Framework
The Aegis Framework is deliberately small. Five stages, applied proportionately, mapped to the obligations you already carry.
Stage 01
You cannot govern what you cannot see. We build a live register of models, datasets, vendors and use cases with named accountable owners.
Stage 02
Each use case is tiered on impact, autonomy and reversibility. Tiering drives how much scrutiny it earns — nothing more, nothing less.
Stage 03
Evaluations matched to the tier: accuracy, subgroup performance, robustness, adversarial behaviour, and human-override effectiveness.
Stage 04
Approval gates, disclosure requirements, logging, and fallbacks written as controls, with owners and evidence for each one.
Stage 05
Drift, complaint and incident signals routed to the people who can pause a system, with periodic reassessment on a fixed cadence.
Regulatory & standards watch
Current as of August 2026. Each control in the framework maps to at least one of these instruments, and every mapping carries a dated source.
Regulation (EU) 2026/1744 moved core Annex III high-risk obligations to 2 Dec 2027 and Annex I product-embedded high-risk AI to 2 Aug 2028. Prohibitions and AI-literacy duties have applied since 2 Feb 2025; GPAI obligations since 2 Aug 2025; Article 50 transparency since 2 Aug 2026. Full roll-out is foreseen by 2 Aug 2028.
Commission implementation timeline →The certifiable AI management system standard: AI policy, roles, risk and impact treatment, lifecycle controls and continual improvement. ISO/IEC 42006 now sets the accreditation requirements for the bodies that certify against it, so certificates are becoming comparable.
ISO/IEC 42001 overview →23894 adapts ISO 31000 risk management to AI; 42005 gives the process for AI system impact assessment — scope, affected individuals, benefits and harms, documentation and timing across the lifecycle. Together they underpin our Assess stage.
ISO/IEC 42005 overview →Govern, Map, Measure, Manage — plus the Generative AI Profile's risk actions for foundation-model use. We use it to structure evidence for US and multinational programmes that are not directly AI Act-scoped.
NIST AI RMF →The 2022 revision's 93 Annex A controls — threat intelligence, secure development, cloud service security, data masking, monitoring — are the security floor beneath any AI control. ISO/IEC 27701 extends it to privacy; transition to the 2022 edition is complete.
ISO/IEC 27001 overview →Prompt injection, insecure output handling, supply-chain and data-poisoning risks tested against the OWASP Top 10 for LLM applications, with NIST's adversarial ML taxonomy (AI 100-2e2025) framing evasion, poisoning and privacy attacks in evaluation scope.
OWASP LLM Top 10 →