Organisations across regulated industries are deploying AI in governance, risk, and compliance functions — fraud detection, compliance monitoring, risk scoring, regulatory reporting — at a pace that has consistently outrun the governance architectures meant to control them. The consequences are well-documented: algorithmic bias in credit decisions, privacy infringement under Saudi PDPL, adversarial manipulation of compliance models, and accountability gaps when AI-generated determinations go wrong without human review.
This repository is the research and implementation output of a study addressing that gap directly. It contains two things:
-
A peer-reviewed academic paper proposing the AI-GRC Integrated Management Framework (AI-GRC IMF) — a five-phase lifecycle governance model grounded in ISO/IEC 27001:2022 and ISO/IEC 42001:2023, cross-referenced against Saudi PDPL, SDAIA AI Ethics Principles, NCA ECC-1:2018, SAMA Cybersecurity Framework, and the EU AI Act.
-
An interactive compliance checker (
index.html) that lets organisations assess their AI systems against the AI-GRC IMF and receive a personalised, AI-generated remediation report mapped to Saudi regulatory obligations — no installation, no server, open it directly in any browser.
No installation. No dependencies. No server required.
# Clone the repo
git clone https://github.com/kayShahbaaz/AIGRC-IMF.git
# Open the tool
open index.htmlOr download index.html and open it in Safari, Chrome, Edge, or Firefox.
Note: The AI-generated remediation report requires an active internet connection to call the API. All scoring, charts, and dashboard functionality works fully offline.
The AI-GRC IMF Compliance Checker is a browser-based self-assessment tool built directly from the framework. It walks compliance officers, IT security teams, and AI governance practitioners through 25 weighted questions across the five AI-GRC IMF phases and produces a detailed compliance posture report with sector-specific Saudi regulatory mappings.
| Feature | Description |
|---|---|
| 25-Question Assessment | Five-phase AI-GRC IMF lifecycle with weighted scoring across 7 risk categories |
| Weighted Risk Scoring | High-stakes categories (bias, privacy) carry greater weight than procedural ones |
| Saudi Regulatory Mapping | Results mapped to PDPL, SDAIA, NCA ECC, SAMA — activated by sector |
| AI-Generated Remediation | Personalised four-paragraph report via Claude AI with specific clause references |
| Live Compliance Dashboard | Radar chart, phase bars, regulatory alignment cards, critical gaps table |
| Arabic / English Toggle | Full RTL layout switch — not just translated text, the entire interface mirrors |
| Demo Mode | Pre-loaded Saudi financial sector scenario (SAMA-Shield Fraud Detection AI) |
| Export / Print | Browser print-to-PDF for sharing results |
| Sector | Regulatory Layer Activated |
|---|---|
| 🏦 Financial Services | SAMA Cybersecurity Framework |
| 🏛️ Government / Public Sector | SDAIA National AI Strategy |
| 🏥 Healthcare | MOH Digital Health Strategy |
| 🏢 General / Cross-Sector | All core frameworks |
Core frameworks active for every sector: ISO/IEC 27001:2022 · ISO/IEC 42001:2023 · Saudi PDPL · SDAIA AI Ethics · NCA ECC-1:2018 · NIST AI RMF 1.0
The AI-GRC Integrated Management Framework is a five-phase lifecycle governance model that integrates ISO/IEC 27001:2022 and ISO/IEC 42001:2023 within a single management system architecture. Its design principle is additive: organisations already certified to ISO/IEC 27001 extend existing processes rather than build parallel ones.
┌──────────────────────────────────────────────────────────────────────────┐
│ AI-GRC Integrated Management Framework │
├──────────────┬──────────────┬──────────────┬──────────────┬─────────────┤
│ 1. IDENTIFY │ 2. ASSESS │ 3. CONTROL │ 4. DEPLOY │ 5. MONITOR │
├──────────────┼──────────────┼──────────────┼──────────────┼─────────────┤
│ AI system │ Dual-standard│ Integrated │ Staged │ Continuous │
│ inventory │ risk │ SoA covering │ rollout with │ model │
│ │ assessment │ both ISO │ human review │ monitoring │
│ Risk │ (ISO 27001 │ 27001 + │ │ │
│ tier │ §8.2 + │ ISO 42001 │ Change │ Bias metric │
│ classification│ ISO 42001 │ Annex A │ management │ tracking │
│ │ §6.1) │ │ for model │ │
│ Saudi │ │ XAI │ updates │ Regulatory │
│ regulatory │ PDPL DPIA │ architecture │ │ horizon │
│ mapping │ integrated │ requirements │ Staff │ scanning │
│ │ │ │ training │ │
│ AIMS scope │ Consolidated │ Human-in- │ │ Unified │
│ definition │ risk register│ the-loop │ Access │ ISMS + AIMS │
│ │ │ mechanisms │ controls │ audit │
└──────────────┴──────────────┴──────────────┴──────────────┴─────────────┘
│ │
└──────────────── PDCA Improvement Loop ───────────────────┘
For full framework documentation, see paper/paper-overview.md.
The academic paper makes four principal contributions:
1 — Use-Case Taxonomy (Table I) Eight AI capabilities mapped to Governance (G), Risk (R), and Compliance (C) function domains with applicable standards for each — from NLP-driven regulatory horizon scanning to LLM-based policy chatbots.
2 — Standards Comparison (Table II) Comparative analysis of six governance instruments across scope, GRC relevance, AI risk focus, and integration pathway — including the first systematic comparison of ISO/IEC 27001:2022 and ISO/IEC 42001:2023 in a GRC context.
3 — Risk-Controls Mapping (Table III) Seven AI risk categories mapped to specific ISO/IEC 27001:2022 Annex A controls, ISO/IEC 42001:2023 Annex A controls, regulatory requirements, and mitigation techniques in a single reference table.
4 — AI-GRC IMF The integrated five-phase governance lifecycle framework itself, grounded in the dual-standard architecture and validated against Saudi and international regulatory obligations.
| Standard / Framework | Type | Role in AI-GRC IMF |
|---|---|---|
| ISO/IEC 27001:2022 | Certifiable Standard | Security foundation — governs AI data, infrastructure, and pipelines |
| ISO/IEC 42001:2023 | Certifiable Standard | AI governance layer — bias, transparency, human oversight, lifecycle |
| ISO/IEC 27701:2019 | Extension Standard | Privacy information management; Saudi PDPL Art. 25 alignment |
| Saudi PDPL | Regulation | Data minimisation, DPIA obligations, automated decision rights |
| SDAIA AI Ethics | National Framework | Fairness, transparency, accountability for AI in Saudi context |
| NCA ECC-1:2018 | National Standard | Essential cybersecurity controls for Saudi organisations |
| SAMA Cybersecurity Framework | Sector Framework | Financial sector AI and cybersecurity governance |
| EU AI Act 2024/1689 | Regulation | Risk-tiered AI classification; high-risk conformity requirements |
| NIST AI RMF 1.0 | Voluntary Framework | Govern, Map, Measure, Manage — complementary AI risk lifecycle |
AIGRC-IMF/
│
├── README.md ← You are here
│
├── index.html ← AI-GRC IMF Compliance Checker (open in any browser)
│
├── paper/
│ └── paper-overview.md ← Full research overview: methodology, framework,
│ risk mappings, findings, and request info
│
├── screenshots/ ← Tool screenshots
│
├── CITATION.md ← How to cite this work
└── LICENSE ← MIT (tool only; paper content is separate)
The academic paper is currently under review for IEEE publication. If you are a researcher, practitioner, student, or institution and would like to read the complete paper, reach out directly.
📬 Contact:
Please include a brief note about your context — academic review, institutional GRC implementation, or general research interest.
Repository:
kayShahbaaz (2026). AI-GRC Integrated Management Framework (AI-GRC IMF).
GitHub. https://github.com/kayShahbaaz/AIGRC-IMF
@misc{kayshahbaaz2026aigrcimf,
author = {kayShahbaaz},
title = {AI-GRC Integrated Management Framework (AI-GRC IMF)},
year = {2026},
publisher = {GitHub},
howpublished = {\url{https://github.com/kayShahbaaz/AIGRC-IMF}}
}A formal IEEE citation will be added to CITATION.md upon publication.
kayShahbaaz · خ شهباز
Independent researcher working at the intersection of AI governance, information security management, and regulatory compliance in the Gulf region.
The AI-GRC IMF Compliance Checker and all content in this repository are for research, educational, and assessment purposes only. Results generated by the tool do not constitute legal compliance certification, regulatory approval, or professional legal advice. Organisations should consult qualified legal and compliance professionals for formal regulatory guidance.
The tool (index.html) is released under the MIT License.
The paper content (paper/paper-overview.md) is the intellectual property of the author and may be read and cited with attribution, but may not be reproduced or redistributed without permission.