{
  "name": "Model Governance Index Guides",
  "as_of": "2026-07-14",
  "count": 4,
  "guides": [
    {
      "slug": "ai-governance-audit",
      "name": "AI Governance Audit",
      "category": "audit-methodology",
      "url": "https://modelgovernanceindex.com/guides/ai-governance-audit",
      "primary_keyword": "ai governance audit",
      "search_volume": 200,
      "aka": [
        "AI governance audit methodology",
        "AI audit"
      ],
      "methods": [
        "Governance-structure review: confirming a named accountable owner, a documented AI inventory, and defined escalation paths exist and are followed in practice, not just on paper",
        "Framework gap assessment: mapping current-state controls against a named framework's specific functions or clauses (e.g. NIST AI RMF's Govern/Map/Measure/Manage, or ISO 42001's Annex A controls) and identifying specific unmet requirements",
        "Control testing: sampling actual AI system records (risk assessments, model validation results, monitoring logs) to confirm documented controls were genuinely performed, not just described in policy",
        "Three Lines Model application: for internal-audit-led engagements, explicitly separating first-line (build/operate), second-line (risk/compliance oversight), and third-line (independent audit) responsibilities per the IIA's model",
        "Findings and remediation tracking: a written report of specific, closable gaps tied to the framework clause or control they violate, not a vague maturity score"
      ],
      "framework_slugs": [
        "nist-ai-rmf",
        "iso-iec-42001",
        "iia-ai-auditing-framework",
        "iia-three-lines-model-ai-governance"
      ]
    },
    {
      "slug": "llm-security-testing",
      "name": "LLM Security & Red-Team Testing",
      "category": "vendor-sourcing",
      "url": "https://modelgovernanceindex.com/guides/llm-security-testing",
      "primary_keyword": "llm security testing",
      "search_volume": 100,
      "aka": [
        "LLM red teaming",
        "AI red-team testing",
        "prompt injection testing"
      ],
      "methods": [
        "Automated adversarial prompt testing: running large libraries of known and generated adversarial prompts against the target system to find prompt-injection and jailbreak vulnerabilities",
        "Manual red-teaming: security researchers manually probing for novel attack chains an automated scanner would miss, including multi-turn conversation attacks",
        "Data-leakage and exfiltration testing: attempting to extract system prompts, training data artifacts, or other users' context through crafted inputs",
        "Agent-specific testing: for autonomous or tool-using AI agents, testing whether the agent can be manipulated into taking unintended actions (e.g. unauthorized API calls, data access outside its intended scope)",
        "Supply-chain and model-integrity checks: scanning third-party or fine-tuned models for embedded malicious behavior or tampering before deployment"
      ],
      "framework_slugs": []
    },
    {
      "slug": "ai-governance-consultants",
      "name": "AI Governance Consultants",
      "category": "vendor-sourcing",
      "url": "https://modelgovernanceindex.com/guides/ai-governance-consultants",
      "primary_keyword": "ai governance consultant",
      "search_volume": 60,
      "aka": [
        "AI governance advisory",
        "AI governance program design"
      ],
      "methods": [
        "Current-state assessment: interviewing stakeholders and reviewing existing AI use to build an honest baseline before recommending a target framework",
        "Framework selection and mapping: recommending a primary framework based on your regulatory exposure and sector, then mapping your specific systems and use cases against it",
        "Governance operating model design: defining roles (first-line, second-line, and audit per the Three Lines Model), a risk-tiering methodology, and a review cadence",
        "Policy and documentation drafting: producing the actual written policies, intake forms, and risk-assessment templates a program needs to operate, not just a slide deck",
        "Change management and training: helping the organization's teams actually adopt the new process, which is frequently the real point of failure in governance program rollouts"
      ],
      "framework_slugs": [
        "nist-ai-rmf",
        "iso-iec-42001"
      ]
    },
    {
      "slug": "ai-compliance-consultants",
      "name": "AI Compliance Consultants",
      "category": "vendor-sourcing",
      "url": "https://modelgovernanceindex.com/guides/ai-compliance-consultants",
      "primary_keyword": "ai compliance consultant",
      "search_volume": 50,
      "aka": [
        "AI regulatory compliance",
        "EU AI Act compliance",
        "ISO 42001 certification support"
      ],
      "methods": [
        "Regulatory applicability assessment: determining which of your specific AI systems fall under a given regulation's scope (e.g. EU AI Act high-risk Annex III categories) and which don't",
        "Control and evidence mapping: linking your existing technical and policy controls to the specific clauses or articles they satisfy, and flagging genuine gaps",
        "Certification support: for ISO 42001 specifically, preparing the Statement of Applicability and internal audit evidence needed before an accredited third-party certification audit",
        "Continuous compliance monitoring: software-platform-based tracking of AI system inventory against a regulation's requirements as both the regulation and your systems change over time",
        "Cross-framework mapping: for organizations subject to multiple overlapping requirements, mapping controls once and showing which framework(s) each control satisfies"
      ],
      "framework_slugs": [
        "eu-ai-act",
        "iso-iec-42001"
      ]
    }
  ]
}