Crosswalk
The layer between AI demand and AI delivery.
GOVBRM is not another AI governance framework. It is the operating layer that decides which AI demand should receive money, attention, autonomy and organisational change, and routes each item into the governance an organisation already has. This page shows where each stage hands off, and what GOVBRM does not replace. The worked examples below are written against UK, US, EU, Canadian, Australian, New Zealand and South African public-sector guidance; the same handoffs apply wherever you are, against whichever of these (or your own local equivalent) your organisation follows.
What GOVBRM does not replace. Business cases and their appraisal method (the UK Green Book's five case model is one version), procurement and commercial assurance, security assurance, privacy and data protection assessments, equality or anti-discrimination assessments, transparency records or registers, service or delivery assessments, an ISO/IEC 42001 management system, or delivery methods such as agile, PRINCE2 or product management. GOVBRM routes demand into them, in the right order, with the need, the value range, the autonomy rung and the owner already written down.
Different questions, different layers
Each framework answers its own question. GOVBRM answers the one before them.
| Framework | The question it answers | Where GOVBRM meets it |
|---|---|---|
| BRM Body of Knowledge (BRM Institute) | How does a relationship function create value with its partners? | Intellectual lineage: demand shaping, value realisation and value optimisation, expressed in GOVBRM's own words for AI demand. |
| UK AI Playbook | How should government use AI responsibly? Ten principles. | The Shape and Commit gates carry the principles on limitations, lawful and ethical use, security, human control, lifecycle, the right tool, commercial involvement and assurance. |
| Green Book | Is this investment worth it, against which options, and did it deliver? | The business case canvas feeds a five case model business case; it does not replace one. The Realise stage feeds monitoring and evaluation. |
| Technology Code of Practice | Is this technology designed, bought and run well? | User needs, accessibility, open standards, integration, purchasing strategy and sustainability are routed from the Design canvases. |
| Service Standard | Is this a good public service? | Discover and Adopt hand off to user research, whole-problem thinking, accessibility and performance data. |
| Data Ethics Framework and ATRS (UK) | Is the use of data and algorithms transparent, accountable and fair? | The risk canvas asks the scoping question for a transparency record, such as an Algorithmic Transparency Recording Standard entry, and routes to ethics review, contestability and redress. |
| EU AI Act and GDPR | Which risk tier does this AI system sit in, and is personal data processed lawfully? | The risk canvas and readiness score feed the classification and documentation an AI Act risk tier calls for; the data protection impact assessment step carries GDPR's lawful basis and DPIA requirements the same way UK GDPR is carried. |
| NIST AI Risk Management Framework (US) | How do we manage AI risk across the lifecycle? Govern, Map, Measure, Manage. | GOVBRM sits before and around it: it decides what enters the lifecycle and checks that value arrived. Assess maps, Realise measures. |
| Directive on Automated Decision-Making (Canada) | Does an automated decision system meet its required Algorithmic Impact Assessment level? | The risk canvas and readiness score ask the same questions an Algorithmic Impact Assessment does: impact, data quality, decision-making process and mitigation. |
| AI-in-government and Digital Service Standard (Australia, New Zealand) | How should public bodies use AI, and design a good service, responsibly? | The same Shape, Assess and Adopt gates carry Australia's policy for the responsible use of AI in government and Digital Service Standard, and New Zealand's Algorithm Charter for Aotearoa New Zealand. |
| ISO/IEC 42001 | How do we run an AI management system? | GOVBRM is not a management system and not an alternative to one. It can be the operational front door into one, and its records are evidence for it. |
| GOVBRM | Which AI demand should receive attention, money, autonomy and change, and did the value arrive? | Six stages, six gates, twenty canvases, one review that closes the loop. |
Stage by stage
Where each stage hands off.
The principle numbers below cite UK public guidance, because they can be checked against a published document. The same handoffs apply if your own governance runs through the EU AI Act and GDPR, the US NIST AI Risk Management Framework, Canada's Directive on Automated Decision-Making, Australia's and New Zealand's AI-in-government guidance, or South Africa's public finance and procurement legislation: substitute your own instrument at each gate.
| GOVBRM stage and canvases | UK guidance it routes into (worked example) | Standards | BRM Body of Knowledge |
|---|---|---|---|
| Discover 01 Opportunity, 02 Demand Shaping | Service Standard 1 and 2 (understand users and their needs; solve a whole problem). AI Playbook principles 1 and 6 (know what AI is and its limitations; the right tool for the job). Technology Code of Practice 1 (define user needs). | NIST AI RMF: Map. | Demand shaping; relationship strategy. |
| Assess 03 Intake, 04 Readiness, 05 Risk and Ethics | AI Playbook principles 2, 3 and 4 (lawful and ethical; secure; meaningful human control). Data Ethics Framework. Data protection impact assessment where personal data is involved. Equality impact assessment. The ATRS scoping question. Technology Code of Practice 6, 7 and 10 (secure; privacy; data). | NIST AI RMF: Map and Measure. ISO/IEC 42001: AI risk and impact assessment. | Value discovery; readiness. |
| Prioritise 06 Value Map, 07 Prioritisation, 08 Portfolio Heatmap | Green Book strategic case and option thinking. Portfolio management. AI Playbook principle 8 (work with commercial colleagues from the start). | NIST AI RMF: Govern. | Portfolio and value planning. |
| Design 09 Business Case, 10 Playbook, 11 Agent, 12 Vendor, 13 Prompt Governance, 14 Product Ownership | Green Book five case model (the canvas feeds it). Technology Code of Practice 3, 4, 9, 11 and 12 (open source; open standards; integrate and adapt; purchasing strategy; sustainability). AI Playbook principles 5, 8 and 10 (lifecycle; commercial; assurance). ATRS record where in scope. Security assurance. | NIST AI RMF: Govern and Manage. ISO/IEC 42001: lifecycle and supplier controls. | Business case; value planning. |
| Adopt 15 Stakeholder Impact, 16 Adoption, 17 Workforce Impact | Service Standard 3, 5, 7 and 8 (joined-up experience; everyone can use the service; agile; iterate). Technology Code of Practice 2 (accessible and inclusive). AI Playbook principle 9 (skills and expertise). Change management. | NIST AI RMF: Manage. | Value realisation; organisational change. |
| Realise 18 Benefits Realisation, 19 Value Review, 20 Capability Roadmap | Green Book monitoring and evaluation. Service Standard 10 (define success and publish performance data). Benefits management. AI Playbook principle 5 (the full lifecycle). | NIST AI RMF: Measure and Manage. ISO/IEC 42001: performance evaluation and improvement. | Value harvesting; value optimisation. |
Framework and standard names belong to their publishers. GOVBRM reproduces none of their text and is not affiliated with, endorsed by or certified against any of them. UK government guidance named here (the Green Book, AI Playbook, Technology Code of Practice, Service Standard, Data Ethics Framework and Algorithmic Transparency Recording Standard) is Crown copyright, used under the Open Government Licence v3.0. Numbers refer to the published principles and points of each document at the time of writing; check the current edition.
One demand, one journey, many assurance outputs
The Shape and Commit gates produce the inputs the other assurances need.
The problem in most organisations is not an absence of governance but its fragmentation: the same request is described five different ways to five different boards. A shaped request carries one need statement, one value range, one autonomy rung, one owner and one set of risk flags, and those feed:
From the Shape and Commit gates
One shaped request
- One need statement
- One value range
- One autonomy rung
- One named owner
- One set of risk flags
Written once, then reused by every assurance below instead of being described five ways to five boards.
Feeds these assurance outputs
- DPIAA privacy or data protection impact assessment
- EqualityAn equality or anti-discrimination assessment, and human rights where relevant
- TransparencyA transparency record or register, where one applies
- SecuritySecurity assurance and the information risk process
- CommercialCommercial and procurement assessment, including exit and lock-in
- Business caseThe business case, on whichever appraisal model applies
- Service assessmentA service or delivery assessment, where your organisation runs one
- A privacy or data protection impact assessment, where personal data is processed (a DPIA under UK or EU GDPR, or your own jurisdiction's equivalent)
- An equality or anti-discrimination assessment, and a human rights assessment where relevant
- A transparency record or register, where your jurisdiction requires one (the UK's Algorithmic Transparency Recording Standard and the EU AI Act's transparency obligations are two versions of this)
- Security assurance and the information risk process
- Commercial and procurement assessment, including exit and lock-in
- The business case, on whichever appraisal model applies (the UK Green Book's five case model is one version)
- A service or delivery assessment, where your organisation runs one (the UK's Service Standard and Australia's Digital Service Standard are two versions of this)
- Evidence for an ISO/IEC 42001 management system, where one exists
- A sustainability assessment: model size, inference volume, hosting and energy
- Accessibility, contestability, redress and human review for the people affected
Keep the door light
Governance burden in proportion to blast radius.
Twenty canvases and six gates would be a new bureaucracy if every request went through all of them. They do not. The front door routes by consequence, and most demand never needs more than a page.
Fast lane
Low risk, a known pattern, low autonomy. Self-service against a published pattern; no canvas beyond the intake record.
Standard lane
Moderate risk or value. BRM shaping at the Shape gate, a readiness score, and the Commit gate with an owner and a number.
Strategic lane
High consequence, public-facing, cross-boundary or high autonomy. Multidisciplinary governance, the full assurance set above, and the strategic portfolio view.
Every lane
Autonomy is one dimension of risk, alongside consequence, scale, reversibility, the population affected and how quickly a failure would be noticed. And one question is asked of every item: who bears the benefit, who bears the cost, and who has no seat at the table?
Status of the numbers
Initial calibration, version 1.0.
The scoring weights, the readiness and vendor thresholds, the exposure floors, the five-rung autonomy ladder and the month-nine default are practitioner design decisions, not measured constants. They are published so that they can be argued with and calibrated through use. Set the review point from the intervention's own value curve: a chatbot may show value in a month, a fraud model may take two years; nine months is the default, not a rule. The status of every mechanism, and what is still a hypothesis, is on the provenance page.