The Nine AI Governance Domains for Higher Education

A comprehensive architecture covering the full scope of institutional AI governance — nine domains, three supercategories, each with its own policy instruments, delegation logic, and coordination mechanisms.

This expands Pillar 4 — Governance, Risk, Compliance & Data Governance of the Campus AI Framework, Joe Sabado's practitioner's playbook of eight pillars and four application domains for AI in higher education.

The whole framework on one screen. Click any domain to open it.

On top of the six components sit six cross-cutting lenses — threads that run through all nine domains. Three carry the work AI adds (Lifecycle, Assurance & Accreditation, Culture & Readiness); three check the system from outside (Transparency & Trust, Global & Jurisdictional, Participatory Co-Governance). See all six in detail →

This is the matrix that ties it together: the six building blocks your data-governance program already runs on, each shown doing real work across Lifecycle, Assurance, and Culture — extended, not rebuilt. Click a domain to see where the component anchors.

Consequential AI clusters in a few domains — govern those first

Proportionality means the most attention goes where the stakes are highest. High-risk systems that make or inform decisions about people tend to live here — with Domain 6 providing the oversight that governs them all.

The body that keeps the system coherent

One standing group owns the connective work — the charter, the inventory, and the coordination map — so the nine domains operate as a single system, not nine silos. Its standing responsibilities cross every domain:

Read it bottom-up: pick a domain → inside it sit all six components (the infrastructure) → and six cross-cutting lenses run through every domain — three describe the work AI adds (lifecycle, assurance, culture & readiness), three the outside audiences it answers to (transparency, jurisdiction, participation).

One sentence connects all three.

In any domain, the six components supply the infrastructure, and six cross-cutting lenses run through every one — carrying the work AI performs and holding the result accountable to the outside world.

The Five-Domain View

Most institutions govern only fragments of AI — usually teaching and academic integrity — while gaps open everywhere else. This is a mission-aligned, five-part structure that folds the complete nine-domain architecture into a front door leaders can actually hold in their head.

The Five-Domain view is the accessible executive summary; the original Nine-Domain architecture remains the complete reference for detailed policy work. Every domain below maps directly onto it.

Four principles apply across every domain wherever an AI system is consequential.

{{ fivePurpose }}

The five domains are the way in. The nine domains remain the complete reference architecture for detailed policy work.

The same components run through every domain

All six shared components — governance body, inventory, classification & risk tiering, stewards & owners, policies & standards, and review & monitoring — operate in every domain, applied to a different object. The three cross-cutting functions concentrate where each domain does its work. ● primary · ○ present · · minimal

Read a row: every domain carries all six components; the dots show which functions it leans on. Culture leads the people domains, Assurance the oversight and risk domains, Lifecycle the build domains.

Apply governance in proportion to context

Governance intensity should scale to the actual stakes — not applied uniformly, and not driven by fear. The same weight should never fall on a faculty member using a writing assistant and on a system determining financial-aid eligibility. Proportionality weighs several factors together:

Adopt in two phases, not all at once

Establish a minimum viable governance stack first, then extend to the full framework once the infrastructure is operational.

Domain 9 — Governance, Oversight, and Continuous Review — should be the first established, not the last.

Nearly every objection assumes governance means control — more rules, more gatekeeping, more delay. Reframe it as clarity about who decides, sized to the risk, and each objection answers itself. That reframing is the whole strategy of this framework.

Every element is scored on two axes, then multiplied — so a strong policy that reaches almost no one scores as low as a weak one deployed everywhere.

Institutional AI capability infrastructure.

Five criteria for evaluating any AI initiative.

Lessons from Reflect feed back into Screen, Score, and Plan.

CAGMA’s contribution: domain-specific maturity + a coverage dimension + a higher-ed governance taxonomy.

Every domain shares one internal structure — six components (from policy instrument to review cadence), a delegation logic that says who decides, and coordination links to the domains it touches. The nine sit in three bands: Academic Core (1–4), Infrastructure & Risk (5–7), and People & Governance (8–9). Cross-cutting lenses — lifecycle, assurance, culture, transparency — run through all of them, and a maturity model (CAGMA) lets an institution locate where it stands and what to do next.

• Senior leaders — provosts, CIOs, CISOs, chief data and academic officers
• AI governance committees and shared-governance bodies
• IT, risk, compliance, privacy, and legal officers building the operating layer
• Faculty and academic leaders weighing AI in teaching and research
• Consultants, accreditors, and peer institutions looking for a reference model

• New here? Start with Overview, or the Five-Domain View for a lighter entry.
• The Nine Domains is the core reference — open any domain for its full detail.
• Use the Maturity Model and Self-Assessment to place your own institution.
• Reach for the Standards Crosswalk when someone asks what it's based on.
• It's non-linear — jump anywhere from the sidebar; nothing requires reading in order.

• +Scholarly research, regulatory analysis, and firsthand institutional practice across many institution types
• +Aligned with recognized standards — NIST AI RMF, ISO/IEC 42001, the EU AI Act, and EDUCAUSE
• +Built as Pillar 4 of the Campus AI Framework, a practitioner's playbook for AI in higher education

• –Not legal advice — confirm applicability with your own counsel, privacy office, and leadership
• –Not a certified compliance mapping; the crosswalk shows association, not equivalence
• –Not vendor- or product-specific, and not a substitute for local policy
• –Not a synthesis of existing frameworks — the architecture is an original contribution

Joe Sabado

Founder of CampusAIExchange.com, writing on responsible AI adoption, governance, and workforce transformation in higher education.

The Nine Domains framework grew out of AI governance work begun in 2023 — as a practitioner inside an institution, as a consultant engaging other campuses and systems, and as a scholar researching the evolving governance landscape.

That work has spanned a university system, a national higher-education technology community, and direct engagement with community colleges, research universities, private universities, a health-sciences institution, an accreditation agency, and industry associations.

In every one of those contexts, the same pattern appeared: institutions working hard on AI governance, but working on pieces of it. The architecture is an original contribution — tested against scholarly research, regulatory analysis, and institutional practice — not a synthesis of existing frameworks.