CADRE (Charter, Authority, Decision rights, Records, Escalation).

What this is.

Renamed. Three frameworks formerly asserted separately, the Governance Office Blueprint, the RACI-AI Matrix and the Governance Cadence Framework, are now the Structure, Decision rights and Cadence sections of this one. A decision-rights matrix has no operational meaning without a structure to assign the rights within, and a cadence has none without both. The three former names remain valid for citing the work published under them and must not be used for new work.

On the mark. The descriptor, AI Governance Operating Model, is a descriptive phrase in common industry use: hard to register, weak to enforce, and impossible to own. That is the argument that produced CADRE rather than an argument against naming, and the descriptive phrase survives as the descriptor because it is what a reader searching for this subject will type. Registry version 2.0 asserts CADRE™ as a mark; version 1.0 recorded this entry as deliberately unmarked. No trademark clearance search has been run on it. That limitation is stated here for the same reason the corpus states it for the Five-Gate name: an unresolved clearance is a fact about the mark, not a detail to discover later. Do not describe CADRE as a registered or cleared mark.

On the name, and what the registry currently says.

CADRE stands for Charter, Authority, Decision rights, Records, Escalation. The five are drawn from the registry entry itself rather than fitted to the letters, which is the same defence MESA uses for its own expansion. Cadre independently means the nucleus of trained people an organisation is built around, which is what this framework specifies. The descriptor remains the AI Governance Operating Model and is not retired; it is what a reader searching for this subject will type. Registry version 2.0, published 15 September 2026, makes CADRE the canonical name and asserts it as a mark; version 1.0 recorded this entry as “AI Governance Operating Model”, unmarked, and that file is immutable. Registry section 11.1 makes a canonical-name change a major version, which is why the rename alone took the register to 2.0, and section 11.2 requires a rename to record the former name and forbids it changing the identifier: this is REG-07 before and after. Cite REG-07 either way, and name the version you read.

Three parts, five artifacts.

The registry defines this framework in three parts, and those three remain the definition. Structure is the office, its staffing and its position within the three lines. Decision rights is the allocation, per lifecycle phase and per decision type, of who is accountable, responsible, consulted and informed. Cadence is the rhythm on which the function operates, together with the escalation paths on which incidents, human-review tiers and gate disputes terminate. The five letters are not the three parts. The five name what those parts produce and are the form in which the framework is testable. Structure produces the charter and the authority it enumerates; cadence produces the records and the escalation. Decision rights appears in both lists because it is both a part of the definition and an artifact in its own right. No other correspondence is intended.

What an auditor asks for.

Five artifacts, and each either exists or does not. The charter, dated and approved by the body that granted the mandate, re-approved at least annually whether or not the text changed. The authority, enumerated in the charter by decision type, in the words that say whether the function can stop a release or can only advise. The decision-rights assignment, two-dimensional across lifecycle phase and decision type, naming one accountable person and a deputy for each before the decision arises rather than at the moment it does. The cadence records of the weekly operations review, the monthly risk review, the quarterly board report and the annual charter refresh, each carrying who decided, what was escalated and the policy version then in force. The escalation records, on paths that each name a recipient, a threshold and a clock.

Two properties, and neither is an organisation chart.

Exactly one person is accountable per decision type, and that person is named. A committee, a function, a team or a board must not be recorded as accountable. The prohibition is on accountability rather than on committees: a committee may deliberate, be consulted, receive the decision or hear an appeal, and where an institution wants a committee decision to bind, the chair is the accountable individual and the charter says so. A cadence with no meeting records is not a cadence. A published calendar is evidence that meetings were scheduled. The record of a meeting cancelled, with the reason and what became of the business it would have transacted, is itself an artifact, and it is the one carrying the most diagnostic weight, because a cadence that quietly stops decays invisibly. A meeting that did not happen leaves no trace.

The sole authority source, and nothing flows back.

This framework grants authority to five of the other eight in the register: the standing of the validation function to MESA MRM, the authority to classify and to refuse a use of data to AI Data Governance, the authority to clear or decline a supplier to AVRF, the authority to declare an incident and the paths it routes along to AIRP, and release authority exercised at the gates to the Five-Gate Deployment Model. No edge in the register has this framework as its target. What returns to it is an escalation record it writes itself. The asymmetry is deliberate. A framework that granted authority to five others and also consumed their evidence would be assessing work performed under authority it issued. The consequence is concrete: an institution that can describe its governance function only by listing the validations performed and the gates passed underneath it has evidenced the frameworks, not the function.

Ninety days, and the order matters more than the days.

Four milestones, in order. A dated mandate from the governing body. A charter that same body has approved. An office whose head and leads are named individuals, with an assignment allocating every decision type the charter enumerates. Then the first meeting of the weekly and the monthly rhythms, each having produced a record. The order is normative and the ninety days are not. An institution reaching the fourth milestone in a hundred and fifty days has stood the function up slowly. An institution reaching it without the second has stood up meetings. That inversion is the common one, because meetings are easy to schedule and a charter requires a governing body to commit, and decisions taken before a charter arrives are not authorised retrospectively when it does.

Which institutions, and on whose authority.

The record of its own revisions.

A framework that cannot say how it changed reads as though it never has. This is drawn from the registry entry, which versions itself independently of the specification it points at.

Change history

• 2026-08-30 · entry v1.0 — First registry entry
• 2026-08-30 · entry v1.0 — Records the consolidation of the Governance Office Blueprint, the RACI-AI Matrix and the Governance Cadence Framework into this framework
• 2026-09-15 · entry v2.0 — Renamed from the AI Governance Operating Model to CADRE, effective 1 September 2026. The identifier is unchanged and the former name is retained as the framework's descriptor rather than withdrawn from use
• 2026-09-15 · entry v2.0 — Mark status moves from `unmarked` to `trademark`. No clearance search has been completed and no registration has issued
• 2026-09-15 · entry v2.0 — Specification status moves from `source-treatment` to `deposited` on the deposit of the CADRE specification, whose concept DOI the entry now carries
• 2026-09-15 · entry v2.0 — Definition reconciled with that specification, which states the three parts as five testable artifacts
• 2026-09-15 · entry v2.0 — Records a `missing` limitation for the charter, decision-rights, cadence and escalation templates that specification does not publish
• 2026-09-15 · entry v2.0 — The authority grant is extended to REG-09, resolving the question routed to this registry at 8.2 of the Cross-Border AI Architecture Patterns specification

Former names. Governance Office Blueprint · RACI-AI Matrix · Governance Cadence Framework · AI Governance Operating Model. Each remains the correct citation for the work published under it and must not be used for new work.

Limitations recorded in the registry

• That the structure fits institutions of different sizes. The source treatment is calibrated to large regulated institutions. A smaller institution MUST adapt the structure and SHOULD record what it adapted.
• The consolidation has not been executed in the source book, which continues to assert the three former marks until a natural reprint. This registry is the authoritative statement in the meantime.
• Specifies the governance function. Does not specify the competencies, training or individual credentials of the people in it.
• No charter, decision-rights assignment, cadence record or escalation record template is published with the deposited specification. An institution can be told what a conformant charter must contain and cannot be handed one, so two institutions operating the framework will produce artifacts that are individually conformant and not comparable with each other.

What would show this to be wrong. CADRE is falsified if institutions operating a chartered office with a documented single-accountable decision-rights assignment and a recorded cadence are found to escalate AI risks no earlier, and resolve them no more consistently, than institutions handling AI governance within existing risk committees without a distinct structure. The framework's claim is that a dedicated structure with named decision rights changes when and how a risk surfaces.

What this does not claim.

Asserted, and falsifiable. The contribution is architectural rather than empirical. No institution unconnected to the author has been observed operating it, and no third party has published a result obtained under it. The framework is falsified if institutions operating a chartered office, a single-accountable decision-rights assignment and a recorded cadence are found to escalate AI risks no earlier, and resolve them no more consistently, than institutions running AI governance inside an existing risk committee. The comparison is deliberately against a competent alternative rather than against no governance at all.

Missing. No charter, decision-rights assignment, cadence record or escalation record template is published. An institution can be told what a conformant charter must contain and cannot be handed one, so two institutions operating this framework will produce artifacts that are individually conformant and not comparable with each other.

Scope. Calibrated to institutions large enough to staff it, which is a head and five leads before deputies. One person may hold more than one lead where scale requires it and the charter records which, but the model risk lead must not be accountable for the release that relies on their validation, and the incident lead must not be accountable for the systems whose incidents they classify. Which further compressions preserve the framework’s properties and which destroy them is not stated, and an unadapted structure applied to a small institution produces roles nobody holds.

Out of scope. The framework specifies the function, not the people in it. Competency, training and individual credentials sit outside it. An institution can hold every artifact required here and be staffed by people who cannot perform the challenge a second-line position depends on. The claim is that the structure exists and produces its artifacts. It says nothing about whether the artifacts are any good.

In progress. The consolidation has not been executed in the source book, which continues to assert the three former marks on its copyright page until a natural reprint, and the book’s treatment diverges from this account in four recorded places, two of them substantive: it runs a daily rhythm this framework does not, and it vests approval authority in a committee, which the single-accountable rule forbids. The registry is the authoritative statement in the meantime.

Citation.

Cite this work. CADRE, version 1.0. 10.5281/zenodo.22285052. This is the concept DOI and it always resolves to the latest version. CC BY 4.0.

In the practice.

• Governed production AI, the discipline this framework belongs to
• Defensible AI, the family and the register
• AI Governance and Compliance Frameworks for the Middle East, the source treatment
• Model risk, the service this framework is applied through
• AI governance in the wiring, on where governance actually lives