OASF is not another framework document. It is a structured, domain-based governance architecture that defines the control boundaries your organisation needs — and drives what AYJIS enforces at runtime. Aligned directly to EU AI Act and NIST AI RMF.
Each domain addresses a distinct governance dimension — from how AI data is classified and handled, to how models are approved and monitored, to how incidents are detected and responded to. Select a domain to see its purpose, the outcome it delivers and the frameworks it supports.
Defines how data is classified, handled and protected throughout AI interactions, so that sensitive information is only ever processed by AI services approved for it.
Confidence that personal and confidential data is used in AI in line with data-protection obligations — and evidence to show it.
Defines how AI models and providers are evaluated, approved, monitored and retired, so that employees work only with vetted AI services suited to their use case.
A clear, defensible view of which AI services are approved for which purposes — and control over the use of unapproved AI.
Defines how identity, authorisation and roles apply to AI usage, so that every AI interaction is attributable to an accountable person or system.
Accountability for AI usage across the organisation, with access aligned to business roles and responsibilities.
Defines the security governance protecting AI systems from misuse, manipulation and AI-specific threats — including the third-party and supply-chain risk that traditional security programmes were not designed for.
AI security risk that is identified, owned and managed as part of the enterprise security programme.
Defines the record-keeping, reporting and evidence requirements that make AI governance demonstrable to regulators, boards and auditors.
AI governance you can prove — audit-ready evidence and reporting for regulators, auditors and the board.
Defines how AI-specific incidents are identified, contained, investigated and reported. Traditional incident response playbooks were not designed for AI misuse or governance failures — this domain fills that gap.
A structured, timely response to AI incidents, aligned with regulatory notification obligations.
The complete OASF control set is shared in a briefing. Request OASF briefing →
OASF is aligned to the regulatory frameworks your organisation is already accountable to. OASF is not a new language to learn — it is a practical implementation of the standards you already know.
Most governance frameworks produce documents. OASF produces operational governance — and AYJIS carries that governance into runtime enforcement, making it measurable, auditable and demonstrable.
Identifies risk and governance gaps — defines what OASF needs to address
Defines the governance your organisation needs to close those gaps
Enforces governance at runtime — and generates evidence back into governance
OASF defines the governance architecture that AYJIS enforces at runtime — typically established through an OASAT assessment that identifies your governance gaps and the controls your organisation needs.