BONSAI AI security and governance framework
Español

AI security and governance scaled to your organisation

Nine questions to find out which controls apply to you, why, and where to start.

Start the assessment Browse the framework

No sign-up and no accounts. Your answers stay in your browser.

Illustration of a bonsai with ten main branches, one for each domain of the framework. 1. AI Governance 2. Technical Security 3. Privacy and Data Protection 4. Explainability, Transparency and Fairness 5. Accountability 6. Human Oversight 7. Monitoring and Auditability 8. Sustainability 9. AI Risk Management 10. Proportionality and Lifecycle

What BONSAI is

An AI security and governance framework with 10 domains, 57 control areas, 3 tiers and 241 controls.

Why it is not linear

There are no levels to climb. Your role and what is at stake decide what applies to you; your size only decides how you apply it.

What you get

Your controls explained, your first stage, and an exportable checklist to implement and track them.

The four levels of the framework

10

domains

57

areas

3

tiers

241

controls

10 domains unfold into 57 control areas; each area groups its controls into 3 cumulative tiers; 241 controls in total.

The ten domains

  1. 1 AI Governance 11 areas · 79 controls
  2. 2 Technical Security 9 areas · 67 controls
  3. 3 Privacy and Data Protection 5 areas · 14 controls
  4. 4 Explainability, Transparency and Fairness 6 areas · 22 controls
  5. 5 Accountability 4 areas · 9 controls
  6. 6 Human Oversight 4 areas · 10 controls
  7. 7 Monitoring and Auditability 5 areas · 12 controls
  8. 8 Sustainability 4 areas · 7 controls
  9. 9 AI Risk Management 6 areas · 13 controls
  10. 10 Proportionality and Lifecycle 3 areas · 8 controls

All 57 areas How it works

Start the assessment

Role bounds the solution space; risk and regulation select within it; size changes the implementation, not the obligation.

Start the assessment Domain 1 · 1.1