G3 provides an evidence-led framework for examining how technology-enabled and AI-enabled systems are governed within a defined organisational and operational context.
Review is limited to submitted information and documentary evidence concerning system scope, accountable ownership, human oversight, decision traceability, lifecycle governance, monitoring, change, risk and incident arrangements.
G3 examines whether governance arrangements for a defined technology-enabled or AI-enabled system can be evidenced in practice. It considers the records through which responsibility, authority, oversight, intervention, change and escalation are made traceable.
Scope is established through the written enquiry and evidence route. A G3 review applies only to the identified system or use case, the submitted information and the evidence position at the time of review.
G3 does not determine technical safety, model accuracy, operational effectiveness, cybersecurity, data quality or suitability for deployment.
Examines whether the system, use case, decision context, affected process and operating boundaries are clearly identified.
Illustrative documentary evidence may include:
approved system or use-case descriptions
intended-purpose and restricted-use records
system-boundary, dependency and affected-process documentation
documented scope and materiality decisions
The evidence position records whether the defined scope and boundaries are documented; it does not determine whether the system is suitable for deployment.
Examines whether accountable ownership, operational roles and decision authority can be identified for the defined system.
Illustrative documentary evidence may include:
named system, business and governance owners
responsibility matrices and delegated-authority records
approval, acceptance and decision records
accountability arrangements for third-party systems and services
The evidence position concerns documented ownership and authority within the defined scope; it does not confirm that those arrangements are effective in every operating circumstance.
Examines whether human review, challenge, intervention and escalation arrangements are defined and supported by accountable records.
Illustrative documentary evidence may include:
human-review criteria and decision thresholds
intervention, override, pause and fallback authorities
escalation routes and exception-handling procedures
records of material challenge, intervention or override
G3 examines whether oversight and intervention arrangements are evidenced; it does not test their technical or operational effectiveness.
Examines whether material decisions, approvals, interventions, exceptions and governance activity can be traced through retained records.
Illustrative documentary evidence may include:
decision and approval logs
intervention, override and exception records
system-change and governance-review records
evidence provenance, version-control and retention information
Traceability records show what can be evidenced within submitted information; they do not establish that every underlying decision was correct.
Examines whether responsibility and decision-making across acquisition, development, testing, deployment, material change and retirement are documented.
Illustrative documentary evidence may include:
lifecycle responsibility and approval records
documented data, model and system review activity
acquisition and third-party dependency records
deployment, material-change and retirement decisions
G3 examines documentary lifecycle governance and does not validate data quality, model accuracy or technical system performance.
Examines whether monitoring, material change, risks, incidents, exceptions and unresolved concerns have defined ownership, reporting and escalation routes.
Illustrative documentary evidence may include:
monitoring responsibilities and reporting records
material-change thresholds and approval records
risk, issue, incident and exception registers
escalation, remedial-action and closure records
periodic system-governance review records
The evidence position does not confirm the absence of risk, operational effectiveness or legal and regulatory compliance.
The evidence relevant to a G3 review depends on the defined system, use case, governance context and review scope. Documentary evidence may be held across technology, operational, risk, legal, compliance, data, procurement and governance functions.
system and use-case inventories
intended-use and operating-boundary records
ownership and responsibility matrices
decision, approval and acceptance records
human-oversight and intervention procedures
decision, activity, exception and change logs
data, model and system lifecycle records
monitoring and periodic-review reports
risk, issue, incident and escalation records
third-party governance and dependency records
remedial-action and closure records
retention, provenance and version-control information
The presence of a document does not by itself establish that a governance arrangement is fully evidenced. Evidence is considered within the defined scope, in context and against the submitted information as a whole.
IGSB records evidence positions using four controlled classifications:
Information required for the defined evidence question has not been provided.
Submitted information does not evidence the relevant governance requirement or control.
Submitted information provides some relevant evidence, but material elements remain incomplete, unclear or insufficiently traceable.
The relevant governance requirement or control is evidenced within the material reviewed.
These classifications describe the documentary evidence position only.
They do not establish that governance of the system is legally sufficient, operationally effective, regulator-approved or certified.
G3 considers the governance evidence surrounding technology, automated decision-making and AI-enabled systems.
G1 considers board-level authority, oversight and accountability.
G2 considers institutional structures, delegated responsibilities, control ownership and organisational governance.
A defined review may use G3 alone or combine it with G1 and G2 where technology-governance, board and institutional evidence are materially connected. Use of more than one G-Series standard does not imply that every domain is assessed.
View G1 Board GovernanceView G2 Institutional GovernanceAn organisation may raise a written enquiry concerning the governance evidence for a defined technology-enabled or AI-enabled system.
Depending on scope and evidence position, the route may involve:
Route stages are determined by scope and evidence position. Progression is not automatic and does not constitute certification, assurance or confirmation of regulatory compliance.
View the AI Governance Evidence RouteG3 Technology & AI Governance may be supported by the G-Series AI Governance Evidence Readiness Programme, which provides a structured route for organising, reviewing and classifying AI governance evidence relating to oversight, accountability, traceability and control.
The Programme connects G3 evidence expectations with the G-Series Governance Evidence Protocol, Governance Evidence Passport, readiness review activity and written observation pathways.
The G-Series AI Governance Evidence Passport may support G3 Technology & AI Governance by providing a structured evidence record for AI-enabled systems, vendor platforms, internal AI use cases and operational technology environments.
It may support evidence organisation, evidence classification, readiness review activity, written observation or G3 Readiness Snapshot preparation.
G3 does not provide:
legal advice
regulatory approval
confirmation of compliance
audit assurance
accreditation
certification
confirmation of technical safety or model validation
deployment-approval decisions
implementation consultancy
confirmation of the absence of bias
Any G3 observation or controlled pre-assessment remains limited to the agreed scope and the information submitted.
Responsibility for system governance, legal duties, regulatory obligations, decisions and ongoing oversight remains with the relevant organisation and accountable decision-makers.
Organisations considering G3 should identify the relevant technology-enabled or AI-enabled system, use case or decision context and briefly explain the documentary evidence question they wish to examine. Do not send confidential, privileged, personal or operationally sensitive evidence at initial contact. IGSB will confirm any controlled submission route in writing.
Submit a Written EnquiryA public overview of the G3 Technology & AI Governance Standard is available as a downloadable PDF.
Download Public G3 Overview PDF%20(2).png)