Red Hat announced Monday the formation of asago — short for AI Safety and Governance Orchestration — an open-source project that wants to do something nobody has quite managed yet: turn AI governance policies into infrastructure controls that deploy automatically alongside AI systems.
The project, reported by SiliconANGLE, brings together Red Hat, Microsoft, Nvidia, IBM Research, MIT Lincoln Laboratory, the Alan Turing Institute, and several universities. It is the kind of coalition that gets attention not because of what it builds but because of who is building it.
The Problem asago Targets
AI governance has a translation problem. Compliance teams write policies in human language. Data scientists build models in Python. Infrastructure administrators deploy systems in Kubernetes, Terraform, and Ansible. The gap between a policy clause that says “high-risk systems must undergo bias testing before deployment” and the actual Kubernetes configuration that enforces it is enormous — and right now, that gap is bridged by hand.
Manual interpretation, custom scripts, and hand-offs between teams slow deployments and introduce errors. More critically, there’s no audit trail. When a regulator asks “which control enforces this policy requirement?”, the answer is often “someone wrote a script for that, but they left six months ago.”
Asago’s pitch is straightforward: automate the pipeline from policy to deployment, and keep the audit trail intact so every active control can be traced back to the specific clause it implements.
How It Works
The project maps a four-stage pipeline:
-
Interpret. Asago reads an organisation’s governance policies and maps them to established frameworks — the NIST AI Risk Management Framework, the OWASP Top 10 for LLM Applications, and the EU AI Act. The mapping uses IBM’s AI Risk Atlas.
-
Test. It generates and runs safety tests tailored to the specific use case. A hiring tool gets bias tests. A medical chatbot gets accuracy tests. The tests are determined by the policy requirements, not by an engineer’s best guess.
-
Recommend. Based on test results, asago recommends mitigations and guardrails — and records the rationale. Not just “add a content filter” but “add a content filter because policy clause 4.2 requires output moderation for user-facing systems.”
-
Deploy. It translates the controls into deployment-ready configurations: Kubernetes manifests, Terraform plans, Ansible playbooks. The same controls that were tested are the ones that ship.
“To be trusted in real-world environments, AI needs measurable testing and operational controls,” said Priya Nagpurkar, vice president of AI Platform at IBM Research, in a statement. “Through the asago community, IBM is contributing our expertise to help bridge the gap between governance frameworks and deployed AI systems.”
Why This Matters Now
The timing is not accidental. The EU AI Act’s transparency obligations took effect on August 2, 2026. Companies deploying AI systems in the European market now face specific, enforceable requirements around deepfake labelling, AI-generated content disclosure, and risk documentation. The penalties for non-compliance can reach 7 per cent of global turnover.
Most organisations are not ready. A recent analysis found that only 8 of 27 EU member states had the national authorities in place to enforce the Act by the deadline. If the regulators aren’t ready, the regulated entities are further behind.
Asago addresses the operational end of that gap. The policy exists. The infrastructure doesn’t. The project’s value proposition is making the connection automatic rather than manual — and making it auditable, so when a regulator shows up, the organisation can point to a specific control and say “this enforces clause 4.2, here’s the test that proved it works, here’s the evidence.”
The Coalition and What It Signals
The participant list reads like a who’s-who of enterprise AI: Red Hat (IBM), Microsoft, Nvidia, the Alan Turing Institute, MIT Lincoln Laboratory, plus Alquimia AI, Brave Software, the EvalEval coalition, and two universities. Nvidia’s involvement is notable — the company that builds the hardware most AI systems run on is now participating in a project that governs how those systems are deployed.
Microsoft’s presence is more complex. The company has its own AI governance tools, its own Responsible AI framework, and its own compliance products. Participating in an open-source project that standardises governance across vendors suggests either genuine commitment to interoperability or a desire to shape the standard before it shapes them. Probably both.
The software will be released under the Apache License 2.0, which is permissive enough for enterprise adoption but requires derivative works to preserve the licence. The project is currently in its formation phase, with a GitHub repository open for early adopters.
The NZ Connection
New Zealand’s AI regulatory posture is, as Bell Gully has noted, deliberately “light touch.” The Ministry for Regulation has issued AI guidance for regulators, but there is no NZ equivalent of the EU AI Act’s enforcement machinery.
That doesn’t mean NZ companies can ignore governance automation. Any Kiwi company selling AI-powered products or services into the EU market — and many do, from agritech to healthtech — needs to comply with the AI Act. Tools like asago that standardise the compliance pipeline could reduce the cost of that compliance, making it easier for smaller NZ firms to enter European markets without building a bespoke governance infrastructure from scratch.
❓ FAQ
What does asago actually do? It connects AI governance policies to the infrastructure controls that enforce them. You write a policy saying “high-risk systems need bias testing.” Asago generates the test, runs it, recommends guardrails based on the results, and produces the Kubernetes/Terraform/Ansible configuration to deploy the controls alongside your AI system.
Is this just for EU AI Act compliance? No. Asago maps to multiple frameworks — NIST AI RMF, OWASP Top 10 for LLMs, and the EU AI Act. The EU Act is the most immediately pressing, but the architecture is framework-agnostic.
Why is this open source rather than a commercial product? Governance standards work best when they’re shared. If every vendor has their own proprietary compliance pipeline, regulators can’t verify them and companies can’t compare them. Open source creates a common layer that everyone can audit.
Does this replace compliance teams? No. Asago automates the translation from policy to infrastructure, but the policies themselves still need human interpretation. The project’s own description emphasises that it “replaces manual policy interpretation and custom scripts” — not the judgement of compliance professionals.
🔍 THE BOTTOM LINE
The gap between AI policy and AI deployment is where most compliance failures live. Asago is an attempt to close that gap with open-source tooling and a coalition that includes the major vendors. Whether it succeeds depends on adoption — if Microsoft, Nvidia, and IBM actually use it in their own products, it becomes a de facto standard. If it remains a research project with good intentions, the gap stays open.
