Safe to raise concerns

Anyone can raise a concern or report a problem with AI without fear of blame, and can see what was done about it.

Why it matters

The first signs that AI is producing wrong or harmful results are usually noticed by the people using it. If they fear blame or expect nothing to happen, they stay quiet and the problem grows.

Levels

0 Absent	Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0.
1 Initial	There is no known route for raising AI concerns; problems are raised informally or not at all.
2 Developing	A route exists, such as a general helpdesk or whistleblowing policy, but staff do not know it covers AI or doubt that it is safe to use.
3 Defined	An owned, no-blame route for raising AI concerns is known to all staff, and everyone who raises a concern hears what was done.
4 Managed	Use of the route and staff confidence in it are measured, and response times and outcomes are monitored and reported.
5 Optimising	Raising concerns is seen as normal practice, and the route and the response to it are improved from staff feedback and trends in what is raised.

Level 3 criteria

Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).

CUL-04.1 A no-blame route for raising AI concerns is in place and has an owner.
CUL-04.2 The route has been communicated to all staff.
CUL-04.3 People who raise a concern receive a response on what was done.

Assessment questions

If a member of staff thought an AI tool was giving wrong or unfair results, what would they do?
How do you know staff feel safe to raise AI concerns?
What happens after a concern is raised, and does the person hear back?

Evidence an assessor would expect

Guidance describing the route for raising AI concerns
A log of concerns raised, with responses and outcomes
Staff survey results on confidence in speaking up

How to reach Level 3

Choose or set up a route for raising AI concerns, which can be an existing route explicitly extended to cover AI, and name its owner.
Write down that concerns raised in good faith will not lead to blame, and get senior leaders to say so publicly.
Tell all staff about the route, with examples of the kinds of AI concerns it is for.
Log each concern and give the person who raised it a response on what was done, with links to the incident process (MON-04) where needed.

Common pitfalls

Assuming staff know that a general whistleblowing policy covers AI.
Taking concerns in but never telling the person what happened.
Making the route anonymous only, so there is no way to reply.

Starter artefacts

Guidance on raising AI concerns
Concerns log with responses
No-blame statement from leadership

Ownership and sequence

Accountable: ai governance lead
Contributors: people lead, risk lead
Depends on: GOV-01
Roadmap step: 3
Lifecycle: deploy, operate

Cross-references

AI Cyber Security Code of Practice	2.5 partial; 6.4 partial
ISO/IEC 42001	A.3.3 direct
JSP 936 Part 1	para 51 partial; para 67 direct; para 101 partial
MITRE AI Maturity Model	P3.1 direct
NIST AI RMF 1.0	GOVERN 4.1 partial
UK Data and AI Ethics Framework	SAT 1.9 partial; SAT 3.4 partial

direct: this control at Level 3 meets the item. partial: it covers part of it.