Making AI governance operational for critical infrastructure.
Keeping authority accountable.
AI systems no longer only inform. They decide and act. AIGN.Global helps boards and operators of critical infrastructure worldwide define what AI is authorised to do, control it in operation and prove it afterwards, with governance architecture, applied research and senior expertise.
Founded by Patrick UpmannAI governance advisor · author · architect of DART and AIGN Critical OS
Nine sectors · one authority question
Tap a sector on the radar to preview it, tap again to open it.
Documented: keynote and round table co-chair at the NATO SPS-supported Advanced Research Workshop on early warning for critical infrastructure, Yerevan (September 2026) · keynote at DESSERT’2026, the 16th International Conference on Dependable Systems, Services and Technologies, Corfu (October 2026)
AI Governance Report 2027
An independent view of AI governance going into 2027 for boards, operators of critical infrastructure and legal, risk and compliance leaders: where AI systems begin to act, which authority they hold, and what management and oversight must be able to evidence.
In preparationWhere machine authority meets critical infrastructure.
Choose a sector to see the authority question that matters most, what has to be governed, and where AIGN helps. The approach is not limited to a single legal definition of critical infrastructure (in German usage: KRITIS): what counts is the consequence a system can have for operations, customers, supply, safety and society. Regulatory mapping is EU-first (EU AI Act, NIS2, DORA, CER) and references international standards such as ISO/IEC 42001 and the NIST AI Risk Management Framework for organisations operating across jurisdictions.
Energy & utilities
“Which optimisation decisions may AI take autonomously, and where must a technical or human boundary always take precedence?”
Grid operators, generators and suppliers are moving AI from forecasting into operational decisions: dispatch, balancing, maintenance and customer processes. The governance question shifts from model quality to authority: what may the system change, and where must a technical or human boundary always win?
What to govern
- Optimisation goals set against safety, resilience and supply requirements
- Non-overrideable boundaries and fail-safe logic
- A clear separation between optimisation authority and safety functions
- Human intervention and incident evidence that stand up to audit
- Re-approval when models, data sources or integrations change
Frameworks in play
Water & wastewater
“Which control actions may an AI-supported system trigger in supply or treatment, and who can stop it, and how fast?”
Utilities use AI for leak detection, treatment optimisation and early warning. Once those systems start adjusting dosing, pumps or valves, governance has to define who may let them do so, and who can stop them.
What to govern
- An authority envelope for control actions in supply and treatment
- Runtime limits and escalation thresholds
- A clear separation between alert, recommendation and intervention
- Fail-safe behaviour when sensors, data or connectivity degrade
- Reconstructable action evidence after an incident
Frameworks in play
Transport & mobility
“What may an AI system change in scheduling, routing or traffic control without human confirmation?”
Rail, road, aviation, shipping and mobility platforms use AI to plan, route and react to disruption. The governance boundary that matters is the line between planning support and operational control.
What to govern
- A mandate and an owner for every automated change
- A clear line between planning support and operational control
- Human confirmation for safety-relevant changes
- Re-approval when tools, data or integrations change
- Evidence that links each change to its mandate
Frameworks in play
Telecom & digital infrastructure
“Which network, access and incident-response actions may an agent take, and under whose mandate?”
Network operators, cloud and data-centre providers are letting agents remediate incidents, change configurations and act on customer accounts. In digital infrastructure, an agent’s permissions are its authority.
What to govern
- Agent identity, permissions and tool access
- Separating what an agent can see from what it can change
- Approval thresholds for changes with service-wide impact
- Credential rotation and revocation when agents change or retire
- Action logs that attribute every change to an agent and a mandate
Frameworks in play
Financial infrastructure & payments
“At what point does a recommendation become financial authority to act?”
Banks, insurers, payment providers and asset managers are embedding AI in credit, payments, fraud and customer processes. The critical moment is when a recommendation becomes authority to act on money.
What to govern
- Transaction authority limits and human escalation
- Runtime controls and re-approval when rights expand
- Third-party and model dependencies in the ICT risk framework
- Action evidence for supervisors and audit
- Board reporting on material AI exposure
Frameworks in play
Healthcare & emergency services
“Which decisions stay reserved to humans, and can an AI-supported decision be reconstructed afterwards?”
Hospitals, emergency services and health providers use AI to prioritise, triage, schedule and communicate. Where time pressure is highest, governance has to make clear which decisions stay with people, and keep every AI-supported decision reconstructable.
What to govern
- Human-reserved decisions and escalation paths
- Oversight design that works under time pressure
- Traceability of inputs, outputs and interventions
- Change control for model and data updates
- Special-category health data and access rights
Frameworks in play
Public services & administration
“Who is accountable when an AI-supported decision reaches a citizen?”
Public administrations are preparing AI agents that handle procedures end to end. When an AI-supported decision reaches a citizen, accountability has to stay with a named public authority, and the state has to be able to prove what the agent was authorised to do.
What to govern
- Named human accountability for every delegated task
- Fundamental-rights impact and explanation paths
- The legal basis for any fully automated decision
- Procurement evidence for AI suppliers
- Records that let a decision be challenged and reviewed
Frameworks in play
Space & earth observation
“Who holds authority over AI-supported sensing, tasking and early warning derived from satellite data?”
Satellite operators, ground segments and earth-observation services use AI to task sensors, analyse imagery and issue early warnings. Authority has to be clear at each step, often across organisational and national borders.
What to govern
- Authority boundaries between analysis, alert and action
- Trusted use of shared data across organisational and national borders
- Accountability for alerts that trigger action elsewhere
- Evidence chains for early-warning decisions
- Access, export and dual-use constraints
Frameworks in play
Context: the 2026 NATO SPS workshop in Yerevan, where AIGN gave a governance keynote, covered aerial, unmanned and satellite sensing and AI-driven earth observation for early warning.
Defence & dual use
“Which decisions must remain reserved to humans, and how is delegated machine authority bounded, interrupted and evidenced?”
Defence and dual-use organisations need AI governance that holds up under independent challenge: which decisions remain reserved to humans, how delegated machine authority is bounded and interrupted, and how it is evidenced. AIGN works on governance, accountability and evidence, not on weapon systems or operations.
What to govern
- Human-reserved authority and intervention design
- Runtime enforcement, revocation and change control
- Separation of civil and defence use contexts for dual-use products
- Supplier and model dependencies
- Evidence that holds up under independent challenge
Frameworks in play
AIGN works on governance, accountability and evidence, not on weapon systems or operations. Participation in a NATO SPS workshop does not constitute NATO endorsement of AIGN.
The nine sectors are illustrative fields of application, not nine documented implementations, and the questions are not client cases. Which frameworks apply depends on jurisdiction, system, operator role and use context, and should be checked against the current legal texts. Whether an organisation or system is legally classified as critical infrastructure depends on national law.
AI governance for critical systems, built to run in operations.
For operators of critical infrastructure (in German usage: KRITIS), defence and dual-use organisations, regulated enterprises and the boards that oversee them. AIGN OS provides the overarching governance architecture. AIGN Critical OS extends it into critical and high-consequence environments, with particular attention to delegated machine authority and runtime controls. AIGN360 supports implementation and ongoing governance operations. The AIGN Trust Label provides an evidence-based assessment within a defined scope, while the Intelligence Hub tracks developments relevant to governance decisions.
Which AI systems in your critical processes exist, what may each of them decide or do, and can you prove it?
As long as AI only produces information, governance can focus on model quality, data, approval and human review. Once AI receives identities, permissions, tools, APIs, communication channels or access to operational systems, the question changes: the system now holds practically effective machine authority, the ability to trigger consequences within or on behalf of an organisation. AIGN OS provides the overarching governance architecture; AIGN Critical OS specialises it for critical and high-consequence environments, carrying authority governance into the runtime.
Nine control points, from mandate to retirement
AIGN OS 4.0 helps organisations classify AI systems before compliance, audit and liability questions arrive. It translates the EU AI Act, GDPR, ISO/IEC 42001, NIS2, DORA and other frameworks into operational controls, clear roles and auditable evidence, and it is delivered as modules that each produce concrete governance artefacts.
AI governance as an operated function.
AIGN360 turns AI governance from a policy project into a continuously operated function. It is a managed service that supports governance operations: reviewing AI use cases, maintaining documentation and evidence, tracking regulatory mapping, and coordinating responsibilities across business, legal, compliance, IT, data, HR, procurement and the boardroom. It is a monthly managed service with a defined scope, not open-ended consulting.
- Use case and governance baseline
- Role, responsibility and forum design
- Policy-to-process translation
- Evidence and documentation architecture
- Roadmap into managed operation
- Recurring governance reviews
- Control and documentation maintenance
- Regulatory mapping and change tracking
- Audit readiness and evidence support
- Risk, issue and escalation management
- Fractional AI governance leadership
- C-level and board-level decision support
- Prioritisation of critical AI risks
- Cross-functional stakeholder steering
- Defensibility under regulatory pressure
Engagements can start with Design and move into Operate. Scope is defined in onboarding.
The governance logic
Make AI governance visible, evidence-based and defensible.
The AIGN Trust Label is a visible, evidence-based governance signal for customers, partners, boards and audit-facing processes, based on the AIGN OS reference architecture and aligned with the EU AI Act, ISO/IEC 42001, GDPR, NIS2 and DORA. It reflects a private assessment within a defined scope, not proof that every operational control functions as intended.
The labels
From AI signal to governance action.
Regulation changes, vendor platforms evolve, agents enter workflows, industries differ, departments need different actions and boards need evidence. The Intelligence Hub gives each of these questions its own entry point: the Briefing explains what changed, the Index measures readiness, the Radars monitor exposure, and the Board & Audit Radar turns it into defensible oversight.
AI governance case studies from regulated and critical sectors.
Governance that holds up has to run in operations. Four cases from the founder’s operational track record and from AIGN’s own programmes, each with the regulatory setting, the mandate, what was delivered, and why it matters for governing AI that acts.
E.ON: consent, ownership and access as a controlled data foundation
- Delivered
- A customer data platform with consent automation; defined data ownership and access control.
- Result
- +30% efficiency in the data governance engagement.
- Relevance for AI governance
- Consent status, data ownership and access rights decide what an AI system may later use and reach. They are the data layer of every authority envelope.
Context & mandate
- Context
- Energy suppliers process customer data at scale under GDPR rules on consent and purpose limitation. Energy is a critical sector under NIS2 and German critical-infrastructure rules.
- Mandate
- Data Governance & Controls Architect (interim)
MEAG (Munich Re): an ISMS and risk framework ready for DORA and NIS2
- Delivered
- An ISMS and risk framework.
- Result
- DORA and NIS2 requirements operationalised.
- Relevance for AI governance
- AI agents in financial processes inherit this control environment. ICT risk, third-party risk and audit readiness are where machine authority has to be evidenced to supervisors.
Context & mandate
- Context
- MEAG is the asset manager of the Munich Re group and operates in a supervised financial environment. DORA, applicable since 17 January 2025, requires financial entities to maintain a documented ICT risk management framework.
- Mandate
- Risk & Audit Readiness Lead, DORA/NIS (interim)
BSR: deletion, retention and NIS2 readiness through an S/4HANA migration
- Delivered
- An SAP deletion and retention concept; NIS2 readiness and support for the S/4HANA migration.
- Result
- Deletion and retention concept delivered for SAP; NIS2 readiness supported alongside the migration.
- Relevance for AI governance
- A system migration changes permissions, data flows and retention at the same time. It is exactly the moment at which the authority of AI systems has to be re-approved.
Context & mandate
- Context
- BSR is Berlin’s municipal waste management company. Waste management is listed among the “other critical sectors” in Annex II of NIS2, and GDPR requires defined deletion and retention rules in core systems such as SAP.
- Mandate
- Regulatory Governance Lead, GDPR/NIS2 (interim)
Fayston Preparatory School, Seoul: the first AIGN Education Trust Label in Asia
- Assessed
- The label’s education criteria: AI usage and ethics framework, student protection, teacher and staff enablement, institutional oversight.
- Result
- In September 2025, the first institution in Asia to receive the AIGN Education Trust Label.
- Relevance for AI governance
- The label model works outside the EU and in an institution rather than an enterprise: governance evidence is built around the people affected, not the technology.
Context & mandate
- Context
- Schools are among the first institutions where AI-supported decisions affect children directly and have to be explainable to students, parents and teachers.
- Programme
- AIGN Education Trust Label
Context describes the public regulatory setting of each sector, not the client’s internal situation. Mandates and outcomes are as documented for each engagement; client work is shown with the role held, not as a client endorsement. The AIGN Education Trust Label is AIGN’s own private governance label, not an audit or accreditation. Full track record
Governing machine authority in high-consequence systems.
Applied research on machine authority, defensible autonomy and AI governance in critical infrastructure, early warning and other high-consequence environments: from governance principles to operational models for AI-enabled systems that can inform, decide and act. AIGN Research studies the authority, accountability and evidence structures needed to govern them, connecting AI governance, operational risk, technical control mechanisms and institutional oversight.
Under what conditions may an AI-enabled system act without real-time human confirmation, while human accountability remains clearly anchored?
- Operational mandates
- Delegated authority and authority boundaries
- Human accountability anchors
- Evidence of authorised behaviour
- Monitoring and early warning
- Escalation and human intervention
- Accountability for consequential actions
- Policy enforcement and monitoring
- Intervention mechanisms
- Logging and auditability
- Reconstruction of consequential system actions
- Distributed accountability
- Institutional coordination
- Shared operational authority
DESSERT’2026, Corfu.
2–4 October 2026, Corfu, Greece (hybrid). The 16th International Conference on Dependable Systems, Services and Technologies. 2026 theme: Dependable, Human‑Aligned and Cyber‑Physical AI Systems for a Safe, Secure and Sustainable World.
Listed by the conference as: Patrick Upmann, Founder & Research Lead, AIGN Research, AI Governance Advisor, Germany. A documented speaking engagement; it does not constitute an endorsement of AIGN by the conference organisers. Keynote abstract · Conference programme (PDF)
Advanced Research Workshop, Yerevan.
14–19 September 2026, Yerevan State University, Armenia. AI-Powered Monitoring Systems, Regional Data Sharing, and Models for Early Warning in Critical Services and Infrastructure.
Organised by the CenTRiS Foundation (Armenia) and the University of Calabria (Italy), with NATO SPS support under grant ARW.G9376. A documented speaking engagement; it does not constitute NATO endorsement of, or funding for, AIGN Research. View the workshop programme
Verifiable work, labelled by type.
Selected publications by Patrick Upmann, research lead of AIGN Research. Outputs are labelled by type; peer review is stated only where it has taken place.
ORCID: 0009-0001-6626-8531
Concepts from the research.
The concepts below run through the research, the advisory work and The AI Governance Operating Series. The three books are presented under Founder → Books.
Patrick Upmann
Machine Authority & Agentic AI Governance
Defensible AI Governance for boards, supervisory boards and operators of critical systems, with the goal of making Machine Authority controllable, traceable and defensible. Founder and architect of AIGN.Global and AIGN OS 4.0; author of The AI Governance Operating Series. Research lead of AIGN Research; keynote speaker at DESSERT’2026 (Corfu) and at the NATO SPS-supported Advanced Research Workshop in Yerevan.
Who gave the machine the authority to do that, and can you prove it?
I do not replace your AI governance, risk, compliance, security or internal audit function. I provide an external challenge at the point where they meet: the authority your organisation is actually giving the machine.
Author · The AI Governance Operating Series
Quoted internationally: Infobae Mundo · The New Africa Magazine | Verifiable delivery: audit readiness, governance operating models, access & control structures, +30% efficiency in one data governance engagement (E.ON).
Three moments to call.
Three steps to work together
- 90–120 minutes, confidential
- Output: Board Question Set and 90-Day Oversight Priorities
- Scope: 1 material agent or use case
- Typically 5 business days after evidence is available
- Fixed scope, fixed fee after scoping
- Output: Machine Authority Decision Memo and executive readout
The decision to deploy remains with the organisation. The review is an external governance challenge, not a certification or approval.
Request a scoping call- Monthly managed service
- Scope defined in onboarding
DART: the challenge for delegated machine authority
Not an enterprise governance model and not a regulatory standard: the proprietary executive test for what an AI system has actually been given and whether that delegation remains controllable. The core tool of every advisory engagement.
When AI acts, governance becomes a leadership question.
Support for supervisory boards, audit committees, executive boards and CEOs in steering and overseeing AI effectively when technical capability turns into real decision and action authority. The focus: strategy, value, materiality, accountability, Machine Authority, operational control and reliable evidence.
Three levels of responsibility, three different questions
Six dimensions of effective executive AI governance
Keynote topics
- When AI systems begin to act: authority, control and accountability in critical infrastructure.
- From innovation to implementation: governance frameworks for AI in critical sectors.
- Who gave the machine the authority? Board oversight of AI agents and delegated machine authority.
For organisers and media: speaker bio, headshot and talk abstracts are available on request. Formats: keynote (30–60 minutes), panel, executive workshop; English and German.
The AI Governance Operating Series.
“AI governance can no longer remain a policy exercise. The next era will be defined by evidence, classification, permission, runtime control and board-level assurance.”Patrick Upmann · The AI Governance Operating Series, 2026
Peer-reviewed status is stated only where it has taken place. All DOI-registered publications are listed under AIGN Research → Publications.
Where specific AI technologies, identity and IAM systems, coding agents, AI Spaces, chatbots, agentic systems, AI early-warning and control systems in critical infrastructure, AI security testing and deployment gates, enterprise Copilots, shadow AI, algorithmic CV screening, create structural governance exposure that boards cannot see until after the incident.
Where AI governance fails inside organisations: culture, time pressure, budget decisions, procurement gaps, institutional order, human factors and structural misalignment between intent and execution.
Where specific regulatory frameworks (EU AI Act, DORA, data protection law) meet real deployment decisions, and where AI use, including AI agents acting beyond their mandate, can create new or previously invisible liability, insurance and accountability exposure.
The track record is deliberately split into two distinct evidence lines, which are not mixed together.
The operational track record documents delivered governance, risk and compliance outcomes. The Critical sector label marks the sector classification, not a formal legal critical-infrastructure designation of the specific organisation. The selection shows the six most significant engagements in critical or regulated sectors.
Core expertise & sectors
A global AI governance network, and the capability to govern AI.
Practitioners, compliance professionals, technologists, educators and policymakers connected around one mission: responsible, accountable AI governance. The network is the human layer of AIGN OS, with sector peer groups such as Financial Services, Energy & Utilities, Healthcare and Public Sector. The Academy, the Fellowship and the education programmes build the capability.
The connected community for responsible AI.
Members come from business, government, academia and civil society. They contribute to benchmarks, pilots and trust labels, and get access to forums, events, knowledge resources and policy insights. Applications are reviewed continuously.
Regional programmes
A curated reference for AI governance professionals.
AIGN Circle is a controlled access layer that connects organisations with governance-ready professionals and gives professionals legitimate positioning without market noise. It is a curated global reference, not a marketplace, not a consulting firm and not an open community. Hiring support is a separate service, AIGN Talent. Human accountability sits at the centre.
- Controlled reference, not open search
- Professionals vetted for judgment and accountability
- Discretion on all sides
- No self-promotion or sales pressure
- Access to AIGN Sparring peer circles
- Positioning within the AIGN infrastructure
AIGN Sparring: peer groups with teeth
A curated, sector-specific peer circle for AI governance professionals who want structured challenge and defensible judgment before regulators, boards or auditors provide it. Not a course, not a webinar. Groups are capped at ten members, built for productive tension (diverse roles, same industry), and every application is read personally by Patrick Upmann.
Where governance expertise meets the roles that need it.
AIGN Talent is a specialist talent network for AI governance, data governance and regulatory experts. Many organisations are building governance competence in-house, and generic recruiting rarely evaluates this expertise well. Every candidate is assessed by governance practitioners rather than keyword matching.
For candidates
- AI governance and EU AI Act specialists
- Data governance and data protection leads
- DORA, NIS2 and GDPR implementation experts
- Regulatory transformation and compliance leads
- Risk, audit and assurance professionals
- Fractional and interim governance managers
For employers
- Financial services, insurance, healthcare
- Automotive, energy and critical infrastructure
- Technology companies building governance functions
- Public sector and government bodies
- Consulting firms building AI governance practices
- International organisations with EU AI Act exposure
The academy for operational AI governance.
Not another AI course. The AIGN Academy is the human capability layer of AIGN OS: professionals, teams and institutions learn to understand, operate, evidence and defend AI governance under real conditions. It is 100% online, 18–40 hours depending on the level, and produces reusable governance artefacts.
The Junior AI Governance Fellowship.
A global talent programme for students and emerging professionals who want to understand, research and shape AI governance: from regulation and risk to accountability, evidence and institutional trust. It is the entry point into the AIGN ecosystem and the first step towards the Academy. Remote, English-language, part-time, research-based and selective: a mentored research cohort for people who want to move beyond discussing AI governance and investigate a concrete institutional gap. Cohort fee: €299 one-time, incl. VAT. The founding cohort started in November 2026; applications are collected for the next cohort.
Accountable AI for every classroom.
Schools, universities and EdTech platforms need child-rights sensitive, transparent and accountable AI governance. Several educational AI uses fall into the high-risk category of the EU AI Act. AIGN offers an operating system for education and a governance label for institutions.
Join the network. Book your entry point.
Programmes for professionals and students are listed with their price. Places are application-based: you apply, we confirm your seat, and you receive the payment details. Organisation mandates are scoped individually.
The final price, including any applicable VAT, is confirmed before payment. Employers posting a role, organisations, boards and research partners: choose your entry under Contact.
AIGN.Global and Patrick Upmann, in brief.
Show imprintHide imprint
Information according to §5 DDG (German Digital Services Act)
Service provider:
Commercial Register Entry
Entry in the Commercial Register · Register Court: Munich · Registration Number: HRA 97344
VAT Identification Number
VAT identification number according to §27a of the German VAT Act: DE 814736585
Content Responsible according to §18 Abs. 2 MStV
Patrick Upmann (address as above)
Liability Notice
Despite careful content control, we assume no liability for the content of external links. The respective operators are solely responsible for the content of linked pages.
Copyright & Licensing
Copyright protects the concrete expression of the content and works on this site, not the underlying ideas, methods or procedures as such. Reproduction, editing, distribution and any use beyond the limits of copyright require the written consent of the author or creator. AIGN OS, AIGN-specific terminology, proprietary models, frameworks and toolchains are the intellectual property of Patrick Upmann / AIGN; commercial use of specifically licensed materials, software and protected implementation components requires a valid AIGN licence. Where content on this site was not created by the operator, third-party copyrights are respected and marked accordingly. Upon notification of infringements, we will remove such content immediately.
Show privacy policyHide privacy policy
1. Data Controller
The controller responsible for data processing on this website is:
2. Hosting & Server Log Files
When you access this website, the hosting provider automatically collects technical access data (IP address, date and time of access, page requested, data volume transferred, browser type/version, operating system, referrer URL) in server log files. This is technically necessary to operate and secure the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional and secure website). Server log files are deleted or anonymised after 30 days at the latest, unless further retention is required for security purposes.
3. Contact by Email
If you contact us by email or via a mailto link, the data you provide (e.g. email address, message content) is processed exclusively to handle your enquiry. Legal basis: Art. 6(1)(b) or 6(1)(f) GDPR. Data is deleted once no longer required, unless statutory retention obligations apply. A mailto link only opens your local email client; no data is transmitted to us unless you send an email.
4. Cookies & Local Storage
This site does not set tracking or analytics cookies and does not use browser local storage for tracking. Any interface preference stored locally (such as a collapsed/expanded state) is technical and is not used to identify you.
5. Fonts (No External Services)
This website does not embed Google Fonts or other externally loaded font services. Typography uses locally installed system fonts and, where used, self-hosted assets. No connection to third-party font servers is made.
6. Recipients & External Links
Recipients may include hosting, email and IT service providers engaged by us, to the extent necessary to operate the website and process your enquiry; these providers process data solely on our behalf. Beyond this, we do not share personal data with third parties. This site links to third-party platforms (including LinkedIn, Amazon, aign.global, now.digital). Following such a link takes you away from this website; the respective third party’s own privacy information applies to any data processing it carries out.
7. Your Rights as a Data Subject
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA).
Last updated: September 2026. This policy may require adjustment due to technical or legal developments.