Linked.Archi AI Ethics & Governance Extension
Extension ontology for AI ethics and governance. Provides element types, properties, and reference data for managing AI system risk classification, conformity assessment, bias assessment, explainability documentation, human oversight plans, and governance policies. Builds on the ML-Enabled Systems extension (mlsys:) by adding the governance layer that connects ML components to regulatory frameworks (EU AI Act), ethical principles (OECD AI Principles), and organizational AI governance policies. Motivated by Gartner 2025 Leadership Vision identifying AI ethics and governance as a critical gap in EA teams, and by the EU AI Act (Regulation 2024/1689) requiring formal risk classification and conformity assessment for high-risk AI systems.
Ontology for AI ethics and governance within the Linked.Archi ecosystem.
Linked.Archi
AI Risk Level
Classification of AI system risk according to the EU AI Act (Regulation 2024/1689). Risk levels determine the regulatory obligations that apply to an AI system.
AI Principle
A responsible AI principle — an ethical guideline that AI systems should adhere to. Sourced from OECD AI Principles, EU Ethics Guidelines for Trustworthy AI, and organizational AI policies.
Human Oversight Mode
The mode of human oversight applied to an AI system. Determines the degree of human involvement in AI decision-making.
Assessment Status
Status of a conformity or bias assessment.
AI System
An AI system subject to governance — the governance wrapper around one or more ML models and their serving infrastructure. An AISystem is the unit of governance: it is what gets risk-classified, assessed for conformity, and monitored for compliance. An AISystem links to the underlying ML components via wrapsMLModel and wrapsServingInfra, connecting the governance layer to the technical layer defined in the ML-Enabled Systems extension. Aligned with the EU AI Act definition: "a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments."
Risk Classification
A risk level assignment for an AI system. Records the assessed risk level, the rationale for the classification, the assessor, and the date. Risk classification determines which regulatory obligations apply under the EU AI Act.
Conformity Assessment
A formal assessment of an AI system against regulatory requirements or organizational AI governance policies. Records which principles were assessed, the assessment result (pass/fail/conditional), findings, and remediation actions.
Bias Assessment
An assessment of bias in an AI system — covering training data bias, model output bias, and deployment context bias. Records the bias metrics used, the protected attributes examined, the findings, and any mitigation measures applied or recommended.
Explainability Report
Documentation of how an AI system's decisions can be explained to affected persons, operators, and regulators. Covers the explainability method used (SHAP, LIME, attention maps, rule extraction), the level of explanation (local vs global), and the target audience.
Human Oversight Plan
A plan for human oversight of an AI system. Specifies the oversight mode (human-in-the-loop, human-on-the-loop, human-in-command), the roles responsible for oversight, escalation procedures, and the conditions under which human intervention is required.
AI Governance Policy
An organizational policy governing AI development and deployment. Defines the principles, standards, processes, and roles that apply to AI systems within the organization. May reference external frameworks (EU AI Act, OECD Principles, NIST AI RMF).
AI Incident
A record of an incident involving an AI system — bias events, safety failures, drift-induced errors, adversarial attacks, or privacy breaches. Records the incident description, affected parties, root cause analysis, and remediation actions.
Transparency Record
Documentation provided to users or affected persons about an AI system's behavior, capabilities, and limitations. Required by the EU AI Act for limited-risk and high-risk AI systems.
Data Governance Record
A record of data governance measures applied to training and evaluation data — data quality checks, representativeness analysis, consent verification, anonymization measures, and data retention policies.
AI Regulatory Compliance
Compliance of AI systems with applicable regulations — EU AI Act, GDPR, sector-specific regulations (financial services, healthcare, employment). Includes risk classification, conformity assessment, and ongoing monitoring obligations.
AI Accountability
Clear assignment of responsibility for AI system behavior — who is accountable for decisions made by or with AI assistance, who is responsible for monitoring, and who handles incidents.
AI Transparency
The degree to which AI system behavior, capabilities, and limitations are communicated to users, affected persons, and regulators. Includes disclosure obligations under the EU AI Act.
Human Oversight of AI
Ensuring appropriate human control over AI system decisions — the ability to understand, intervene in, and override AI outputs when necessary.
AI Governance Overview
High-level overview of AI governance across the organization — which AI systems exist, their risk classifications, conformity assessment status, and governing policies. The entry point for AI governance stakeholders.
AI Risk Assessment
Detailed view of AI system risk — risk classification rationale, bias assessments, explainability reports, and human oversight plans. Used for conformity assessment preparation and regulatory reporting.
AI Transparency & Disclosure
View of transparency obligations — which AI systems require disclosure to users, what transparency records exist, and what information is provided to affected persons.
AI Incident Tracking
View of AI incidents — bias events, safety failures, adversarial attacks, and their resolution. Used for post-incident analysis and continuous improvement of AI governance.
wraps ML model
Links an AI system governance wrapper to the ML model it governs.
wraps serving infrastructure
Links an AI system governance wrapper to the serving infrastructure it governs.
governed by
Links an AI system to the governance policy that applies to it.
has risk classification
Links an AI system to its risk classification.
classified as
The risk level assigned in a risk classification.
classification rationale
The rationale for the risk classification decision.
classification date
The date the risk classification was performed.
classified by
The stakeholder who performed the risk classification.
has conformity assessment
Links an AI system to a conformity assessment.
has bias assessment
Links an AI system to a bias assessment.
has explainability report
Links an AI system to its explainability documentation.
has human oversight plan
Links an AI system to its human oversight plan.
has transparency record
Links an AI system to its transparency documentation.
has data governance record
Links an AI system to its data governance documentation.
has incident
Links an AI system to an incident record.
assessed against principle
Links an assessment to the AI principle it evaluates.
assessment result
The result of an assessment — Pass, Fail, or Conditional with rationale.
assessment date
The date the assessment was performed.
assessed by
The stakeholder who performed the assessment.
assessment findings
Detailed findings from the assessment.
remediation action
Required or recommended remediation action based on assessment findings.
oversight mode
The mode of human oversight applied to an AI system.
oversight responsible
The stakeholder or role responsible for human oversight.
escalation procedure
Description of the escalation procedure when human intervention is required.
intervention conditions
Conditions under which human intervention is required.
incident date
The date the AI incident occurred.
incident description
Description of the AI incident.
root cause analysis
Root cause analysis of the AI incident.
incident severity
Severity of the AI incident (critical, high, medium, low).
policy scope
The scope of the AI governance policy (organization-wide, business unit, project).
references framework
External framework referenced by the policy (EU AI Act, OECD Principles, NIST AI RMF, ISO 42001).
policy effective date
The date the governance policy takes effect.
mandates principle
Links a governance policy to the AI principles it mandates.