Governance & Accountability ยท GOV-08
Policy compliance and exceptions
Compliance with the AI policy is monitored, and exceptions are requested, approved, recorded and reviewed.
Why it matters
A policy nobody checks is advice. Recorded exceptions also show where the policy is out of step with real need, which is the best input to its next revision.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Compliance is not checked; exceptions happen informally or unseen. |
| 2 Developing | Compliance is checked occasionally or after problems; exceptions are agreed verbally or by email without a record. |
| 3 Defined | Compliance with the AI policy is checked on a defined basis, and exceptions go through a recorded process with approval, expiry, risk and treatment. |
| 4 Managed | Compliance results and exception trends are reported to the oversight forum, and repeat exceptions trigger policy review. |
| 5 Optimising | Monitoring is largely built into tools and processes, and exception data routinely improves the policy. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- GOV-08.1 Compliance with the AI policy is checked on a defined basis.
- GOV-08.2 A recorded exception process, with approval and expiry dates, is in use.
- GOV-08.3 Each exception record states the exception's risk and its treatment.
Assessment questions
- How do you know whether the AI policy is being followed?
- If someone needs to do something the policy does not allow, what happens?
- Compliance check records or reports
- The exceptions register, with approvals and expiry dates
How to reach Level 3
- Decide how compliance with the AI policy will be checked, such as an annual sample of uses and a self-declaration by owners, and how often.
- Set up an exception process in which each request records the risk, the treatment, the approver and an expiry date.
- Keep an exception register and review exceptions before they expire, either closing, renewing or escalating them.
- Report compliance findings and open exceptions to the oversight forum (GOV-04).
Common pitfalls
- Granting exceptions with no expiry, so they become permanent policy by the back door.
- Checking compliance only when something goes wrong.
Starter artefacts
- Policy compliance check plan
- Exception request form and register
Cross-references
| AI Cyber Security Code of Practice | 7.2 partial |
|---|---|
| ISO/IEC 42001 | 10.1 partial; 10.2 partial |
| JSP 936 Part 1 | para 13 partial; para 18 direct; para 189 partial |
| MITRE AI Maturity Model | P1.1 direct; P2.3 direct |
| NIST AI RMF 1.0 | MEASURE 1.2 partial |
| UNESCO AI Maturity Framework | 5.1 partial; 5.4 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.