Governance & Accountability ยท GOV-03
Decision rights proportionate to risk
Decision rights for approving, changing and retiring uses of AI are defined, scaled to risk, and followed.
Why it matters
If every use needs the same approval, low-risk use is choked and people work around the process. If none does, high-risk use goes ahead unseen. Tiered decision rights give speed where it is safe and scrutiny where it matters.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No defined approval route; uses of AI start wherever someone decides to try them. |
| 2 Developing | An approval route exists for some uses or some parts of the organisation, or is the same for all uses regardless of risk. |
| 3 Defined | Risk-tiered decision rights for approving, changing and retiring uses of AI are applied everywhere, screen out prohibited practices and stop uses beyond the risk appetite. |
| 4 Managed | Decisions are recorded and periodically checked against the tiers; bypasses are detected and dealt with. |
| 5 Optimising | Tiers and thresholds are adjusted from evidence such as time to decision, incidents and outcomes, so the route stays proportionate. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- GOV-03.1 Defined decision rights, tiered by residual risk, state who can approve, change and retire each class of AI use.
- GOV-03.2 The decision rights are applied across the organisation.
- GOV-03.3 The approval route screens each proposed use of AI against prohibited practices.
- GOV-03.4 A use whose residual risk cannot be brought within the risk appetite is not approved, or is stopped.
Assessment questions
- Who can approve a new use of AI, and does that depend on its risk?
- Who can change or switch off a use of AI once it is live?
- How would you know if a use of AI went live without approval?
- Documented decision rights or approval matrix by risk tier
- A sample of approval records for recent uses of AI
How to reach Level 3
- Group uses of AI into risk tiers based on residual risk from the risk assessment (RSK-02).
- For each tier, write down who can approve, change and retire a use, and publish this as a decision rights table.
- Add a screening step at the start of the approval route that checks each proposal against prohibited practices in the policy (GOV-01).
- Make it a rule that a use whose residual risk cannot be brought within the risk appetite (RSK-01) is refused or stopped, and record such decisions.
- Apply the decision rights to every AI use across the organisation and check a sample each year for compliance (see GOV-08).
Common pitfalls
- Covering approval but not change or retirement, so material changes slip through unreviewed.
- Sending every use to the same senior forum, which creates a queue and encourages workarounds.
Starter artefacts
- Decision rights table by risk tier for approve, change and retire
- Prohibited practice screening checklist
Cross-references
| EU AI Act | Art 5 direct; Art 6 partial; Art 25 partial; Art 26(1) partial |
|---|---|
| ISO/IEC 42001 | 5.3 partial; 8.1 partial; A.9.4 partial |
| JSP 936 Part 1 | para 28 partial; para 75 partial; para 86 partial; para 88 partial; para 90 partial; para 102 partial; para 177 partial; para 206 partial |
| MITRE AI Maturity Model | P3.2 partial |
| NIST AI RMF 1.0 | GOVERN 1.3 partial; GOVERN 2.1 partial; GOVERN 2.3 partial; MAP 3.3 partial; MEASURE 2.6 partial; MANAGE 1.1 partial |
| UK Data and AI Ethics Framework | Safety 8 direct; SAT 1.8 partial; SAT 1.9 direct; SAT 3.9 direct; SAT 4.9 partial |
| UNESCO AI Maturity Framework | 5.1 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.