AI Adoption Controls Framework
What an organisation needs in place to adopt AI well, who owns it, how far along it is, and how that lines up with the standards it answers to: 93 controls in 11 domains.
A controls matrix for AI adoption: the organisational layer that sits above technical and security control sets. It covers strategy, governance, risk and ethics, the portfolio of uses, the operating model, data, technology, security, people, culture and measurement.
Each control has an objective, five level descriptors from Initial to Optimising, with Level 3 as the foundation every organisation should have, and Levels 4 and 5 for going beyond it, assessment questions, the evidence an assessor would expect, an accountable owner, dependencies on other controls, short guidance on reaching Level 3, and cross-references to published standards.
- STRStrategy & Value8 controls
- GOVGovernance & Accountability10 controls
- RSKRisk, Ethics & Compliance9 controls
- PORPortfolio & Use Cases9 controls
- OPMOperating Model & Delivery10 controls
- DATData & Information8 controls
- TECTechnology & Platforms8 controls
- SECAI Security6 controls
- PPLPeople & Skills8 controls
- CULCulture & Change8 controls
- MONMeasure & Improve9 controls
- Assess. Score each control from 0 to 5 against its level descriptors, in the browser or in the assessment workbook.
- See the gaps. Mean level and the share of controls at target, by domain.
- Plan. The controls below target, in dependency order, become the improvement roadmap.
- Show alignment. Each control is cross-referenced to the standards below, so one assessment speaks to several of them.
- AI Cyber Security Code of Practice our coverage
- Algorithmic Transparency Recording Standard our coverage
- EU AI Act our coverage
- GDS AI Playbook our coverage
- ISO/IEC 42001 our coverage
- JSP 936 Part 1 our coverage
- MITRE AI Maturity Model our coverage
- NIST AI 600-1 our coverage
- NIST AI RMF 1.0 our coverage
- UK Data and AI Ethics Framework our coverage
- UNESCO AI Maturity Framework our coverage
Jurisdiction and sector requirements are carried in the cross-references, not in the controls, so the controls work for any organisation. See the coverage of each standard.
Version 1.0.0. Open for comment: tell me what is wrong or missing.