Data Governance Framework 2026: Templates and 5-Step Implementation

---

Data governance framework explained

A data governance framework works like a blueprint that guides how data is handled across teams, so it stays reliable, secure, and aligned with business goals. It is an operating model that addresses:

• Who decides: Which roles hold authority over definitions, access, and exceptions.
• What the rules are: The classification, quality, retention, and privacy standards that apply.
• How rules are applied: The workflows and automation that turn a written policy into an enforced control.
• How you know it works: The metrics that show coverage, compliance, and adoption over time.

Modern frameworks like AI-first governance address the AI value chasm. Key attributes include policy as code, a centralized data and agent catalog, decision tracing, and DataGovOps (continuous, versioned, code-driven controls).

---

---

Quick facts about the data governance framework

Framework Component	What It Delivers	Measurable Impact
People	Clear ownership through defined roles: data owners, stewards, custodians, and governance councils, and the emerging context steward who certifies how data is understood by AI.	Eliminates ownership and skill gaps that stall 42% of governance programs.
Process	Standardized workflows across the data lifecycle, from creation through quality checks, certification, use, and retirement.	Reduces data search time by 30–40% and cleaning effort by 20–30%.
Technology	Automated discovery, real-time lineage, continuous quality monitoring, policy enforcement at query time, and a registry of models and agents.	Organizations report 30–500% ROI from data quality investments in 18–24 months.
Policy	Machine-readable rules for classification, access, retention, privacy, and compliance enforcement, applied as code.	Prevents penalties up to €20M or 4% of global turnover under regulations like the EU AI Act.
Metrics	Freshness, mean time to resolve, policy compliance rate, and adoption by domain, reviewed on a fixed cadence.	Exposed a 38% lift in natural-language query accuracy from governed context, across 174 enterprise queries and 522 evaluations.
Outcomes	The named business problem the framework exists to solve, tied to a sponsor who owns the result.	Gartner predicts 80% of governance initiatives will fail by 2027 without tying work to business outcomes.

---

---

Data governance framework: Is it the same as a data governance model?

Data governance frameworks and data governance models are different artifacts that work together. A data governance framework gives a structured operating standard for how an organization should manage, secure, and use its data. It uses policies and processes to operationalize governance across teams.

While often used interchangeably, the data governance model focuses on who decides, who executes, and who enforces.

What is a data governance framework - Image by Atlan.

A strong data governance framework fits directly into daily workflows. It focuses on people, processes, policies, and technology to manage and secure data while automating rules at scale.

When implemented, the data remains accurate and trustworthy, making it suitable for AI systems that are only as reliable as the data behind them.

The three core ideas of a good data governance framework are:

• It gives an operating model, not a document
• It creates operational guardrails that empower teams
• It aligns governance work with business outcomes

The data governance model describes the shape of authority: centralized, federated, or a hybrid of both. You pick a model, then express it inside a framework.

Most large organizations land on federated authority, where domain teams own their assets and a central group maintains shared standards.

---

Why does a data governance framework matter now?

Gartner expects 40% of enterprise applications to feature task-specific AI agents by the end of 2026, up from less than 5% in 2025. Every one of those agents will act on data whose rules someone either defined deliberately or left undefined. When an AI agent queries your warehouse, it inherits whatever governance is attached to the data it reads.

Before an agent acts, it needs to know:

• Classification: Which fields are PII, and what handling applies to each.
• Policy: Which rules govern this asset in this jurisdiction for this persona.
• Entitlement: Who is permitted to see what, enforced at query time rather than after.
• Certification: Which assets are approved for production use and which are experimental.

When you leave these aspects undefined, the cost surfaces as a confident wrong answer, breaking trust in the agent’s outcomes.

Data governance must go from defense to offense

For two decades, the data governance framework existed for human readers. Analysts read the definitions, stewards enforced the rules, and auditors reviewed the evidence. The rationale was risk reduction, and it produced programs that read as cost centers.

In the age of agentic AI, governance is a function within the context layer for AI, the infrastructure that makes enterprise AI accurate and trustworthy. A governed estate is the precondition for shipping AI that works.

Atlan Frontier Labs measured this directly. Governed context lifted natural-language query accuracy by 38%, across 174 enterprise queries and 522 evaluations, with the gain coming from governance rather than a change of model.

---

How does this fit in the context layer?

Data governance is one piece of a broader context layer, the bedrock that makes every AI agent in your business useful and accurate. It connects to:

• Data lineage: How an agent traces an answer back to source so the output is auditable.
• Semantic definitions: What a metric means, for which team, with which exceptions, and who certified it.
• Access and policy: The guardrails an agent inherits so answers respect GDPR, HIPAA, and internal rules from the first token.
• Quality signals: Whether the underlying data is fit to answer on, so agents flag broken data rather than answering confidently over it.

Together these give every agent, from Genie to Cortex to Claude to the next one, the same governed view of the business.

---

What are the pillars of a data governance framework?

Modern data governance frameworks typically consist of four foundational pillars: people, process, technology, and policy.

1. People: Ownership and decision rights

A strong people foundation makes data responsibility clear at every stage, eliminating gaps and orphaned assets. Key ownership roles include:

• Governance council: Cross-functional leaders who set strategy, approve policy, and resolve escalations.
• Data owners: Business leaders accountable for accuracy and value within a domain.
• Data stewards: Day-to-day custodians of quality, policy enforcement, and exception handling.
• Data custodians: Technical teams implementing controls and maintaining infrastructure.
• Context stewards: An emerging role focused on how data is understood and used by AI, not only how it is stored and protected. As agents take over documentation and tagging, the human job shifts from producing context to certifying it.

2. Process: Standardized workflows

Clear processes transform abstract policies into an active operating model. The core elements include:

• Lifecycle checkpoints: Defined gates from creation through quality checks, certification, use, and retirement.
• Issue resolution: Tickets routed by impact, with lineage context attached automatically.
• Impact analysis: Change predictions that show which reports, models, and agents a schema change will break.
• Policy review: Versioned policies with formal approval paths and a fixed review cadence.
• Exception handling: A documented path for edge cases that leaves an audit trail behind it.

3. Technology: Automation and enforcement

Technology scales governance through automation and AI with:

• Automated discovery: Continuous inventory of assets, owners, and usage across sources.
• Column-level lineage: A traceable map of where data came from and what depends on it downstream.
• Quality monitoring: Checks that run close to the data, flagging drift before it reaches a dashboard.
• Policy enforcement: Classification, masking, and access rules applied at query time.
• AI and agent registry: A record of which models and agents exist, what they read, and under which policy they acted.

4. Policy: Rules a machine can read

Policies as code ensure that agentic AI is well-governed and compliant with regulations, on every request:

• Classification: Sensitivity tiers with defined handling rules for each.
• Quality standards: Benchmarks for accuracy, completeness, consistency, and timeliness.
• Access rules: Entitlements keyed to role, sensitivity, and demonstrated need.
• Retention: Timelines for archival and deletion, enforced rather than documented.
• Privacy: Alignment with GDPR, CCPA, HIPAA, and the EU AI Act.

Consider the EU AI Act for instance. It classifies AI systems into four risk tiers. Mapping these to governance controls helps ensure data and AI artifacts stay compliant. Here’s an overview of what EU AI Act covers and what governance controls to apply:

Risk tier	What it covers	Governance controls to apply
Unacceptable	Prohibited uses (e.g., social scoring, manipulative subliminal techniques)	No deployment; Audit trail and policy lock to prevent use.
High	Critical infrastructure, education, employment, essential services, and law enforcement	Training data lineage, model cards, bias/drift monitoring, human oversight, and audit snapshots.
Limited	Transparency obligations (e.g., chatbots must disclose they are AI)	Model and prompt governance; disclosure and logging.
Minimal	Most other AI applications	Lightweight cataloging and lineage; optional quality and usage metrics.

Data governance violations under new laws like the EU AI Act carry penalties of up to €20 million or 4% of global turnover. The framework guides your organization’s data governance to prevent such damages.

The four pillars of your data governance framework at a glance

Component	What it includes	Why it matters for agents
People	Owners, stewards, custodians, context stewards, council.	Someone certifies what the agent is allowed to trust.
Process	Lifecycle gates, issue routing, impact analysis, exceptions.	Changes get caught before an agent answers on stale logic.
Technology	Discovery, lineage, quality, enforcement, agent registry.	Coverage extends past the assets a human had time to document.
Policy	Classification, quality, access, retention, privacy as code.	Rules apply at query time rather than at audit time.

---

What does a data governance framework template look like?

A simple data governance framework template lays out six key elements to give you a clear starting point for documenting your framework decisions, including:

1. Outcomes
2. People
3. Process
4. Technology
5. Policy
6. Success Metrics

If needed, you can customize it to match your organization’s needs and business goals. It turns high-level ideas into a practical rulebook that guides every team in managing data.

KPI scorecard: metric definitions

You can use a lean scorecard for tracking governance effectiveness, with quarterly review cadence:

Metric	Definition
Freshness	How up-to-date metadata and lineage are; target maximum staleness (e.g., 24h) for critical assets.
MTTR (mean time to resolve)	Average time from detecting a data quality or policy issue to resolution; lower is better.
Policy compliance rate	Share of assets (or pipelines) that meet defined policy rules (e.g., classification, quality thresholds).
Usage/adoption	Usage of catalog, lineage, and governance workflows; adoption by domains and data producers.

---

What are the key objectives of a data governance framework?

Strong data governance frameworks deliver six strategic outcomes: ensuring high-quality data, maintaining security, enabling regulatory compliance, supporting decision-making, optimizing efficiency, and achieving AI readiness.

Here’s a deep-dive into each objective, exploring why they matter:

1. Ensuring data quality and reliability

The framework sets clear standards for data accuracy, completeness, consistency, and timeliness. Automated validation rules catch errors early, before they appear in executive dashboards.

It prevents mistakes from cascading into budgets and forecasts, closing the trust gaps in data. According to the 2024 FPA Trends Survey, only 9% of FP&A respondents fully trust the data they rely on for critical decisions.

2. Maintaining security and privacy

A data governance framework organizes data into sensitivity levels, such as public or confidential. Role-based access controls ensure employees only see the data they need to do their jobs, helping protect sensitive and personally identifiable information (PII).

The framework also recommends maintaining an audit log of all access and changes. It allows teams to investigate security issues as needed.

3. Enabling regulatory compliance

The framework defines the documented controls and audit trails required to meet regulations such as GDPR, SOX, HIPAA, and the EU AI Act. It links each requirement directly to the relevant data, helping the organization stay continuously compliant and audit-ready.

The EU AI Act classifies AI systems into four risk tiers. Mapping these to governance controls helps ensure data and AI artifacts stay compliant. Here’s an overview of what EU AI Act covers and what governance controls to apply:

Risk tier	What it covers	Governance controls to apply
Unacceptable	Prohibited uses (e.g., social scoring, manipulative subliminal techniques)	No deployment; Audit trail and policy lock to prevent use.
High	Critical infrastructure, education, employment, essential services, and law enforcement	Training data lineage, model cards, bias/drift monitoring, human oversight, and audit snapshots.
Limited	Transparency obligations (e.g., chatbots must disclose they are AI)	Model and prompt governance; disclosure and logging.
Minimal	Most other AI applications	Lightweight cataloging and lineage; optional quality and usage metrics.

Data governance violations under new laws like the EU AI Act carry penalties of up to €20 million or 4% of global turnover. The framework guides your organization’s data governance to prevent such damages.

4. Supporting data-driven decision-making

When decision-makers see a single source of truth, they make faster, strategic moves. A data governance framework delivers it. You get a data catalog and lineage to understand the data’s origin and trust the analytics. It takes you from constant firefighting with inconsistent data toward proactive planning.

5. Optimizing operational efficiency

You have a low productivity drain caused by manual data cleaning. Automation reduces operational monitoring time while accelerating insight delivery.

It reduces the high costs associated with poor data quality, which averages $12.9 million annually per firm.

6. Achieving AI readiness

Most companies struggle to become generative AI-native; 95% companies are failing. Modern data governance frameworks help such companies bridge the AI value chasm and move toward deploying more reliable, production-ready systems.

Strong data governance frameworks make it possible by including:

• Bias detection: Monitoring model outputs for discriminatory patterns
• Drift Monitoring: Tracking performance drops when live data no longer matches a model’s original training baseline
• Explainability: Tracing AI lineage back to raw training features to explain how decisions were reached

Pro-tip: Prioritize objectives based on your organization’s needs. A strong framework covers all areas, but the order should match your reality. Regulated industries lead with compliance. Data driven teams focus on decision support. If security incidents are top of mind, make protection your first move.

---

How does a modern data governance framework work?

A working framework comprises four interconnected functions that together translate high-level principles into daily practices.

The operating cycle

1. Discover: Automatically scan connected systems to establish what exists, where it lives, and who uses it.
2. Define: Attach context, ownership, classification, and certification status to each asset.
3. Enforce: Convert written policy into machine-readable rules applied at access and at ingestion.
4. Observe and improve: Track compliance, quality, and adoption, then adjust as regulation and business needs change.

Shift-left governance

Modern data governance frameworks focus on a shift-left philosophy. Traditionally, the approach to data governance was “shift down,” where there was no metadata available.

The shift-left philosophy moves documentation, standards, and testing closer to the point where the data asset is created rather than consumed.

General Motors is the clearest illustration of this principle working at scale. GM governs data by design before it reaches production, and reports 45 to 60% less effort for each subsequent agent it builds, because the context the first agent needed was already in place for the second.

Policy as code

Policy as code lets agents operate autonomously and scales data governance framework execution across an enterprise. Three properties matter:

• Versioned: Every change to a rule is tracked, attributable, and reversible.
• Testable: Rules can be simulated against real assets before they take effect.
• Portable: The same rule applies whether the consumer is a BI tool, a notebook, or an agent.

Human on the loop

Human in the loop meant a person approved each action, which does not survive agent-scale volume. Human on the loop means agents do the volume work and stewards approve.

Here’s an example of this principle in action. Atlan’s Context Agents author descriptions, READMEs, glossary terms, metrics, and semantic models autonomously, compressing 9 to 12 months of manual stewardship into roughly 30 days, with humans reviewing and certifying the output rather than producing it.

Extending the framework to AI and context

One lifecycle should cover data and analytics assets, AI models, and the context artefacts that agents consume. Splitting these into separate programs creates gaps at exactly the seams where risk concentrates. Practically, that means the framework grows four capabilities:

• Agent and model discovery: Finding the AI applications already running, including the ones nobody registered.
• Context lineage: Tracing the supply chain from source data through knowledge bases to the agent that answered.
• Risk classification: Sorting AI systems against internal standards and regulations such as the EU AI Act.
• Decision traceability: Recording what an agent queried, what it changed, and under which policy it acted.

---

How to implement a data governance framework: 5 steps

Atlan’s data governance experts recommend rolling out governance through a simple, agile loop instead of a long, one-time policy manual. Iterate these five steps to create fast wins while building toward full coverage:

1. Define outcomes and link them to business goals
2. Inventory assets and establish ownership
3. Develop baseline policies and standards
4. Automate enforcement and embed governance into workflows
5. Measure, improve, and repeat quarterly

How to implement a data governance framework: 5 steps - Image by Atlan.

1. Define outcomes and link them to business goals

Choose the business problem that governance will immediately improve, such as reducing failed campaigns, improving compliance posture, or increasing reporting accuracy. Start with one high value or high risk domain.

Actionable tip: To keep executives invested, build a simple value map showing how better data drives revenue, efficiency, or risk reduction. E.g., “5% improvement in customer data accuracy → 3% reduction in failed marketing campaigns → $X additional revenue.”

2. Inventory assets and establish ownership

Use automated discovery and lineage to map your data landscape, then assign clear owners and stewards. Apply stricter oversight to your “crown jewel” data, where mistakes have the biggest business impact.

Actionable tip: Use tiered governance for large organizations, to maximise ROI from governance investment. Classify crown jewel data assets (Tier 1) requiring full governance, apply lighter controls to Tier 2 assets, and minimal governance to Tier 3.

3. Develop baseline policies and standards

Write simple rules for quality, access, privacy, retention, and classification, and structure them as policy as code so systems can enforce them. Add domain specific standards only where needed.

Actionable tip: Start with five enforceable rules, not fifty aspirational ones. Expand only when teams consistently follow the basics.

4. Automate enforcement and embed governance into workflows

Use metadata and lineage to drive tagging, masking, alerts, and access workflows. Make governance appear directly in SQL editors, BI tools, and catalogs so controls feel natural rather than bureaucratic.

Actionable tip: Choose one high friction process, such as access requests, and automate it first to show instant value.

5. Measure, improve, and repeat quarterly

Track a small set of indicators like freshness, usage, policy compliance, and MTTR. Review progress quarterly, refine policies, and expand ownership and automation as maturity grows.

Actionable tip: Use a maturity model to show progress, highlight gaps, and guide investments quarter by quarter.

Implementation timeline: Organizations typically see early results within weeks through focused domain pilots. Comprehensive enterprise-wide frameworks take 6-12 months to build, with maturity achieved over 18-24 months through iterative expansion.

---

Which established data governance frameworks should you use?

There are six popular data governance frameworks. They serve different needs, for example:

• DAMA DMBOK: A full body of knowledge across eleven data management areas, and the most common starting vocabulary. Check out the DAMA-DMBOK guide for more information.
• DGI framework: Strong on roles, decision rights, and accountability for teams that need ownership clarity first.
• COBIT: Controls, audit readiness, and IT risk governance, developed by ISACA and favoured in heavily audited environments.
• DCAM: A capability maturity model from the EDM Council, useful for scoring where you are and sequencing investment.
• NIST AI RMF: Increasingly paired with data frameworks because its Govern, Map, Measure, and Manage functions cover AI risk. See the NIST AI Risk Management Framework for more information.

Popular governance frameworks and how they compare - Image by Atlan.

How they compare: At a glance

Framework	What it provides	Where it helps most
DAMA DMBOK	Broad data management concepts and shared vocabulary	Programs building end to end capability from a low base
DGI	Roles, decision rights, accountability structures	Teams whose blocker is ownership ambiguity
COBIT	Controls, audit trails, IT risk alignment	Regulated and audit-driven environments
DCAM	Maturity scoring and roadmap sequencing	Programs justifying investment quarter by quarter
NIST AI RMF	AI risk functions and trustworthiness characteristics	Organizations extending governance to models and agents

None of these frameworks execute themselves. They describe what should be true, and the gap between the description and the running estate is where programs usually fail.

---

How does Atlan operationalize a data governance framework?

A framework describes what should be true about your estate. The gap between that description and the running systems is where most programs stall. Atlan closes the gap by treating data governance as a function within the context layer, rather than as a standalone platform.

Key capabilities that drive this approach are:

• Context Agents: Autonomously author descriptions, READMEs, glossary terms, metrics, semantic models, and SQL intelligence across the estate, so stewards certify rather than type.
• Context Engineering Studio: Context Engineering Studio versions, simulates, and grades agents before they reach production, deriving test cases from downstream lineage so the questions your users actually ask become the eval suite.
• Context Lakehouse: The Context Lakehouse persists everything as Apache Iceberg tables behind a Polaris REST catalog, queryable directly from Snowflake, Databricks, Spark, or Athena with no proprietary export step. That openness lets partners build on the same store as first-class applications.
• Atlan MCP and conversational AI: Atlan MCP and conversational AI serve context to humans and agents at inference under identical persona entitlements. So, an agent gets exactly what the person it acts for is permitted to see, checked before anything executes.
• Data Quality Studio: Data Quality Studio is the first native quality experience on Snowflake, Databricks, and BigQuery, with checks running in-warehouse so no new compute is provisioned and no data crosses the perimeter. AI drafts the first version of each rule, which extends coverage into the long tail.

Atlan capabilities at a glance

Capability	What it does	Outcome
Context Agents	Autonomously author descriptions, READMEs, glossary terms, metrics, semantic models, and SQL intelligence	~30 days against 9 to 12 months; 55,000+ hours avoided by one cohort in one week; 64% adoption in 3 months at 7x value realization.
Context Engineering Studio	Versions, simulates, and grades agents pre-deployment, with test cases derived from downstream lineage	Workday and Fox each report 5x better AI analyst accuracy.
Context Store	Apache Iceberg tables behind a Polaris REST catalog, queryable from Snowflake, Databricks, Spark, and Athena, with no proprietary export	Immuta, BigID, and Cyera shipping as first-class apps.
Atlan MCP and conversational AI	Serves context to humans and agents at inference under identical persona entitlements	8Bn+ context reads in 90 days; 58x MCP call growth since September 2025.
Data Quality Studio	First native quality experience on Snowflake, Databricks, and BigQuery, with in-warehouse checks and AI-drafted first-version rules	No new compute, no data leaves the perimeter, coverage reaches the long tail.

---

Real stories from real customers building context layers with Atlan

Here are three examples that demonstrate data governance framework success through measurable outcomes:

---

Moving forward with your data governance framework

Effective data governance doesn’t mean rigid rules. It’s all about finding the right balance between structure and flexibility, and building controls into the tools teams already use every day.

Start from one business outcome, govern the assets that outcome depends on, then expand. Make sure you adopt policy-as-code to govern humans and agents, put humans on the loop, and govern data, context, and AI with the same program.

The organizations moving fastest on AI have a framework and technology that let their agents know what is classified, what is certified, and who is allowed to see what, before the agent acts.

---

FAQs about data governance framework

1. What is a data governance framework?

A data governance framework is the structured operating model that defines how an organization manages, secures, and uses its data to maximize business value and ensure compliance. It assigns ownership, standardizes processes, and embeds technology and policy controls that keep data trustworthy at scale.

2. What are the four components of a data governance framework?

Most frameworks are built on people, process, technology, and policy. People establishes ownership and accountability through owners, stewards, custodians, and a governance council. Process defines lifecycle workflows for quality checks, certification, issue resolution, and exceptions. Technology supplies discovery, lineage, quality monitoring, and enforcement, while policy sets the classification, access, retention, and privacy rules those systems apply. Many programs add a fifth component, metrics, so effectiveness can be tracked rather than assumed.

3. What are the main objectives of implementing a data governance framework?

The primary objectives are to improve data quality, protect sensitive information, and ensure regulatory compliance while enabling confident decision-making. A framework also reduces operational friction by standardizing how teams work with data.

4. How long does data governance framework implementation typically take?

Most organizations see initial results in a few weeks by piloting governance in a focused domain. A broader rollout usually takes six to twelve months as teams formalize ownership, processes, and tooling. Full maturity develops over time through iteration and automation. This phased approach lets organizations deliver value quickly while scaling governance in a controlled, sustainable way.

5. How do you measure data governance framework effectiveness?

Measure effectiveness by tracking clear operational metrics and tying them to business outcomes. Common indicators include policy compliance rates, data quality scores, issue resolution time, and user trust in shared data. Then connect those numbers to results such as fewer compliance incidents, faster decision-making, and better analytics performance to confirm that governance delivers real, measurable value.

6. What’s the difference between data governance and a governance framework?

Data governance is the ongoing practice of managing data quality, security, and accountability throughout its lifecycle. A governance framework is the structure that makes this practice repeatable. It defines roles, processes, policies, and enabling technologies so that teams apply governance consistently, measure progress, and evolve capabilities, rather than relying on ad hoc or undocumented approaches.

7. Which data governance framework model should organizations choose?

Organizations should choose a framework that fits their maturity level, regulatory needs, and technology environment. There is no universal best option. The right model is one that teams can realistically adopt, scale, and sustain. Evaluate how well it supports daily operations, growth plans, and AI initiatives, then adapt it to balance governance control with flexibility and measurable business impact.

8. What is policy-as-code in data governance?

Policy-as-code turns governance rules into machine-readable instructions that systems enforce automatically. Instead of relying on manual checks, organizations embed privacy, quality, and access controls directly into data platforms and pipelines. This makes enforcement consistent, reduces human error, and allows policies to run continuously, helping teams scale governance faster while maintaining reliable, compliant data practices.

9. What’s the difference between federated and centralized data governance?

Centralized governance places decision-making with a single authority to enforce consistent standards across the organization. Federated governance gives domain teams more responsibility while aligning them to shared rules. Centralization prioritizes control and uniformity, while federation emphasizes speed and ownership. Many organizations combine both, using central guardrails with local execution to balance consistency, agility, and accountability.

10. Do AI agents need a separate governance framework?

They don’t need a separate framework, and separating them tends to create gaps. Agents consume the same data that human users consume and inherit whatever governance is attached to it, so the more workable approach extends the existing framework to cover models, agents, and the context artefacts they read. That extension adds agent discovery, context lineage, risk classification against standards such as the NIST AI RMF or the EU AI Act, and decision traceability. Keeping data and AI in one lifecycle also matters legally, since privacy obligations follow a record into any system that processes it.

---

Sources

1. Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, Up from Less Than 5% in 2025, Gartner
2. EU AI Act Compliance Checker, Future of Life Institute
3. AI Risk Management Framework, NIST

---