How the three frameworks work together.
GAISSF governs and assures. UAIF records and classifies. AI-IRF coordinates response. They exchange defined context; none replaces the others.
Connected operating flow
GAISSF™
Sets control objectives, ownership, evidence expectations and bounded assurance criteria before an incident occurs.
UAIF™
Creates a consistent incident identity, severity, impact, confidence and evidence record when an event is assessed.
AI-IRF™
Uses the incident record to coordinate preparation, triage, containment, recovery, notification and improvement actions.
Evidence returns to governance
Response and review evidence can inform GAISSF control ownership, applicability, evidence quality and improvement decisions. The relationship is iterative: governance sets expectations, classification records the event, response uses that record, and verified learning informs control improvement.
Mapping boundaries
These links describe operating relationships, not equivalence. A GAISSF control is not a UAIF field; a UAIF record is not an AI-IRF response plan. Using one framework does not establish compliance, certification, endorsement or effectiveness in another.