Why now
of companies using generative AI have no governance structure for managing its risks.
of agentic AI projects will be cancelled by the end of 2027, with inadequate risk controls among the reasons.
of organisations are satisfied with their AI governance staffing. The rest are hiring people who still have to learn the trade.
year-on-year growth in demand for AI governance skills.
The work is known. The owner usually is not. This book assigns it: a role per knowledge area, a responsibility per role, a mandate per AI agent.
Who it is for
The book has eleven role-based reading paths. These are the five chosen most often.
CIO and board
You have to bring a proposal to the board that holds up. Path: executive summary, KA1 AI Governance, the CIO 30-day plan and the maturity model.
Enterprise architect
You have to fit AI into an existing landscape without breaking it. Path: KA3 architecture, the four planes with the cognition plane, the meta-model and the ArchiMate model you can download freely.
AI governance officer, CDO, privacy officer
You have just become the owner of something that does not exist yet. Path: KA1, KA9 risk, KA10 compliance, the role model with RACI and the EU AI Act checklist.
CHRO and HR
You have to organise AI literacy and new roles. Path: KA13, the adoption roles AI Ambassador and AI Prompting and Agents Specialist, and the Article 4 evidence in the Toolkit.
Project lead and product owner
You are taking an AI system to production for the first time. Path: the 8-phase lifecycle with gate criteria, the sprint checklist and the model card.
Knowledge Areas
From AI Governance to AI Literacy (KA13). Each area with activities, roles, metrics and standards.
Roles
Complete role model with 22x13 RACI matrix, separation of duties and two adoption roles: AI Ambassador (Role 21) and AI Prompting & Agents Specialist (Role 22).
Failure Modes
22 patterns where agentic and cyber-physical AI structurally fails - including drill scenarios and cognition-plane binding.
Lifecycle Phases
From ideation to decommissioning, with feedback loops, gate criteria and sprint checklists.
Templates
Governance Charter, Model Card, EU AI Act Checklist, Maturity Assessment and Shadow AI Inventory.
How the AI-BOK relates to the standards
Not a replacement for ISO, NIST or the law. The layer on top that says who does it.
| Framework | What it gives | What it does not give | What the AI-BOK adds |
|---|---|---|---|
| ISO/IEC 42001 | A certifiable management system for AI | No knowledge areas, no role model | 13 knowledge areas and 22 roles that assign the management system requirements |
| NIST AI RMF | Four risk functions: govern, map, measure, manage | No organisational design | Roles, RACI and 22 failure modes per function, with drill scenarios |
| EU AI Act | Obligations per role and risk class | No implementation guide | Mapping of provider and deployer onto the role model, a checklist and Article 4 evidence; v1.3 incorporates the Digital Omnibus |
| DAMA-DMBOK and TOGAF | The data and architecture disciplines | The AI-specific knowledge | The AI layer on top: a gap analysis per knowledge area and an ArchiMate reference architecture with four planes |
| IAPP AIGP | Certification of the professional in four knowledge domains | The organisational side | The operating model that assigns that knowledge inside the organisation: who, what, when |
Choose your edition
Both editions contain the same complete content with 18 diagrams
AI Body of Knowledge
255 pagesAI Body of Knowledge (NL)
Het referentiekader voor AI-governance, lifecycle management en organisatie-inrichting
AI Body of Knowledge
308 pagesAI Body of Knowledge (EN)
The reference framework for AI governance, lifecycle management and organizational design
Five readers, both editions
For the governance team working on it together: five readers within one organisation, both editions, one invoice.
- ✓Up to five readers within your organisation
- ✓EN + NL edition included
- ✓Free updates during the first year
Read first
The sample contains the cover, the table of contents, the executive summary, where to start and the complete knowledge area KA1 AI Governance. Eighteen pages, no e-mail address needed.
AI-BOK Toolkit v1.3
Five working files alongside the book: ArchiMate modelling conventions, KA9 risk-control library (YAML), maturity calibration kit, AI procurement clauses and filled example templates. Drop into your own organisation right away.
- ✓ArchiMate modelling conventions (purist mapping)
- ✓KA9 risk-control library (YAML checklist)
- ✓Maturity calibration kit + inter-assessor protocol
- ✓AI procurement clauses for contracts
- ✓Filled example templates (Charter, Model Card, IAMA, Article 4 evidence)
ZIP with 5 PDFs (branded, ready to read) + Markdown sources + README (~970 KB). Dutch edition available on the Dutch page. Buyers of the book get the Toolkit straight from their download link.
Sneak peek inside the book
Four of 18 diagrams from the AI-BOK - free preview
The 13 knowledge areas with AI Governance as the central hub
The AI Lifecycle Model with 8 phases and 4 feedback loops
Knowledge areas mapped onto the four planes (Data / Control / Cognition / Management)
Eleven role-based reading paths plus the MVG-7 growth path - extended in v1.3
RACI matrix with 22 roles
Who is responsible, accountable, consulted and informed per knowledge area? The complete RACI matrix eliminates ambiguity.
5 ready-to-use templates
Governance Charter, Model Card, EU AI Act Checklist, Maturity Assessment and Shadow AI Inventory. Ready to fill in.
CIO 30-day plan
Week by week concrete actions to get AI governance off the ground. From inventory to board decision in one month.
Prefer listening?
Discover the essence of the AI-BOK in a podcast episode — available in Dutch and English.
AI-governance werkt pas als architectuur
A debate: IT operations defends guardrails and strict permissions — but a filter checks whether an agent may act, not whether its reasoning holds. On the bounded deviation envelope and policy-as-code.
Why AI Policies Fail at Runtime
Your AI policy is a PDF your agent cannot read. Why governance fails outside the runtime path, and how the cognition plane makes mandates enforceable: the authority register, reasoning boundaries, and the runtime trace that stands up in an audit.
Securing Enterprise AI with the AI-BOK
How do you govern AI at enterprise scale? From the 13 knowledge areas and the cognition plane to operationalising the EU AI Act.
Governing Autonomous Non-Human Identities
AI agents as digital employees: why they need a formal identity profile, lifecycle management and a human owner. About the cognition plane, governance hooks and the key cabinet pattern.
Grip op Shadow AI met de AI-BOK
Employees are already using ChatGPT and Claude without IT knowing. How do you inventory and govern Shadow AI?
Manage AI agents as real employees
Your next colleague is an AI agent. Why agents need a mandate, escalation protocol and exit procedure.
How your AI project survives production
70% of AI projects never make it to production. About the 8 phases of the AI lifecycle and why 50% of costs come after launch.
AI-BOK Unplugged — The framework behind responsible AI
Read a chapter from the book
The foreword and the Start Here guide — directly applicable, no purchase required.
What changed: v1.0 to v1.3
Three minor releases, one goal: a workable, audit-ready reference framework for AI governance.
Foundation: 12 knowledge areas + 19 roles
- ·12 knowledge areas (KA1 to KA12) as canonical decomposition
- ·19 roles distributed across 4 governance levels
- ·8-phase lifecycle (from ideation to decommissioning)
- ·10 metamodel entities + 5-level maturity model
- ·Open ArchiMate 3.2 reference model with 48 views
Depth: agentic AI + regulation
- ·Cognition plane as architectural integration layer (Mandate, NHI lifecycle, Authority Register, Policy-as-code, Escalation)
- ·16 agentic AI failure modes (FM01-FM16) with cognition-plane binding
- ·Regulatory traceability matrix across 9 jurisdictions (EU AI Act, NIS2, NIST, ISO 42001/23894/38507, VNG, BZK, US state laws)
- ·Maturity evidence rubric (D/M/L per KA x level, with inter-assessor protocol)
- ·Operational + cyber-physical addendum (three-tier device/edge/centre)
Integration + parity: KA13, Role 20, 22 FMs
- ·KA13 AI Literacy & Capability Development integrated into canonical Module 1 (EU AI Act Article 4)
- ·Role 20 AI Literacy Officer (Article 4 evidence file owner)
- ·6 operational/cyber-physical failure modes (FM17-FM22) added - 22 patterns total
- ·5 standalone addenda integrated as Module 3 sub-sections (3.3.8-3.3.9, 3.4.9, 3.6.7-3.6.8)
- ·Role-based reading paths (8 paths) + Minimum Viable Governance profile (MVG-7)
- ·NL + EN at full parity for the first time since v1.0
- ·Open ArchiMate model expanded to 52 views; 1066 relations
- ·SemanticXL pack ai-bok-1.2 (112 reference claims + 4 guardrails)
Correction and update: 22 roles, 4 planes, Digital Omnibus
- ·Two adoption roles: AI Ambassador (Role 21) and AI Prompting & Agents Specialist (Role 22); RACI 22x13 corrected with exactly one accountable role per knowledge area
- ·Four architecture planes: the management plane alongside the data, control and cognition planes
- ·Digital Omnibus (Regulation (EU) 2026/1744) incorporated: application timeline, Article 4 as a duty to take measures, Article 73 reporting deadlines, FRIA scope; verified against the consolidated regulation text
- ·New: GPAI obligations (art. 53-55), Article 50 transparency, MCP/A2A governance, evaluation gates in CI/CD, knowledge-chain security
- ·Dutch edition at full parity: failure-mode catalogue, regulatory traceability and evidence rubric fully translated
- ·Eleven role-based reading paths (auditor and supervisor, works council and AI Agent Governor added)
- ·Consistency tooling: book, figures, ArchiMate model and SemanticXL pack are validated from one canonical source
Correction and update: 22 roles, 4 planes, Digital Omnibus
- ·Two adoption roles: AI Ambassador (Role 21) and AI Prompting & Agents Specialist (Role 22); RACI 22x13 corrected with exactly one accountable role per knowledge area
- ·Four architecture planes: the management plane alongside the data, control and cognition planes
- ·Digital Omnibus (Regulation (EU) 2026/1744) incorporated: application timeline, Article 4 as a duty to take measures, Article 73 reporting deadlines, FRIA scope; verified against the consolidated regulation text
- ·New: GPAI obligations (art. 53-55), Article 50 transparency, MCP/A2A governance, evaluation gates in CI/CD, knowledge-chain security
- ·Dutch edition at full parity: failure-mode catalogue, regulatory traceability and evidence rubric fully translated
- ·Eleven role-based reading paths (auditor and supervisor, works council and AI Agent Governor added)
- ·Consistency tooling: book, figures, ArchiMate model and SemanticXL pack are validated from one canonical source
What is on the planning board
Six work packages that strengthen the framework in upcoming releases.
Community validation & journal version
The peer-reviewed EA4AI paper (Springer LNBIP) is being extended into a journal version. In parallel: community validation through the FGEA CoP and DANW, publication of the source-to-KA traceability matrix, and measuring the cognition-plane hypotheses in pilot organisations.
SemanticXL ai-bok pack live
The ai-bok-1.2 pack as a runtime overlay in SemanticXL: 112 claims, 4 guardrails (MVG-7, FM coverage, Article 4 evidence, cognition-plane binding). Organisations load their own ArchiMate model and run gap analyses on the spot.
NHI Federation Protocol (RFC draft)
Standards-track proposal for cross-organisation NHI mandate exchange: JOSE token format, revocation propagation, freshness budget across organisational boundaries. Builds on the cognition plane.
AI-BOK Conformance Suite
`ai-bok check` CLI: ingest AI portfolio + ArchiMate model, output JSON with MVG-7 status, FM coverage percentage and KA maturity heatmap. Open source, vendor neutral.
Regulatory monitor
Continuous scraping of EU OJ, Dutch DPA, BZK, NIST, IMDA publications. Diff against the regulatory matrix; push notifications with impact mapping to KAs and evidence files.
Sector overlays
Three sector overlays: banking (BCBS-239 / EBA), healthcare (FDA SaMD / EU MDR) and municipal (VNG deepdive). Each: 30-page booklet with 5 worked examples on the canonical MVG-7.
Join the open reference architecture: download the ArchiMate model and contribute feedback through the community issues.
Open reference architectureAI is transforming your organization - whether you are ready or not
Your employees are already using ChatGPT, Copilot, Claude, Cursor and Gemini - often without IT knowing. The EU AI Act is in effect: the AI literacy measures (Article 4) apply since February 2025, the general obligations since August 2026 and the obligations for Annex III high-risk systems from 2 December 2027 (Digital Omnibus). Every month without AI governance is a month without control over your biggest technology transformation.
Take the free Quick ScanFrequently asked questions
Who is the AI Body of Knowledge written for?
For anyone who has to set up AI governance or account for it: CIO and board, enterprise architects, AI governance officers, CDOs and privacy officers, HR and project leads. The book has eleven role-based reading paths so you read what counts for your role.
How does it differ from ISO 42001 and NIST AI RMF?
ISO 42001 describes a management system, NIST AI RMF describes risk functions. Neither says which knowledge areas an organisation must master or which roles do the work. The AI-BOK adds that layer and refers back to the standards per knowledge area.
Does the book cover the EU AI Act, including the Digital Omnibus?
Yes. Version 1.3 (September 2026) incorporates Regulation (EU) 2026/1744: Annex III moved to 2 December 2027, Article 4 as a best-effort obligation, the new prohibitions from 2 December 2026. The role model is mapped onto provider and deployer.
What is the cognition plane?
A fourth architecture plane next to data, control and management: the place where AI agents reason and decide under an explicit mandate. Mandates, reasoning boundaries, delegation and escalation become objects you can model, assign and audit. It is the core of the peer-reviewed paper at EA4AI (CBI and EDOC 2026, Springer LNBIP).
Are the Toolkit and the ArchiMate model free?
Yes. The Toolkit (modelling conventions, risk-control library, calibration kit, procurement clauses, filled templates) is sent by mail. The ArchiMate model is freely available on the architecture page. The book is the reasoning behind them.
Is the English edition the same book?
Yes. Both editions have the same content and the same 18 diagrams; the English edition is longer because of typesetting. Dutch public-sector crosswalks (VNG, BZK, GEMMA) appear in both as worked examples of mapping a national framework.
Team or whole organisation: which licence?
A single copy is for one reader. The team licence covers five readers in both editions. The enterprise edition covers all employees and fits a governance programme in which the AI-BOK is the shared reference.
Why an AI Body of Knowledge?
ISO 42001 offers a management system but no knowledge area structure. NIST AI RMF offers risk management but no role model. The EU AI Act offers legal frameworks but no implementation guide.
The AI-BOK brings these puzzle pieces together and fills the gaps.
Written for the CIO who needs to present an AI governance proposal to the board tomorrow. For the enterprise architect who must fit AI into an existing landscape. For the CHRO shaping workforce transformation. And for the project manager deploying an AI system to production for the first time.
About the author
Jan Willem van Veen
Principal Enterprise Architect
Over 25 years of experience at the intersection of technology, organization and meaning. From the first enterprise architectures in the public sector to the current generation of AI systems. Background in semantic web technology, knowledge graphs and linked data. The scientific paper on the AI-BOK was peer-reviewed and accepted at the EA4AI workshop of CBI & EDOC 2026, to appear in the Springer LNBIP proceedings.