Frameworks

A framework describes a regulation, standard or internal policy as a tree of risks, their sub-risks and the controls that address them. Its mappings link those elements to evaluations, so an evaluation run becomes the evidence for a control. Frameworks are tenant-wide: they are registered once and shared by every AI app, unlike the entities declared in a run config.

# framework.yaml
kind: framework
key: "iso_42005"
display_name: "ISO 42005"
description: "Guidance for organisations conducting AI system impact assessments."
version: "Edition 1, 2025"
metadata:
  reference: "https://www.iso.org/standard/42005"
  author: "International Organization for Standardization (ISO)"
risks:
  - key: "D.1"
    display_name: "AI System Profile"
    description: "Maintain the profile of the AI system as input into risk management."
    controls:
      - key: "R.1.1"
        display_name: "AI System Description"
        description: "Ensure documentation describes what the AI system does and how it works."
        reference: "6.3.1"
mappings:
  - evaluation_key: "harmful_content"
    control_key: "R.1.1"

Structure

Field Effect
key, version Identify the framework. A new edition of a standard is a new version of the same key.
risks The top-level elements of the framework. Each risk carries its own controls and may be broken down further into sub_risks, which carry controls of their own.
reference, citation Where the element comes from in the source document - the clause number and the quoted text - so a control can be traced back to the standard it implements.
metadata Provenance and presentation attributes stored as-is, e.g. reference, author, type, region, coverage, icon, gradient.
mappings The links between framework elements and evaluations. Each mapping names exactly one of risk_key, subrisk_key or control_key, plus the evaluation_key that provides evidence for it. The evaluation does not have to exist yet.

Working with frameworks

Register a framework with lf add framework, which creates it or updates the existing one with the same key; --validate checks the file without applying it. lf list framework shows the registered frameworks, lf export framework writes one back to YAML that can be fed straight into lf add framework, and lf delete framework removes it.

Configuration

Properties

key string required

Unique identifier assigned to the entity in AI Platform.

Pattern: ^[a-zA-Z0-9_\-]+$
Max Length: 250

kind Literal “framework” required

The kind of entity described by this file.

display_name string required

The framework’s name displayed to the user.

description string required

Short description of the framework.

version string required

The framework version, either semantic (1.2.0) or date-based (06/2024).

tags array[string]

Free-form labels cataloguing the framework’s subject matter. Unrelated to the tags used to organise entities in AI Platform.

Default: None

domain array[string]

The domains the framework applies to, e.g. Cross-sector.

Default: None

metadata object

Provenance and presentation attributes stored as-is, e.g. reference, author, type, region, coverage, icon, gradient.

Default: None

risks array[SDKFrameworkRisk] required

The risks the framework covers.

mappings array[FrameworkElementEvaluationMapping]

The links between the framework’s elements and evaluations.

Default: None