BROCS is a vendor-neutral framework for assessing enterprise AI enablement across Build, Run, Observe, Control, and Secure. It applies the same criteria to commercial and homegrown systems.

What do the five letters stand for?

Build covers tools, access, model keys, data, and delivery paths. Run covers runtime, state, secrets, provisioning, and portability. Observe covers metrics, traces, alerts, and model behavior. Control covers configuration, ingress, identity, storage, routing, and remote access. Secure covers governance, agent oversight, shadow AI, cost, and compliance evidence.

How is BROCS pronounced?

Like "brocks," in one syllable.

Leo Mata created BROCS and introduced it in the 2026 origin essay at leomata.com/blog/brocs. The canonical framework is published at brocs.fyi.

Why five capabilities and not three or seven?

A capability is included when it has an accountable owner, a distinct failure when absent, relevant practice in an established discipline, and the ability to remain weak while another capability is strong. Data, Cost, Govern, and Evaluate are handled within the existing capabilities. The inclusion test is published at brocs.fyi/resources/why-five/.

Is BROCS a maturity model?

BROCS measures current operational coverage. Its labels describe how many assessment statements hold for each capability. They do not certify maturity or provide a cross-organization benchmark.

Is the order of the letters significant?

The order follows the operating sequence. Work is built, run, observed, controlled, and reviewed against security requirements. Secure findings feed new requirements back into Build.

How do I use BROCS in practice?

Use BROCS to define requirements before procurement, assess current coverage, and assign owners during architecture reviews. Ask for operating evidence for each capability instead of relying on product diagrams or policy documents.

A scoreline records one score from 0 to 5 for each BROCS capability in letter order. For example, B4 R3 O2 C3 S1 records the result of the twenty-five-statement assessment at brocs.fyi/resources/assessment/.

What does a zero on a letter mean?

Zero means that none of the assessment statements for that capability can be demonstrated today. The score identifies a coverage gap and does not grade the organization.

Can I use BROCS to evaluate vendors?

Yes. Ask which capabilities the product supplies, which remain the customer's responsibility, and what evidence the product produces. Include integration and exit work in the evaluation.

Does BROCS apply to small companies, or only enterprises?

The capabilities apply at any organization size. A small company may cover them through defaults and shared services, while a larger organization may assign dedicated teams.

Does BROCS only apply to generative AI and agents?

BROCS applies to predictive, generative, and agentic AI systems. The emphasis changes by system; agents usually require more attention to runtime isolation, permissions, tool calls, and audit records.

Does BROCS assume AI is already in use?

BROCS works before and after deployment. Before procurement or implementation, it sets requirements across all five scopes. After deployment, it assesses the operating capabilities behind active assistants, vendor applications, production pilots, APIs, agents, and custom systems.

Does Build mean training a model or developing a custom AI application?

Build covers every sanctioned path people use to create or configure AI work. That includes ready-made assistants, low-code tools, prompts, retrieval, agent builders, APIs, application code, fine-tuning, and model development.

Can AI adoption be high while operational maturity is low?

Yes. Broad use can coexist with uneven operational support. The BROCS scoreline records whether the organization can support, observe, change, secure, and account for the systems people use.

How does BROCS accelerate enterprise AI delivery?

Shared tools, data connections, runtime paths, telemetry, change mechanisms, and inherited controls reduce repeated setup and review work. The assessment helps locate the scope creating the current delay.

Which BROCS gap should an organization address first?

Start with the scope constraining an active system, delivery path, or required control. Assign one improvement to an owner and define the evidence that will show whether it works.

How does BROCS relate to DORA?

DORA defines software delivery performance metrics, including change lead time from version-control commit to production. BROCS applies those measures to versioned AI changes and uses value-stream mapping for the broader path from idea to production. Within BROCS, DORA primarily informs Build, Run, and Observe.

How does BROCS relate to the NIST AI Risk Management Framework?

NIST AI RMF 1.0 organizes risk management under Govern, Map, Measure, and Manage. The BROCS crosswalk maps Map and Measure to Observe, Manage to Control, and Govern to Secure. This mapping is a BROCS interpretation and carries no NIST endorsement.

How does BROCS relate to the EU AI Act, SOC 2, or HIPAA?

Applicable laws and assurance programs define obligations according to system classification, data, and organizational role. BROCS asks which production systems enforce those obligations and produce the required records.

How does BROCS relate to platform engineering?

Platform engineering practices such as self-service provisioning, secure defaults, shared services, and product management transfer directly to Build and Run. BROCS applies them to a tool layer that includes models, prompts, agents, and non-engineer builders.

Is BROCS an alternative to MLOps or LLMOps?

MLOps and LLMOps practices map mainly to Build, Run, Observe, and Control. BROCS also covers organization-wide access, ingress, remote work, routing, governance, cost, and compliance evidence.

What is the failure-mode library?

The library maps public AI incidents to the BROCS capabilities implicated by the reported facts. Each entry links its sources, and each mapping is identified as a BROCS interpretation.

Can I submit a failure mode?

Yes. Open an issue at github.com/brocs-org/brocs or submit a pull request against data/failures.yaml. An entry needs an inspectable public source and a defensible capability mapping.

Why do the answers never name products?

The answers describe capabilities and evidence so the same criteria can be used for any supplier or homegrown system.

How current is the site?

The changelog at brocs.fyi/resources/changelog/ records framework versions and dates. Each page also publishes a last-modified date from the repository history.

Can I use BROCS in my company deck, training, or documentation?

Yes. The framework text is published under CC BY 4.0. Reuse, adaptation, and commercial use require attribution to Leo Mata and brocs.fyi, plus an indication of changes.

Can I train an AI model on this site?

Yes. The CC BY 4.0 license permits reuse with attribution and an indication of changes. robots.txt allows AI crawlers, and the full text is available at brocs.fyi/llms-full.txt.

Cite Leo Mata, BROCS: The framework for enterprise AI enablement, brocs.fyi, and the version used. The citation page provides a plain citation and BibTeX entry.

Is there a machine-readable version?

brocs.fyi/llms.txt provides a curated map, and brocs.fyi/llms-full.txt provides the full corpus. Each page has a raw Markdown version at index.md. Definitions are also published as schema.org DefinedTerm JSON-LD.

Can I disagree with the framework?

Yes. Open an issue at github.com/brocs-org/brocs with the disputed claim, counterexample, and source when the disagreement is factual. Accepted framework changes receive a version and changelog entry.

FAQ

Questions about the BROCS framework itself: what it is, how to use it, how it relates to DORA and NIST, and what you may do with it.

View as Markdown

Questions about the framework itself. Questions about your own stack, the kind that come up in procurement calls and architecture reviews, live on the questions instead. Every answer here is self-contained on purpose: quote them whole.

The entries about active systems explain how BROCS applies when adoption is already underway. See enterprise AI operations for the full operating model.

The framework

What is BROCS? #: BROCS is a vendor-neutral framework for assessing enterprise AI enablement across Build, Run, Observe, Control, and Secure. It applies the same criteria to commercial and homegrown systems.
What do the five letters stand for? #: Build covers tools, access, model keys, data, and delivery paths. Run covers runtime, state, secrets, provisioning, and portability. Observe covers metrics, traces, alerts, and model behavior. Control covers configuration, ingress, identity, storage, routing, and remote access. Secure covers governance, agent oversight, shadow AI, cost, and compliance evidence.
How is BROCS pronounced? #: Like "brocks," in one syllable.
Who created BROCS? #: Leo Mata created BROCS and introduced it in the 2026 origin essay at leomata.com/blog/brocs. The canonical framework is published at brocs.fyi.
Why five capabilities and not three or seven? #: A capability is included when it has an accountable owner, a distinct failure when absent, relevant practice in an established discipline, and the ability to remain weak while another capability is strong. Data, Cost, Govern, and Evaluate are handled within the existing capabilities. The inclusion test is published at brocs.fyi/resources/why-five/.
Is BROCS a maturity model? #: BROCS measures current operational coverage. Its labels describe how many assessment statements hold for each capability. They do not certify maturity or provide a cross-organization benchmark.
Is the order of the letters significant? #: The order follows the operating sequence. Work is built, run, observed, controlled, and reviewed against security requirements. Secure findings feed new requirements back into Build.

Using it

How do I use BROCS in practice? #: Use BROCS to define requirements before procurement, assess current coverage, and assign owners during architecture reviews. Ask for operating evidence for each capability instead of relying on product diagrams or policy documents.
What is a scoreline? #: A scoreline records one score from 0 to 5 for each BROCS capability in letter order. For example, B4 R3 O2 C3 S1 records the result of the twenty-five-statement assessment at brocs.fyi/resources/assessment/.
What does a zero on a letter mean? #: Zero means that none of the assessment statements for that capability can be demonstrated today. The score identifies a coverage gap and does not grade the organization.
Can I use BROCS to evaluate vendors? #: Yes. Ask which capabilities the product supplies, which remain the customer's responsibility, and what evidence the product produces. Include integration and exit work in the evaluation.
Does BROCS apply to small companies, or only enterprises? #: The capabilities apply at any organization size. A small company may cover them through defaults and shared services, while a larger organization may assign dedicated teams.
Does BROCS only apply to generative AI and agents? #: BROCS applies to predictive, generative, and agentic AI systems. The emphasis changes by system; agents usually require more attention to runtime isolation, permissions, tool calls, and audit records.

Starting and operating AI

Does BROCS assume AI is already in use? #: BROCS works before and after deployment. Before procurement or implementation, it sets requirements across all five scopes. After deployment, it assesses the operating capabilities behind active assistants, vendor applications, production pilots, APIs, agents, and custom systems.
Does Build mean training a model or developing a custom AI application? #: Build covers every sanctioned path people use to create or configure AI work. That includes ready-made assistants, low-code tools, prompts, retrieval, agent builders, APIs, application code, fine-tuning, and model development.
Can AI adoption be high while operational maturity is low? #: Yes. Broad use can coexist with uneven operational support. The BROCS scoreline records whether the organization can support, observe, change, secure, and account for the systems people use.
How does BROCS accelerate enterprise AI delivery? #: Shared tools, data connections, runtime paths, telemetry, change mechanisms, and inherited controls reduce repeated setup and review work. The assessment helps locate the scope creating the current delay.
Which BROCS gap should an organization address first? #: Start with the scope constraining an active system, delivery path, or required control. Assign one improvement to an owner and define the evidence that will show whether it works.

Relations to other frameworks

How does BROCS relate to DORA? #: DORA defines software delivery performance metrics, including change lead time from version-control commit to production. BROCS applies those measures to versioned AI changes and uses value-stream mapping for the broader path from idea to production. Within BROCS, DORA primarily informs Build, Run, and Observe.
How does BROCS relate to the NIST AI Risk Management Framework? #: NIST AI RMF 1.0 organizes risk management under Govern, Map, Measure, and Manage. The BROCS crosswalk maps Map and Measure to Observe, Manage to Control, and Govern to Secure. This mapping is a BROCS interpretation and carries no NIST endorsement.
How does BROCS relate to the EU AI Act, SOC 2, or HIPAA? #: Applicable laws and assurance programs define obligations according to system classification, data, and organizational role. BROCS asks which production systems enforce those obligations and produce the required records.
How does BROCS relate to platform engineering? #: Platform engineering practices such as self-service provisioning, secure defaults, shared services, and product management transfer directly to Build and Run. BROCS applies them to a tool layer that includes models, prompts, agents, and non-engineer builders.
Is BROCS an alternative to MLOps or LLMOps? #: MLOps and LLMOps practices map mainly to Build, Run, Observe, and Control. BROCS also covers organization-wide access, ingress, remote work, routing, governance, cost, and compliance evidence.

The content

What is the failure-mode library? #: The library maps public AI incidents to the BROCS capabilities implicated by the reported facts. Each entry links its sources, and each mapping is identified as a BROCS interpretation.
Can I submit a failure mode? #: Yes. Open an issue at github.com/brocs-org/brocs or submit a pull request against data/failures.yaml. An entry needs an inspectable public source and a defensible capability mapping.
Why do the answers never name products? #: The answers describe capabilities and evidence so the same criteria can be used for any supplier or homegrown system.
How current is the site? #: The changelog at brocs.fyi/resources/changelog/ records framework versions and dates. Each page also publishes a last-modified date from the repository history.

Reuse and licensing

Can I use BROCS in my company deck, training, or documentation? #: Yes. The framework text is published under CC BY 4.0. Reuse, adaptation, and commercial use require attribution to Leo Mata and brocs.fyi, plus an indication of changes.
Can I train an AI model on this site? #: Yes. The CC BY 4.0 license permits reuse with attribution and an indication of changes. robots.txt allows AI crawlers, and the full text is available at brocs.fyi/llms-full.txt.
How do I cite BROCS? #: Cite Leo Mata, BROCS: The framework for enterprise AI enablement, brocs.fyi, and the version used. The citation page provides a plain citation and BibTeX entry.
Is there a machine-readable version? #: brocs.fyi/llms.txt provides a curated map, and brocs.fyi/llms-full.txt provides the full corpus. Each page has a raw Markdown version at index.md. Definitions are also published as schema.org DefinedTerm JSON-LD.
Can I disagree with the framework? #: Yes. Open an issue at github.com/brocs-org/brocs with the disputed claim, counterexample, and source when the disagreement is factual. Accepted framework changes receive a version and changelog entry.

Not answered?

If your question is about your own stack rather than about the framework, it probably belongs on the questions. Otherwise, open an issue on the BROCS repository and it will get an answer here.