Frameworks

A framework describes a regulation, standard or internal policy as a tree of risks, their sub-risks and the controls that address them. Each element can list the evaluations that provide evidence for it in its evaluation_keys. Frameworks are tenant-wide: they are registered once and shared by every AI app, unlike the entities declared in a run config.

# framework.yaml
kind: framework
key: "iso_42005"
display_name: "ISO 42005"
description: "Guidance for organisations conducting AI system impact assessments."
version: "Edition 1, 2025"
metadata:
  reference: "https://www.iso.org/standard/42005"
  author: "International Organization for Standardization (ISO)"
risks:
  - key: "D.1"
    display_name: "AI System Profile"
    description: "Maintain the profile of the AI system as input into risk management."
    controls:
      - key: "R.1.1"
        display_name: "AI System Description"
        description: "Ensure documentation describes what the AI system does and how it works."
        reference: "6.3.1"
        evaluation_keys:
          - "harmful_content"

Structure

Field Effect
key, version Identify the framework. A new edition of a standard is a new version of the same key.
risks The top-level elements of the framework. Each risk carries its own controls and may be broken down further into sub_risks, which carry controls of their own.
reference, citation Where the element comes from in the source document - the clause number and the quoted text - so a control can be traced back to the standard it implements.
evaluation_keys The keys of the evaluations that provide evidence for a risk, sub-risk or control. Every evaluation must already exist when the framework is added; --validate only checks the file’s structure, so an unknown key is reported only by lf add framework. Leave it out for an element no evaluation covers.
metadata Provenance and presentation attributes stored as-is, e.g. reference, author, type, region, coverage, icon, gradient.

Working with frameworks

Register a framework with lf add framework, which creates it or updates the existing one with the same key; --validate checks the file without applying it. lf list framework shows the registered frameworks, lf export framework writes one back to YAML that can be fed straight into lf add framework, and lf delete framework removes it.

Configuration

Properties

key string required

Unique identifier assigned to the entity in AI Platform.

Pattern: ^[a-zA-Z0-9_\-]+$
Max Length: 250

kind Literal “framework” required

The kind of entity described by this file.

display_name string required

The framework’s name displayed to the user.

description string

Short description of the framework.

Default: None

version string

Always “1” for now. Server-managed and reserved for future versioning support, so this is ignored when creating or updating a framework.

Default: 1

tags array[string]

Tags associated with the framework.

Default: []

domain array[string]

The domains the framework applies to, e.g. Cross-sector.

Default: None

metadata object

Provenance and presentation attributes stored as-is, e.g. reference, author, type, region, coverage, icon, gradient.

Default: None

risks array[SDKFrameworkRisk] required

The risks the framework covers.