Conformance Profile Governance requires that organisations define and maintain formally versioned conformance profiles specifying which governance controls, at which conformance scores, are required for each agent risk tier, deployment context, and sector-specific scenario. A conformance profile is the bridge between the abstract taxonomy of controls and the concrete assessment of a specific agent deployment — it answers the question "what does conformance mean for this agent in this context?" Without governed profiles, conformance is either undefined (every organisation invents its own interpretation) or monolithic (every agent is assessed against every control regardless of risk). Both outcomes undermine the standard's effectiveness.
Scenario A — Undefined Conformance Creates Inconsistent Assessment: Two organisations in the same industry deploy similar AI customer-service agents. Organisation A self-assesses against 35 controls and declares conformance. Organisation B self-assesses against 89 controls and declares conformance. A regulator reviewing both declarations asks why the scope is different. Neither organisation can point to a governed profile that defines what conformance means for a customer-facing agent in their sector. The regulator concludes that both declarations are unreliable because neither is based on a defined standard of conformance.
What went wrong: No formal conformance profile existed for "Customer-Facing Agent" in the relevant sector. Each organisation independently determined which controls to include, producing incomparable results. Consequence: Both conformance declarations rejected by regulator, requirement to re-assess against a regulator-defined scope (adding 6 months to authorisation timelines), reputational damage for the standard's credibility.
Scenario B — Monolithic Conformance Drives Evasion: An organisation with 12 deployed agents applies a single conformance profile requiring Score 2 on all 218 implemented controls for every agent. The governance team estimates that achieving this for all agents would cost £3.2 million annually. The CTO approves governance for the 4 highest-risk agents only, leaving 8 agents entirely ungoverned because the all-or-nothing profile makes partial governance economically irrational. One of the 8 ungoverned agents — a supplier communication bot classified as low risk — is compromised through prompt injection and sends contractual commitments to 47 suppliers totalling £2.8 million in unauthorised obligations.
What went wrong: The monolithic conformance profile did not differentiate between risk tiers. Low-risk agents needed a lightweight profile (perhaps 15 controls at Score 1), not the full 218-control treatment. The all-or-nothing approach created a binary choice between full governance and no governance. Consequence: 8 agents with no governance, £2.8 million in unauthorised obligations from a "low-risk" agent.
Scenario C — Profile Governance Gap Allows Downward Reclassification: An organisation's conformance profiles are defined in a policy document but not change-controlled. A project team seeking to accelerate deployment reclassifies their financial trading agent from "Financial-Value Agent" (profile requiring 147 controls at Score 2+) to "Enterprise Workflow Agent" (profile requiring 62 controls at Score 1+). The reclassification has no approval workflow — the team simply changes a metadata field in the deployment registry. The agent goes live with 62 controls assessed at Score 1, executing trades of up to £500,000 per transaction. An FCA review 8 months later identifies the reclassification and issues an enforcement notice for operating a trading agent without adequate governance controls.
What went wrong: Conformance profiles existed but were not change-controlled. Agent profile classification had no approval workflow. Downward reclassification (moving an agent to a less stringent profile) was possible without governance review. Consequence: FCA enforcement notice, trading agent suspended pending remediation, £890,000 in regulatory fines and remediation costs.
Scope: This dimension applies to every organisation that conducts conformance assessments against the Agent Governance Standard, whether self-assessed or externally assessed. The scope covers the definition, versioning, approval, and maintenance of conformance profiles — the specifications that define what "conformance" means for each combination of agent profile, risk tier, and sector-specific context. The scope also covers the assignment of agents to profiles and the governance of that assignment process. Organisations operating in multiple jurisdictions or sectors may require multiple conformance profiles; all must be governed under this dimension.
4.1. A conforming system MUST define formally versioned conformance profiles for each agent risk tier (at minimum: low, medium, high, critical), specifying: the set of required controls, the minimum conformance score for each control, and any sector-specific additions or modifications.
4.2. A conforming system MUST assign every deployed agent to exactly one conformance profile based on its agent profile classification, risk tier, and deployment context, with the assignment recorded and change-controlled.
4.3. A conforming system MUST subject conformance profile changes to a formal change-control process requiring review and approval by at least two individuals with governance authority, including justification for every control inclusion, exclusion, and score threshold.
4.4. A conforming system MUST subject agent profile reclassification (changing an agent's assigned conformance profile) to governance review, with mandatory senior governance approval for any reclassification that reduces the number of required controls or lowers minimum score thresholds.
4.5. A conforming system MUST validate that every conformance profile respects the dependency relationships recorded in the dependency register (AG-220) — a profile cannot require a control without also requiring all controls on which it has a "requires" dependency.
4.6. A conforming system MUST review and revalidate all conformance profiles at least annually, or within 30 days of a material change to the taxonomy (AG-219), the dependency register (AG-220), or the regulatory landscape.
4.7. A conforming system SHOULD define conformance profiles in a machine-readable format enabling automated conformance assessment — the profile directly drives the assessment scope and scoring criteria.
4.8. A conforming system SHOULD publish conformance profiles to all stakeholders (governance teams, development teams, auditors) to ensure consistent understanding of conformance requirements.
4.9. A conforming system MAY define transitional conformance profiles for agents migrating between risk tiers, specifying interim requirements and a maximum transition period (not exceeding 180 days).
A governance standard that defines hundreds of controls but does not define what conformance means for specific contexts is incomplete. The Agent Governance Standard serves organisations deploying agents across a wide risk spectrum — from read-only internal copilots to autonomous financial trading agents. Applying identical conformance requirements to both extremes is neither practical nor appropriate. The low-risk copilot does not need the same control depth as the trading agent; requiring it wastes resources and creates governance fatigue. The trading agent cannot be assessed against a lightweight profile; permitting it creates inadequate governance.
Conformance profiles solve this by defining graduated tiers of governance intensity. Each profile specifies exactly which controls apply, at what score, for agents in a defined risk category. This serves four purposes. First, it makes conformance assessable — assessors know exactly what to test and what score constitutes a pass. Second, it makes conformance comparable — two organisations assessing against the same profile produce comparable results. Third, it makes governance economically rational — low-risk agents receive proportionate governance, making it feasible to govern all agents rather than only the highest-risk ones. Fourth, it makes conformance demonstrable to regulators — an organisation can present a defined profile and its assessment results, rather than an ad hoc selection of controls.
Without profile governance, profiles drift, are gamed (as in Scenario C), or are applied inconsistently. The profile itself is a governance artefact that requires the same change control, versioning, and review discipline as any other governance artefact.
Conformance profiles should be implemented as structured data artefacts, each containing: a profile identifier, a version number, applicability criteria (which agents this profile covers), a list of required controls with minimum score thresholds, and dependency validation results confirming that all required control dependencies are included.
Recommended patterns:
Anti-patterns to avoid:
Basic Implementation — The organisation has defined conformance profiles for at least three risk tiers (low, medium, high). Each profile specifies required controls and minimum scores. Every deployed agent is assigned to a profile. Profile changes follow a documented approval process. Agent reclassification requires governance review. Profiles are reviewed annually.
Intermediate Implementation — Conformance profiles are machine-readable and integrated with the assessment pipeline. Profile assignment triggers automated assessment scope generation. Dependency validation is automated — profiles are validated against the dependency register on every change. Sector overlay profiles address industry-specific requirements. Reclassification has a formal workflow with differential analysis and senior approval for downward changes. Profiles are reviewed semi-annually.
Advanced Implementation — All intermediate capabilities plus: conformance profiles are independently audited for completeness and regulatory alignment. Transitional profiles with time-bounded interim requirements enable governed migration between tiers. Profile analytics track conformance trends across the agent portfolio, identifying systemic weaknesses. Cross-organisation profile harmonisation enables comparable assessments across supply chains. Profile impact simulation allows modelling the effect of proposed profile changes on the entire agent portfolio before commitment.
Required artefacts:
Retention requirements:
Access requirements:
Test 8.1: Profile Completeness Verification
Test 8.2: Dependency Consistency Validation
Test 8.3: Reclassification Governance Enforcement
Test 8.4: Profile Version Immutability
Test 8.5: Profile Change-Control Enforcement
Test 8.6: Automated Assessment Scope Derivation
| Regulation | Provision | Relationship Type |
|---|---|---|
| EU AI Act | Article 9 (Risk Management System) | Direct requirement |
| EU AI Act | Article 43 (Conformity Assessment) | Direct requirement |
| ISO 42001 | Clause 6.1.3 (AI Risk Treatment) | Supports compliance |
| ISO 42001 | Clause 9.2 (Internal Audit) | Supports compliance |
| NIST AI RMF | GOVERN 1.3 (Risk Management Processes) | Supports compliance |
| SOX | PCAOB AS 2201 (Audit Standard on Internal Controls) | Supports compliance |
| FCA SYSC | 6.1.1R (Systems and Controls) | Supports compliance |
Article 43 requires conformity assessment of high-risk AI systems, including assessment against defined requirements. AG-222 provides the mechanism for defining what "conformity" means for each deployment context — the conformance profile is the specification against which conformity is assessed. Without governed profiles, conformity assessment has no defined scope, and assessment results are not comparable across organisations or across time.
Article 9 requires risk management measures proportionate to the level of risk. Conformance profiles implement proportionality by defining different governance requirements for different risk tiers. A low-risk agent receives proportionate governance; a high-risk agent receives comprehensive governance. This risk-proportionate approach directly satisfies Article 9's proportionality requirement.
Clause 9.2 requires internal audit of the AI management system against planned arrangements. Conformance profiles are the "planned arrangements" — they define what the organisation has committed to implementing and at what level. Internal audit scopes and criteria are derived from the profiles, ensuring that audit coverage is systematic and comprehensive.
| Field | Value |
|---|---|
| Severity Rating | High |
| Blast Radius | Organisation-wide — affects the meaning and comparability of all conformance assessments |
Consequence chain: Without conformance profile governance, "conformance" is undefined or inconsistently defined. The immediate failure mode is either over-governance (monolithic profiles making governance economically irrational, leading to governance abandonment) or under-governance (ad hoc profiles allowing high-risk agents to be assessed against lightweight criteria). The downstream consequence is unreliable conformance declarations — stakeholders, regulators, and counterparties cannot rely on conformance claims because the underlying assessment scope is unknown or inconsistent. The ultimate business consequence is loss of standard credibility and regulatory rejection of conformance evidence.
Cross-references: AG-219 (Control Taxonomy Governance) provides the control set from which profiles select. AG-220 (Control Dependency Governance) provides the dependency graph that profiles must respect. AG-221 (Assurance Evidence Schema Governance) standardises the evidence that conformance assessments produce. AG-223 (Certification Scope Governance) builds on profiles to define certification boundaries. AG-157 (External Conformance Assessment) consumes profiles to scope external assessments.