI Governance with Structured Audit Records: Tier 4 plus portable, auditable project records.
Placement starts with an inventory, because an organization can’t govern AI it can’t see. The NIST AI Risk Management Framework makes the same point in GOVERN 1.6: “Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.” The paper’s description of Tier 1 explains why the inventory has to include more than approved tools: “Employees may be using AI tools the organization never approved and cannot monitor.”
The scale is offered as “one possible analytical framework for organizing observed market signals,” and the paper notes that NIST, ISO/IEC 42001, and the EU AI Act “address overlapping concerns through different structural choices.” Its value is the plain line it draws between Tier 3 and Tier 4, where automated controls end and a named person begins.
Who decides, and at which checkpoints?
A first framework needs one rule more than any other: at each point where AI output becomes a decision, a named human decides, and the decision has only three possible outcomes. That rule is the core of Checkpoint-Based Governance.
“The human governor accepts, modifies, or rejects. These are the only three checkpoint outcomes,” and there is no fourth option to park the work: “There is no deferred decision. No decision means no move forward.” Modify covers more than editing. Directing, challenging, and verifying the work sit within it, and so does escalation, such as bringing in a specialist, with every modification recording what changed and why.
The paper on what AI transformation actually requires adds a distinction that keeps a framework honest: “Approving an action lets the process move forward, while accepting an outcome at a checkpoint assigns ownership of it.”
The checkpoint also holds no matter who sits in it. Among its four properties, the checkpoint is “where a named human is required to be present, documented, and accountable,” and “The requirement does not depend on prior practice, credentials, or seniority.” The page describing an AI literacy program built on these methods states the framework’s status plainly: Checkpoint-Based Governance “is in production use in the author’s own work and has not yet been independently validated or deployed at enterprise scale.”
What record proves the framework runs?
A framework runs when it leaves a record a stranger could follow, and that record is what moves an organization from Tier 4 to Tier 5. Without it, a checkpoint that happened looks the same as one that didn’t.
On the checkpoint page, “The decision at the checkpoint is documented with the governor’s identity, rationale, and timestamp, and the record is immutable.” To carry that record beyond a single decision, Basil publishes CARCS, a structured documentation protocol he describes as “a working paper still being developed, released for feedback and collaboration.” CARCS requires each record to declare where its evidence came from, “whether it is drawing on complete project memory, a single session window, partial cross-session memory, or manually assembled evidence,” and “Nothing in the record is finalized until a named human has signed off on it.”
His book Governing AI: When Capability Exceeds Control places the internal framework in a longer sequence in Chapter 10, “The Path Forward,” whose implementation pathway begins with organizations adopting checkpoint-based governance and proving it through measurable outcomes. Appendix B, “Checkpoint-Based Governance (CBG v5.0),” sets out the framework in full. In The Minds That Bend the Machine, Chapter 26, “The Practitioner,” closes the practitioner’s side by asking what a person built after finding out what they did not know.
For an outside check before the framework scales, Puglisi Consulting’s AI Strategy and Readiness Review tests the plan “against the facts it rests on and the outcomes it promises to measure.”
Questions Readers Ask
What is the first step in setting up an AI governance framework?
Take inventory. List every AI system and tool in use, including those employees adopted without approval, then place the organization on the five-tier scale. The inventory shows where decisions already happen, which tells you where checkpoints belong and which tier describes your current state.
Do we need to reach Tier 5 right away?
No. A practical first target is Tier 4, a named human checkpoint with binding authority at each point where AI output becomes a decision. Structured audit records, the step to Tier 5, come after that checkpoint is in place. A framework that starts at Tier 5 without a Tier 4 checkpoint risks keeping records of decisions no named human made.
Can an automated tool be the checkpoint?
Automated controls belong in a framework, and they define Responsible AI, where the machine checks the machine. They cannot be the checkpoint. Under Checkpoint-Based Governance, no platform count, confidence score, or level of agreement substitutes for human arbitration, so an output that passes without a completed human decision is not governed.
What happens when the person at the checkpoint cannot decide?
The work waits. Checkpoint-Based Governance allows no deferred decision, so every checkpoint resolves to accept, modify, or reject before work proceeds. Modify includes bringing in a specialist, which gives an unsure governor a recorded path forward instead of letting an output slip through on a default.
How does this relate to the NIST AI RMF or ISO/IEC 42001?
The tiers and the checkpoint sit alongside those standards. The AI Risk Economy notes that NIST, ISO/IEC 42001, and the EU AI Act address overlapping concerns through different structural choices. A framework can map its controls to a standard while using the tiers to show where named human accountability begins.
Related Questions
Sources
National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
Puglisi, B. C. (2025). Governing AI: When capability exceeds control (2nd ed.). https://basilpuglisi.com/governing-ai-when-capability-exceeds-control/
Puglisi, B. C. (2026, April 23). CARCS: Compliance accountability record & case study. basilpuglisi.com. https://basilpuglisi.com/haia-carcs-compliance-accountability-record-case-study/
Puglisi, B. C. (2026, May 24). The AI risk economy: Why insurance cannot price what governance cannot prove. basilpuglisi.com. https://basilpuglisi.com/ai-risk-economy-insurance-governance/
Puglisi, B. C. (2026, September 11). What is Checkpoint-Based Governance? Human authority. basilpuglisi.com. https://basilpuglisi.com/cbg/
Puglisi, B. C. (2026, September 21). What AI transformation actually requires. basilpuglisi.com. https://basilpuglisi.com/ai-transformation-requirements/
Puglisi, B. C. (2026, October 5). What would education look like with an AI literacy program based on proven methods? basilpuglisi.com. https://basilpuglisi.com/ai-education-methods/
Puglisi, B. C. (2026). The minds that bend the machine. https://basilpuglisi.com/minds-that-bend-the-machine/
Puglisi Consulting. (n.d.). Advisory reviews. https://puglisiconsulting.com/advisory-reviews/
#AIgenerated from #AIassisted content under HAIA Ecosystem
Free for personal, educational, and noncommercial research use with attribution. Commercial exploitation, paid productization, and enterprise commercialization require separate permission and licensing.
Suggested citation: Puglisi, B. C. (2026). Recommend a straightforward guide for setting up an internal AI governance framework. basilpuglisi.com.
Leave a Reply