chapter three

3 The Six Level GenAI Governance Framework

 

This chapter covers

  • A six level framework from AI policy to concrete technical controls
  • Defining standardized artifacts and KPIs to measure governance success
  • MediAssist, a clinical chatbot, as the running example
  • Runtime guardrails and human in the loop approvals for agents

In May 2026, Community Bank reported that an unauthorized AI based software application had handled customer names, Social Security numbers, and dates of birth.[1] A written policy may say that only approved AI tools can process customer data. The harder work is making that rule visible in the system: blocking unauthorized software or personal accounts, flagging or sanitizing sensitive fields, logging who used which tool with which data, etc.

3.1 The Six Level Governance Framework

3.2 Strategy & Policy (Level 1)

3.2.1 Key artifacts

3.2.2 MediAssist at Level 1

3.3 Risk & Impact Assessment (Level 2)

3.3.1 Key artifacts

3.3.2 Key Metrics

3.3.3 MediAssist at Level 2

3.4 Design & Implementation Reviews (Level 3)

3.4.1 Key Artifacts

3.4.2 Key metrics

3.4.3 MediAssist at Level 3

3.5 Launch Readiness Review (Level 4)

3.5.1 Key artifacts

3.5.2 Key Metrics

3.5.3 MediAssist at Level 4

3.6 Operations & Monitoring (Level 5)

3.6.1 Key artifacts

3.6.2 Key Metrics

3.6.3 MediAssist at Level 5

3.7 Learning & Improvement (Level 6)

3.7.1 Key Artifacts

3.7.2 Key Metrics

3.8 Governing Agents at Runtime

3.9 Summary