Governance framework & guidance
Monitoring and Review are different
Monitoring asks what the organisation needs to keep watching while an AI Use remains active. Review asks whether, at a particular point in time, the current governance position is still appropriate.
Monitoring is ongoing. Review is an explicit governance event.
Evidence and residual Risk can become stale
Governance decisions often rely on evidence and Controls. If important evidence expires, a Control stops working, a Product changes materially or the organisation uses AI differently, a previously confirmed residual Risk may no longer represent the current position.
Swell can make that governance attention visible rather than continuing to present an outdated rating as current.
The continuing governance question
Approval is not the end of governance. The useful question is: are the conditions that justified that approval still true?
Monitoring and Review connect Approval → Controls and Conditions → evidence and Risk changes → Incidents and Material Changes → Review → Actions or reassessment where required.
Using Swell AI
What does Swell monitor?
Release 1 focuses on governance monitoring rather than technical model telemetry. Swell can surface current Risk positions, Control and evidence currency, approval and Risk Acceptance conditions, supplier assurance gaps, incidents, material changes, operational restrictions and Periodic Review obligations.
Swell does not replace model observability, cybersecurity monitoring or application-performance platforms. Relevant information from those systems can inform the governance position.
Periodic Review
A Periodic Review is a scheduled governance check asking whether the AI Use is still being used for the same purpose, ownership remains correct, Products and suppliers have materially changed, Risks remain accurate, Controls are operating, evidence is current and approval conditions remain satisfied.
Review should be proportionate to the significance of the Use and can conclude no change, actions required or reassessment required.
Review does not overwrite the old Assessment
If a Review determines that reassessment is required, Swell creates a new Assessment cycle rather than rewriting the old one. The organisation can later reconstruct what was originally assessed, what changed and what was decided afterwards.