# GOV-08 Board reporting cadence

Domain: GOV Governance & Accountability · HI-AAF v1.3 · Public review · https://humanintel.net/standard/gov/gov-08

Material AI agent risks are reported to executive leadership and, where appropriate, to the board on a defined cadence.

The board, or an equivalent designated governance committee, receives at a documented cadence (no less than annually for L3) a written report on the organization's AI agent estate: number of agents in scope, material incidents in the period, maturity trend, and any controls failing to operate.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for GOV-08: At least one board-level or executive-level AI risk report has been delivered in the prior twelve months; the report covers agent inventory, incidents, and maturity posture; delivery evidence is retained.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- At least one board-level or executive-level AI risk report has been delivered in the prior twelve months.
- The report covers agent inventory, incidents, and maturity posture.
- Delivery evidence is retained.

## Framework mappings

- NIST AI RMF: GOVERN 4.1, GOVERN 4.2
- ISO/IEC 42001: 5.1, 9.3
- SOC 2 (TSC): CC1.2
- EU AI Act: Art. 9(1)
- Singapore: MAIGF Internal Governance, AI Verify Accountability

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, GOV-08 Board reporting cadence. Public review edition, July 2026. https://humanintel.net/standard/gov/gov-08