About
The AI Adoption Controls Framework is written and maintained by Adrian Saxton. It is independent: not a product of any employer, client or standards body.
Management system standards such as ISO/IEC 42001 and risk frameworks such as the NIST AI RMF say what an organisation must do. Security control sets such as the CSA AI Controls Matrix go deep on technical protection. Maturity models score capability in broad bands. This framework sits between them: granular, evidenced controls for adopting AI across a whole organisation, each graded from 0 to 5 and cross-referenced to those standards.
This is a living framework. If a control is wrong, unclear or missing, or a cross-reference is over-claimed, please raise an issue on GitHub or email hello@adriansaxton.com.
Content is licensed under Creative Commons Attribution-ShareAlike 4.0. Scripts are under the MIT Licence.
The controls are original work. Cross-references cite other publications by clause, item or paragraph number and do not reproduce them. Each cross-reference is the author's interpretation and is not endorsed by the publisher.
- UK Government publications (GDS AI Playbook for the UK Government; Algorithmic Transparency Recording Standard; Code of Practice for the Cyber Security of AI; JSP 936 Part 1; Data and AI Ethics Framework and Self-Assessment Tool). Contains public sector information licensed under the Open Government Licence v3.0. Where mapping labels quote these sources, they do so under that licence. No official status or endorsement is implied.
- NIST AI 100-1 (AI Risk Management Framework 1.0) and NIST AI 600-1. National Institute of Standards and Technology, U.S. Department of Commerce. Referenced by subcategory and risk identifier. Republished courtesy of the National Institute of Standards and Technology.
- Regulation (EU) 2024/1689 (EU AI Act). © European Union, https://eur-lex.europa.eu. Referenced by article. Only European Union legislation published in the Official Journal of the European Union is deemed authentic.
- ISO/IEC 42001:2023. Referenced by clause number only. Labels are the author's own descriptions, not ISO text. ISO/IEC 42001 is copyright ISO/IEC and is available from ISO and national standards bodies.
- MITRE AI Maturity Model and Organizational Assessment Tool Guide (2023, © 2022 MITRE, Approved for Public Release, Distribution Unlimited, case 22-1879). Referenced by pillar and dimension; dimension names are cited as names only, with descriptions in the author's own words.
- UNESCO, AI Maturity Framework: a self-positioning guide for public administrations (2025). Licensed by UNESCO under CC BY-SA 3.0 IGO. Referenced by pillar and category. Category names are cited as names only, with descriptions in the author's own words. No UNESCO endorsement is implied.
- CSA AI Controls Matrix (AICM). Not included in this release. A cross-reference will be added only with the Cloud Security Alliance's permission.
- Hanken Grotesk font (`site/assets/fonts/`, `_build/site_assets/brand/fonts/`), licensed under the SIL Open Font License 1.1.