Governance is enforced at the authorization boundary: the point where an output becomes an effect-bearing action, and where evidence, not explanations, must exist.
Executive guides for the regulated enterprise, vertical by vertical. Each guide treats AI governance as an evidence and authorization problem, not merely a monitoring problem, and gives risk and compliance leaders a defensible path: risk tiering, regulatory mapping, examination readiness, and a maturity model that ends in independently verifiable governance.
AI does not present one governance problem. It presents three, and they do not share a control objective. The guides separate them cleanly, then show where the authorization boundary sits across all three.
Quantitative AI and machine learning that meets the model definition belongs in the model risk management track: effective challenge, validation, ongoing monitoring, and third-party accountability. Anchored to the 2026 revised guidance, SR 26-2.
Generative and communications AI carries books-and-records, supervision, and disclosure exposure. It is governed primarily through recordkeeping, review, supervision, and disclosure, not by treating every communications workflow as a model-validation exercise.
Effect-bearing and agentic AI must obtain an authorization verdict before an action executes. If the authorization artifact cannot be produced, the action fails closed.
Start with the series introduction, which establishes the vocabulary and the five tests. Then take the volume for your sector, where the same doctrine is applied to that regulatory reality: Financial Services, Healthcare, Federal Programs, and Government Contractors.
An Executive Guide to Runtime Authorization and Spotting the Fake
The entry point to the series. What runtime authorization is, the five tests that separate enforced governance from theater, the moves by which observation is presented as control, and the minimum bar to require in writing before AI touches consequential work.
Model risk management and regulatory compliance for AI in banking, broker-dealers, investment advisers, and insurers.
AI governance for providers, payers, and health systems, from clinical decision support to administrative automation.
AI governance through acquisition and oversight for federal programs, from contractor evidence requirements to Inspector General audit readiness.
AI governance for defense and civilian contractors, from contractor evidence packages and subcontractor flow-down to pre-award testing and Inspector General audit readiness.
Every guide is built on one evidentiary standard. The Five Tests Standard (5TS) defines what it means for an AI action to be governed. It is a published standard.
The maturity endpoint is Level 5, Independently Verifiable: every consequential action produces a tamper-evident authorization artifact, with evidence sufficient for independent replay.
5TS standard DOI: 10.5281/zenodo.21040295Written for risk, compliance, clinical, acquisition, audit, and AI governance leaders responsible for AI systems in regulated or public-sector environments.
The series introduction and all four volumes are available under CC BY 4.0 from FERZ, Inc. For help applying the framework in your organization, request a consultation.