A practitioner who has to answer a supervisor, an auditor or a board meets the same three questions in different words. Which obligations apply, and which control answers each of them? Is the control working, and who other than its owner says so? How far along are we, and what do we do next? This chapter collects the tools of the series that answer these questions. It serves the activity of demonstrating: turning what an organisation does into something that a second person can check. The tools are of all four kinds. Most are artefacts (mapping matrices, registers, catalogues, test procedures, metrics and reports), a few are methods (assure once and comply many, the internal algorithmic audit, the maturity assessment), one is an own tool (the Maturity Radar of Architecture as Code) and the rest are standards and frameworks that the series maps to (ISO/IEC 42001, ISO/IEC 27001, the NIST frameworks, OSCAL). They come mainly from Architecture as Code (1, Nordqvist, 2025), AI Governance (2, Nordqvist, 2026), The Transformed Security Architect (6, Nordqvist, 2026), AI Purple (9, Nordqvist, 2026) and AI Operations (10, Nordqvist, 2026), with contributions from AI Platform and Security (3, Nordqvist, 2026), AI Red Team (4, Nordqvist, 2026), AI Threat (5, Nordqvist, 2026), AI Boss (7, Nordqvist, 2026) and AI Blue (8, Nordqvist, 2026).
Laws are not tools. The AI Act, DORA, NIS 2 and the GDPR appear here only as the things the tools are mapped to, and every statement about them is attributed to the instrument and article and framed as an architectural implication, not as legal advice (195, European Union, 2024) (197, European Union, 2022) (198, European Union, 2022) (196, European Union, 2016). What this chapter treats is the machinery that makes a mapping to those instruments testable.
The chapter proceeds in five families. Obligation mapping holds the tools that start from an article and end at a control and a piece of evidence. Control catalogues holds the records that hold the controls. Assurance and audit evidence holds the tools by which a control is tested and its oversight is shown to be real. Maturity models and profiles holds the tools that measure where an organisation stands. Reporting and transparency holds the tools that carry the result to a management body, to workers and to the public. Compliance checks that run inside the pipeline (Rego policies, pipeline definitions, infrastructure templates) are tools of delivery and are treated in Chapter 5 and Chapter 6; this chapter says where they connect.
Primary topics explored
- Obligation mapping
- Control catalogues
- Assurance and audit evidence
- Maturity models and profiles
- Reporting and transparency
- Across the usage modes
About Tools
Tools is a companion to The Transformed Architecture. It collects the tools that Books 1 to 10 describe in one reference, organised by what the practitioner is doing: artefacts (templates, manifests, records), own tools, third-party tools and standards, and methods. Each entry says what a tool is for, when to use it, what it needs and produces, and where the book that defines it explains the reasoning. The book covers choosing, adopting and retiring tools, architecture and delivery, governing AI, securing and testing, operating, agents and autonomy, and people, organisation and society, for European enterprises and public authorities. It comes with a template library, an inventory, three web tools and the Toolbox Maturity Method.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss, AI Blue, AI Purple and AI Operations.
Architects and security architects, CIOs and CISOs, platform and operations leads, heads of governance, risk, compliance and third-party risk, AI governance and AI platform teams, red, blue and purple team leads, boards and management bodies, procurement and vendor managers, supervisors and auditors, works councils and unions, data protection officers, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 8: Obligation, Assurance and Maturity Tools in Tools gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Governing AI” and is one of 29 drawn from the manuscript.