AACF
Measure & Improve ยท MON-08

Reporting to leadership

Leadership and the board receive consolidated, evidence-based reporting on AI use, performance, benefits, incidents and risk, on a set cycle.

Why it matters

Leaders cannot oversee what they cannot see. Bringing measures, benefits, incidents and assurance findings into one report lets them judge the overall position and make decisions on evidence rather than anecdote.

Levels
0 AbsentConfirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0.
1 InitialLeadership hears about AI through occasional updates or individual project reports.
2 DevelopingSome reporting reaches leadership, but it is not consolidated, is mostly narrative or covers only some uses of AI.
3 DefinedLeadership and the board receive an owned, consolidated AI report from defined data on a set cycle, with a signed assurance statement where the organisation answers upward.
4 ManagedThe data behind the report is checked for accuracy, leadership actions are tracked, and reporting shows trends against targets.
5 OptimisingReport content is refined from what leaders use in decisions, and the report brings in external comparison and forward-looking indicators.
Level 3 criteria

Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).

  1. MON-08.1 A consolidated report with an owner covers AI use, performance, benefits, incidents and risk.
  2. MON-08.2 The report is produced on a set cycle from defined data.
  3. MON-08.3 The report goes to leadership and the board.
  4. MON-08.4 Where the organisation answers to a parent body, regulator or group board, it gives a periodic signed assurance statement backed by auditable evidence.
Assessment questions
  • What does leadership receive about AI, and how often?
  • Where does the data in the report come from, and how is it checked?
  • Can you show a leadership decision made on the basis of the report?
Evidence an assessor would expect
  • Recent leadership or board reports on AI
  • Minutes recording discussion and actions arising
  • Signed assurance statements with their evidence, where required
How to reach Level 3
  1. Name an owner for leadership reporting on AI and agree the reporting cycle with the board.
  2. Define the data for each section of the report: AI use from the inventory (GOV-06), performance from monitoring (MON-02), benefits (MON-03), incidents (MON-04) and risk.
  3. Produce one consolidated report on that cycle and send it to leadership and the board.
  4. Where you answer to a parent body, regulator or group board, add a signed assurance statement on the agreed cycle and keep the evidence behind it ready for audit.

Common pitfalls

  • Sending a narrative update with no data behind it.
  • Reporting each project separately, so leaders never see the whole picture.
  • Signing assurance statements without keeping the evidence that supports them.

Starter artefacts

  • Consolidated AI report template
  • Data source list for each report section
  • Signed assurance statement with evidence pack
Ownership and sequence
Accountable
executive sponsor
Contributors
ai governance lead, risk lead, business owner
Depends on
GOV-02, MON-02, MON-03
Roadmap step
10
Lifecycle
strategy, operate
Cross-references
ISO/IEC 420019.3 direct
JSP 936 Part 1para 99 partial
MITRE AI Maturity ModelP2.3 partial
UNESCO AI Maturity Framework2.3 direct; 4.2 partial

direct: this control at Level 3 meets the item. partial: it covers part of it.