MASTER-AI ™
Six domains, one governance function.
MASTER-AI ™ is a six-domain framework that maps the technical and organisational disciplines required to govern AI responsibly. It draws together the common threads in multi-jurisdictional laws and standards — including ISO 23894, ISO 27001, ISO 42001, the EU AI Act, the NIST AI RMF, and the UK's sector-based, pro-innovation approach.
Each of the six domain names forms the MASTER acronym — Model lifecycle, Algorithm explainability, Supply chain, Trusted data, Engaged humans, and Risk management — and together they feed into a central governance function, built on people, process, and technology, aligned to ISO/IEC 42001:2023, the world's first international standard for AI management systems.
Even the emerging standards have much more to say about how to structure AI governance than they do about the critical actions and technical controls to put in place. MASTER-AI ™ is not process theatre. It is the practical layer that sits on top of the standards — the actionable steps.
Every AI system has a lifecycle — trained, deployed, monitored, updated, and eventually retired. Most organisations have a clear picture of the deployment moment, and a much hazier picture of everything before and after. For boards, the key question is whether management has a model inventory — a documented register of every AI system in use, its purpose, its risk classification, and its current governance status. Without an inventory, you cannot govern what you cannot see.
When someone asks "why did the AI decide that?", can you answer? Explainability is not just a regulatory requirement under the EU AI Act — it is a basic condition of accountability. If your AI can make a consequential decision but no one can explain the reasoning behind it, you have a governance gap regardless of what the regulations say. This domain covers both technical explainability and operational explainability — communicating outputs to affected individuals in plain language.
Most organisations do not build their own AI — they buy it, licence it, or deploy it through third-party platforms. This does not reduce your governance obligations, it extends them. The EU AI Act is explicit: your compliance exposure includes the AI your vendors supply. Supply chain governance asks what AI is embedded in the software you purchase, and whether your contracts include appropriate representations about model safety and compliance. One of the most underdeveloped — and most material — risk areas in most organisations.
AI is only as good as the data it learns from and operates on. Poor data quality, unrepresentative training sets, and inadequate lineage tracking are among the most common root causes of AI failures — including the discriminatory outcomes that attract regulatory and reputational consequences. Trusted data governance covers data quality, training data documentation, bias detection, lineage, and alignment with GDPR. For organisations with existing data governance, the challenge is extending those frameworks explicitly to AI use cases.
AI governance is not a technology problem. It is a people problem. The most sophisticated technical controls will fail if the humans who interact with AI systems do not understand what they are doing, or feel empowered to challenge it. This domain covers AI literacy, human-in-the-loop design, and escalation pathways. It also covers leadership. An organisation that treats AI governance as a compliance burden to delegate to legal will produce compliance-on-paper. Leadership that genuinely engages with AI risk produces governance that actually works.
The final domain brings the other five together into a structured risk management approach — connecting AI governance to your existing enterprise risk framework, internal audit function, and board reporting. Risk management for AI covers classification, impact assessments, incident response, and ongoing monitoring cycles. ISO 42001 provides the management system architecture for this domain — a systematic, auditable approach that organisations can implement proportionately to their size and context.
