# The PRO Framework: From Documentation to Due Diligence > The CORE framework captures AI system architecture as a blueprint, while PRO adds policies, risk analysis, and outcomes that support due diligence. Canonical URL: http://modelmonster.ai/blog/the-pro-framework-from-documentation-to-due-diligence/ ## Article Metadata - Author: Van Lindberg - Published: 2026-01-28 - Category: AI Governance - Reading time: 4 min - Tags: AI governance ## The Limits of Questionnaires The CORE framework provides a structured way to capture AI system architecture as a blueprint—a directed graph showing Components, Operations, Resources, and Execution paths. This blueprint translates technical knowledge into a form that governance professionals can analyze without reading code. But documentation alone does not constitute governance. A CORE blueprint answers the question "What does this system look like?" It does not answer the questions that matter most to organizations: Is this system acceptable? Does it comply with our policies? What are the risks, and are they adequately controlled? Can we demonstrate due diligence to auditors and regulators? These questions require a layer of logic that sits on top of the CORE blueprint to interpret it, enforce rules, and quantify risk. This is the role of the PRO extensions: **Policies**, a **Risk** register, and **Outcome** evaluations. Together, CORE+PRO transforms governance from passive documentation into active, automated compliance verification. ## What PRO Provides PRO adds three capabilities to the CORE blueprint: **Policies** translate organizational constraints into executable rules. Rather than relying on engineers to read policy documents and self-attest compliance, PRO policies run directly against the system blueprint. A policy like "Customer data cannot flow to third-party AI providers" becomes an automated check that either passes or fails, with specific evidence of which data flows caused any violations. **Risk Register** applies systematic failure analysis to identify and prioritize risks. This replaces subjective risk assessments ("I think this is high risk") with structured methodology that weights severity, likelihood, and detection capability. The result is a defensible prioritization that ensures catastrophic-but-rare failures receive appropriate attention alongside frequent-but-minor issues. **Outcomes** generate the artifacts that demonstrate governance occurred: compliance reports showing which policies passed and failed, risk summaries showing the system's overall risk profile, and violation logs identifying precisely where problems exist. These outcomes create the evidentiary chain that demonstrates reasonable care. ### From Policy Documents to Policy Enforcement Traditional AI governance relies on policy documents that engineers must interpret and implement. This creates three problems: (1) inconsistent interpretation across teams, (2) no systematic verification that implementation matches intent, and (3) no audit trail when questions arise. PRO policies solve these problems by expressing organizational constraints in terms the system can evaluate automatically. ### Risk Assessment with Defensible Methodology When AI systems cause harm, organizations face questions about whether they exercised reasonable care. Vague assertions that "we assessed the risks" provide weak defense. The PRO Risk Register adapts governance for the probabilistic nature of AI: traditional software governance relies on binary checklists (Pass/Fail), which fail when applied to models that behave non-deterministically and guardrails that have non-zero failure rates. PRO applies a Failure Modes and Effects Analysis (FMEA) methodology that scores risks **Severity** of failure, **Occurrence** (probability) and **Detection** (mitigation effectiveness). This allows the organization to quantify and prioritize risks like “Compounding Multi-Agent Failures” or “Indirect Injection” that cannot be completely eliminated, only managed to an acceptable threshold. Where appropriate, PRO analysis also incorporates Use Case documentation that captures business context - intended purpose, user population, deployment environment - that shapes risk assessment but isn't visible in the technical blueprint. For governance teams, having a comprehensive risk register also makes it explicit which risks are being evaluated. It moves risk identification from an ad hoc process to a checklist-based process, making it easy to verify that nothing was missed. ### Outcomes as Evidence The Outcomes are the definitive artifacts that drive deployment decisions and demonstrate compliance. After having calculated the risk scores according to the Risk Register, the Outcomes layer generates the evidence: (1) a Compliance Report detailing policy passes/failures, (2) a Risk Summary listing prioritized threats (Critical/High/Medium) with their specific Risk Priority Numbers (RPN), and (3) a Remediation Roadmap. These artifacts provide the concrete evidence required by auditors, providing data-backed records of the system’s safety posture at the moment of deployment. ## What PRO Delivers **For Developers and Product Teams**: PRO gives software teams specific feedback about what needs to be done and what can be improved. Rather than saying “we need to make sure this system is safe,” PRO identifies particular failure points and risky execution paths and describes exactly what gives rise to the risk. **For Legal and Compliance**: PRO provides immediate evidence of reasonable care. When questions arise about whether the organization exercised due diligence, PRO outcomes show that policies were defined, systems were evaluated against those policies, risks were systematically assessed, and appropriate action was taken on findings. This evidentiary chain is far more defensible than attestation emails or meeting notes. **For Regulators**: PRO generates documentation that maps to regulatory requirements. The EU AI Act's Article 9 (Risk Management) and Article 11 (Technical Documentation) require organizations to demonstrate systematic risk assessment and maintain technical documentation. PRO outcomes satisfy these requirements with structured data rather than narrative descriptions. **For Executive Leadership**: PRO provides confidence that deployment decisions rest on rigorous analysis rather than verbal assurance. When a system is approved for deployment, leadership can see exactly what policies were checked, what risks were assessed, and what the findings were.