Governance & Accountability ยท GOV-07
Integration with existing governance
AI governance works through the organisation's existing risk, information, data protection, security and procurement governance rather than alongside it.
Why it matters
A separate AI governance track duplicates effort, confuses people and leaves gaps where the two meet. Most AI questions are existing questions with a new twist, and the existing owners should answer them.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | AI is handled entirely outside existing governance, or ignored by it. |
| 2 Developing | Some links exist, for example data protection reviews AI cases, but the routes are informal and inconsistent. |
| 3 Defined | Existing governance processes each have a defined AI step that the AI route calls on, with information and data protection advice involved from the start. |
| 4 Managed | Hand-offs between AI and existing governance are tracked, and duplication or gaps are identified and closed. |
| 5 Optimising | AI considerations are part of how existing governance normally works, and no separate track is needed for routine decisions. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- GOV-07.1 Risk, information management, data protection, security, procurement, safety and quality management, internal audit and business continuity processes each have a defined AI step.
- GOV-07.2 The AI governance route calls on those processes rather than repeating them.
- GOV-07.3 Uses of AI that could contribute to physical harm have a hazard analysis that feeds the relevant safety case. HIR
- GOV-07.4 Information governance and data protection advice is brought in at the start of design for each use of AI.
- GOV-07.5 Information governance and data protection advisers have authority to require changes to a use of AI.
Assessment questions
- When a use of AI is proposed, which existing governance processes does it go through?
- Where do AI decisions duplicate or bypass existing processes?
- Process maps or guidance showing the AI steps in existing governance
- Examples of AI cases handled through those routes
- The AI step in safety and quality management, and hazard analyses for uses that could cause physical harm
How to reach Level 3
- List the existing governance processes (risk, information management, data protection, security, procurement, safety and quality management, internal audit and business continuity) and add a defined AI step to each.
- For uses that could contribute to physical harm, require a hazard analysis and feed its results into the relevant safety case.
- Design the AI approval route so it calls on these processes for their parts rather than repeating their checks.
- Bring information governance and data protection advisers in at the start of design, and give them authority to require changes.
Common pitfalls
- Building a separate AI process that duplicates existing checks and frustrates delivery teams.
- Involving data protection advisers only at the end, when changes are expensive.
Starter artefacts
- Governance integration map showing the AI step in each process
- Hazard analysis template for AI uses
Ownership and sequence
- Accountable
- ai governance lead
- Contributors
- risk lead, security lead, data owner
- Depends on
- GOV-03
- Roadmap step
- 4
- Lifecycle
- strategy, design, acquire_build
Cross-references
| Algorithmic Transparency Recording Standard | Scope exemptions partial |
|---|---|
| EU AI Act | Art 26(9) partial |
| GDS AI Playbook | P10 direct |
| ISO/IEC 42001 | A.2.3 direct |
| JSP 936 Part 1 | para 8 partial; para 9 partial; para 47 partial; para 82 partial; para 141 direct; para 142 direct; para 187 partial; para 188 partial; para 189 partial; para 190 partial; para 191 direct; para 192 partial; para 194 partial; para 196 partial |
| MITRE AI Maturity Model | P2.3 partial; P5.3 partial |
| NIST AI RMF 1.0 | GOVERN 1.4 partial; MEASURE 2.6 partial |
| UK Data and AI Ethics Framework | Accountability 2 direct; Privacy 1 direct; SAT 1.3 partial; SAT 1.4 direct; SAT 1.6 partial; SAT 1.8 partial; SAT 2.1 partial |
| UNESCO AI Maturity Framework | 5.1 partial; 5.4 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.