IT Governance — SI assurance and compliance

Training

Certified Super Intelligence Governance Professional

A formal framework for governing Super Intelligence, organised in accordance with the White House Accord on Super Intelligence and international standards for the governance of information and technology.

Govern SI · Implementing the White House Accord through ISO standards and SI Governance

1. Introduction and Scope

This super intelligence (SI) governance certification scheme is organised around four layers of controls and audits. It addresses the duties of the governing body in respect of purpose, value generation, strategy, oversight, accountability, stakeholder engagement, leadership, data and decisions, risk, social responsibility, and viability.

The scope of the scheme includes the governing body’s alignment of assurance objectives to the organisation’s purpose and risk appetite, and the legal requirements applicable to prohibited practices, lawful processing of personal data, and related duties form a non-negotiable floor. The governing body determines the relative priority of objectives above that floor. An independent committee of the board receives reports from the internal team responsible for the controls and from the independent external auditor or evaluator, and ensures that identified deficiencies are remediated.

2. The Four Layers of SI Governance

Each organisation that trains or deploys frontier models is required to implement the following four layers:

  1. Internal controls that monitor the capabilities and alignment of models during training and deployment, including in respect of cybersecurity, biosecurity and chemical threats, and that prevent models from accessing technical systems in unintended ways.
  2. An internal team empowered to verify that the controls, monitoring and detection operate as intended and to remediate any deficiencies.
  3. An independent external auditor or evaluator that assesses whether the controls, monitoring and detection operate as intended.
  4. An independent committee of the board of directors that receives reports from the internal team and from the external auditor or evaluator, and that ensures remediation of identified issues.

The system of internal control comprises identity and authentication arrangements, a task contract that cannot be altered by the training process or the agent, controls over memory, tools and runtime, fail-closed behaviour for side-effect tools, treatment of external inputs as untrusted, and a stop mechanism external to the model that takes precedence over in-flight operations. A control lacking a named owner is not regarded as operating. A breach of a first-ranked objective suspends use pending reopening of the relevant decision.

3. Domains of the Scheme

The following domains define the governing body’s duties. In each domain the governing body is required to produce a reconstructable record demonstrating that the duty has been discharged. The tests of alignment to intended purpose, matching of responsibility to authority, competence of the governing body, transparency and reconstructability of process, and visibility of conditions across the life cycle apply throughout.

Domain 1: Purpose for Super Intelligence Systems

The governing body shall ensure that the use of Super Intelligence systems is aligned with the organisation’s reason for existence and with a documented intended purpose. Organisational purpose, the purpose of any processing of personal data, and the intended purpose of the SI system shall be maintained as distinct but related concepts. A change in intended purpose constitutes a material event requiring reassessment.

Objectives

Required practices

Domain 2: Value Generation

The governing body shall ensure that value generated by Super Intelligence systems for stakeholders is defined, created, captured and sustained in a manner consistent with organisational purpose and values. Value comprises residual-risk-adjusted outcomes together with associated costs, including the costs of evaluation, re-certification and oversight where a catalogue is claimed. A certificate is not itself a measure of value.

Required tasks

Domain 3: Strategy

The governing body shall direct the strategic planning for Super Intelligence so that the strategic frame, priorities, resource commitments and adaptation mechanisms remain consistent with organisational purpose and the value model.

Required tasks

Domain 4: Oversight

The governing body shall maintain oversight of Super Intelligence systems throughout the life cycle. The independent committee of the board shall receive reports from the internal team and the external evaluator and shall ensure that deficiencies are remediated.

Required tasks

Domain 5: Accountability

The governing body shall demonstrate accountability for the lawfulness, trustworthiness, fairness, integrity, effectiveness, efficiency, resilience and explainability of Super Intelligence systems. Responsibility shall match authority. Named individuals shall be accountable for outcomes and for residual-risk acceptance.

Required mechanisms

Domain 6: Stakeholder Engagement

The governing body shall establish arrangements for engagement with stakeholders affected by Super Intelligence systems so that their expectations are identified, considered and responded to, and so that reporting remains accurate and current.

Required activities

Domain 7: Leadership

The governing body shall exercise ethical and effective leadership of Super Intelligence systems, demonstrate commitment to the internal control system, and maintain that leadership throughout the life cycle.

Required tasks

Domain 8: Data and Decisions

The governing body shall treat data as a governed resource for Super Intelligence systems and shall direct the management of risks arising from different classes of data and processing. Processing of personal data shall be limited to what is necessary for the documented legitimate purpose.

Required tasks

Domain 9: Governance of Risk

The governing body shall determine the nature and extent of risks that the organisation is prepared to accept in the use of Super Intelligence systems, and shall oversee the management of residual risk so that appetite is not exceeded. Appetite shall be set below available capacity, including capacity for intervention and for evaluation activities where a catalogue is claimed.

Required tasks

Domain 10: Social Responsibility

The governing body shall ensure that decisions and activities relating to Super Intelligence systems are aligned with broader societal expectations concerning human rights, inclusion, fairness, the natural environment and democratic processes.

Required activities

Domain 11: Viability and Performance Over Time

The governing body shall assess whether Super Intelligence systems remain capable of delivering their intended purpose under changing conditions, including constraints arising from energy, water, land and community considerations associated with supporting infrastructure, and shall decide on continuation, remediation or withdrawal with matched authority.

Required tasks

4. Implementation

Implementation proceeds by the following sequence. The governing body first records the alignment of assurance objectives to organisational purpose and the order of priority. Management then incorporates the task contract and the external stop into operational change procedures. The internal team operates the controls and remediates deficiencies. Internal audit reviews the design and operation of the system against the ranked objectives and reports to the independent committee. An independent external auditor or evaluator performs a separate assessment. The independent committee ensures that any identified deficiencies are remediated and, where the deficiency concerns a first-ranked objective, that the relevant decision is reopened.

The domains set out above, together with the associated Direct practices and structured walkthroughs, provide the means by which the governing body demonstrates that it has directed the Super Intelligence system and that the four layers of the Accord are in place.

5. Intended Users

The scheme is intended for use by trainers, implementers, governance risk and compliance personnel, internal and external auditors, and certification bodies that require a defined basis for assessing conformance of Super Intelligence governance arrangements.