Platform-Native vs. Org-Overlay Governance

What your AI platform already provides — and what your organization has to add on top.

Regulatory Crosswalk mapped your controls to framework requirements. This module gets one layer underneath that: which of your controls come from the AI platform you use (platform-native) and which you have to build yourself (org-overlay). Knowing the boundary is what lets you avoid two equally common failures — over-building controls your vendor already provides, and assuming controls exist that your vendor doesn't actually offer. Five things every IT lead, vendor manager, and policy author should be able to inventory cleanly.