The Democracy Of AI Governance -Dyfram.
Categorize AI systems, get a numeric risk score compute governance obligations, generate DyFram Governance Core Packages, and deliver implementation-ready outputs across jurisdictions.
Who the Dyfram Serves?
DyFram is a dynamic Governance framwork that can serve government agencies & individuals alike.
Governments
Create DyFram platform for their Jurisdiction. Manage jurisdiction profiles, sector-specific logic, thresholds, versioned obligation changes etc.
Organizations
Submit MDCM data through your Jurisdiction’s Dyfram platform and receive Governance Core Packages/ implementation roadmap and more.
Developers
Connect to DyFram engine through API keys, and build a robust DyFram platform for ther govenements, regulators and governance users to use DyFram
Individuals
Submit the MDCM info via their Jurisdiction’s DyFram frontend, generate and manage versioned DyFram governance Core Packages and implementation roadmaps.
What’s Your AIs Risk Score and DC Signature?.
100 Different AI tools will have almost 100 different inherent risk signatures. DyFram captures all the tiny nuances through a multi dimentional categorization matrix and gives any AI tool a numeric risk score and a classification signature that shows the true and unique risk picture of that specific AI.
Dyfram’s key advantages
Some Amazing DyFram Concepts
DyFram is not only meant for experts. Here are 6 things you’d love, click any card to get familiar.
CPP (Conditional Prohibition Protocol)
DyFram does not believe in “hard bans” vs “free allowed” it rather introduces a CPP stance that relies on a set conditions for certain risk patterns and gives it either “Allowed”, “Allowed with conditions”, “Prohibited by default”, or “Prohibited”. Prohibited by default means banned unless some narrow conditions are met. PBDE is for systems like AI powered weapons and most high stakes military used cases where outright use is by default prohibited unless the government seems it absolutely necessary for national defense. In the DyFram’s world everything depends on conditions. AI weapons could be made if you’re in a hot war. A mass public survelance can be done using AI to expel a group of terrorist hiding amongst civilians, and a mass AI policing can be done to respond to violent riots. By default (When everything is okay), these systems are prohibited but once condisions are favorable they are become allowed.
MCR (Minimum Capability Requirement)
In the world of DyFram AI systems are seen as specialized tools. You can’t just manufacture any automobile and throw it out there in the streets for anyone to use anyhow. Just like people can’t drive cars without a licence but can ride bicycles, MCR determines the skills that an end user must have in order to use an AI system. It can be as easy as a walkaround tutorial, to as complex as a complete licenced training. MCR makes end user training mandatory and depends on G Level and R. AIs have capabilies that users must be trained to handle to avoid what DyFram call AI accidents that could lead to AI hazards. Not every driver can drive a trailer or a 70 seater bus. But if a sedan driver decides to drive a Mercedes trailer and ends up causing accidents you can’t blame Mercedes for that.
R (Risck Score)
Risk Theremometer for AIs. Gone are the days of high risk systems vs low risk systems. DyFram brings in the engineering to tackle that ambiguity. The R score is a single number that indicates the risk threshold of a system. R scores depend on ranges to set a level index which maps dirrectly to G Levels. The MDCM captures your risk profiles and DyFram gives you a number from your system’s unique classification signature. Think of it like the invention of a thermometer. While everyone says it’s warm, or it’s cold outside the R scores says it’s 32 degrees celsius outside.
RB (Red Band)
One sweet thing about the DyFram is the fact that you can plan on a system you want to build by testing different signatures to get a required G Level. However, this is prone to sneaking in a high stakes tool and obtain low governance obligations through gaming. Red Bands are zones in the DyFram spectrum that immediately your tool touches any of them a minimum required G level is triggered. This is to ensure high stakes gets high protection at all times. So if a single individual wants to raise a lion, the obligations are pretty much the same as that of a group raising a lion, because lions are dangerous irrespective of who is raising them.
SAM (Shared Accountability Model)
With Uncle SAM you can’t use your OpenAI API keys to generate harmful images for your downstream users and then heap 100% of the blames on OpenAI. From an AIs model creator like GPT5.5, to orchestrator like AI powered chatapps, to integrators, like AI powered user tools, to platform providers, to end users. Everybody gets a slice of the responsibility. It’s no longer about who is responsible. It’s about Who is responsible for what? If an orchestrator gives chatgpt a dirty prompt the output will be dirty, if an integrator uses your bank accounts as MCP, the AI spends your cash. ChatGPT can’t take 100% of the blame for that except in the case of PII.
JAL (Jurisdictional Adaptation Layer)
So you could very easily be using the NIST Framework in Washington and then decide to give your buddies in Europe a few AI treats and all of a sudden you’re facing a new jurisdiction? More like having to start from scratch. That’s where the Jurisdictional adaptation layer comes in handy. JAL only understands “Jurisdictional Obligations” your Governance level is determined by your country and if you ship to other country JAL looks at what overlay obligations apply so that when a regulator from that country asks a question you have the right evidence and information to show them. JAL is a DyFram big boy that makes DyFram jurisdiction agnostic. It can map to any jurisdiction and give you your overlay obligations. Governments own their JAL, DyFram only processes it.
key governance intensity levels
Mostly Individuals And Lowest Stakes
Personal or experimental tools. Like Solo Dev’s code explainer helper, a social media manager draft generator tool etc. Lowest Governance intensity.
Mostly Internal Teams. Low Stakes.
Mostly small internal tools in SMEs and teams. Low stakes features, like internal productivity assistants that don’t make decisions. Minimal Governance Intensity.
Mostly Solopreneurs & Startups.
Low level customer facing tools, moderate scale, and low risk decisions tools like content moderations tools in small platroms, etc. Standard Governance.
Mostly Standard Businesses and Organizations.
Systems that meaningfully affect users and customers dirrectly. E.g. Mid scale credit screening tool, ranking system that determines opportunities. Elevated Governance Intensity.
Mostly Large Enterprises
Mostly systems that touches essential life chances decisions and often trigger a red band. Hiring, credit, high stakes education etc. High Governance Intensity.
Mostly Global & State Level
Systems used by healthcare, law enforcment etc. Very High Governace Intensity.
G7 Maximum Governance Intensity (LNAS, CSPS, etc) Mostly PBDE CPP.
SPOILER ALERT!!
These G illustrations are just to give a clue. If you as an individual decide to build a tool that a million people will use, that triggers a red band, or strikes a high risk score, you’ll get a certainly high G Level and High Governance obligations. If a large enterprise decides to build a small internal assistant the tool can land on G2 if its risk score is low and it doesn’t trigger a red band.
Faq, Clear your doubts
DyFram is a dynamic AI governance framework that classifies an AI system first, scores its risk, and then assigns the right level of governance for that system. Instead of applying one rigid rulebook to every tool, DyFram uses a structured process to generate governance that fits the AI’s capability, use case, context, impact, and control mode.
No. DyFram is designed to work for solo builders, startups, SMEs, enterprises, and governments, with governance obligations that scale up or down based on the real risk and context of the system. A low-stakes internal assistant may land in a lighter governance level, while a credit, hiring, healthcare, or public-sector system may require much stronger controls and oversight.
No, your government/jurisdiction decides what risk score enters what governance intensity. DyFram only uses a categorization-first process called the MDCM, which examines what the system can do, what it is used for, who controls it, what harms it could cause, how much human oversight exists, and the context in which it operates. From that, it generates a risk score and maps the system to a governance level from G1 to G7, so governance is proportionate rather than arbitrary.
After assessment, your country/Jurisdiction’s DyFram can send raw mdcm Schema for the Dyfram engine to compute and do JAL overlays then your government’s DyFram platform will generate a Governance Core Package that organizes the system’s obligations across key governance layers such as universal controls, jurisdictional requirements, classification-specific rules, user governance, and organizational governance. That package can then be turned into an implementation roadmap with concrete actions, owners, evidence needs, and review expectations so teams can move from assessment to execution.
Yes. The DyFram was built exactly for this. There are two core parts of every DyFram establishment. Govlanes DyFram backend that only contains a risk engine and JAL obligations data, and your Governemet’s own DyFram that contains all the other information. You submit the MDCM via your govenement or Jurisdiction’s DyFram platform and it communicates with Govlane’s DyFram engine to produce a risk Score and other engine level data and sends it back to your Govenments’ DyFram to begin the computation and generation of a Governance Core package. DyFram also includes a Jurisdictional Adaptation Layer that allows you to get the jurisdictional obligation for your specific tools’ sector, sub sector, or even red bands. The JAL also let’s you map jurisdictional obligations from other Jurisdictions in cases where your AI tool will be used abroad.
Get started, get your risk score.
Governance that truly gives you a snapshot of what your risks, an understanding of your obligations and answers to your questions.