Portfolio & Use Cases ยท POR-04
Stage gates from idea to retirement
Each use of AI passes through defined stages (explore, pilot, scale, operate, retire), with entry and exit criteria checked at each gate.
Why it matters
Gates give a consistent point to ask whether a use should continue, and they let effort and scrutiny grow as the use grows. Without them, pilots drift into live service without the checks that live service needs.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No defined stages; work moves forward by default until someone stops it. |
| 2 Developing | Stages are described but criteria are vague or optional, or gates are used only for some uses. |
| 3 Defined | Documented, risk-proportionate stages with entry and exit criteria apply to every use, with gate decisions and a running design record kept. |
| 4 Managed | Gate outcomes and time spent at each stage are measured, and uses that skip or stall at a gate are identified and dealt with. |
| 5 Optimising | Gate criteria and stages are refined from evidence of which checks catch problems and which only add delay. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- POR-04.1 Documented stages for uses of AI have entry and exit criteria proportionate to risk.
- POR-04.2 The stages are applied to every use of AI.
- POR-04.3 Gate decisions are recorded in the pipeline register (POR-03).
- POR-04.4 A record of key design decisions and assumptions, with reasons, is kept for each use of AI.
- POR-04.5 The design record is updated at each gate.
Assessment questions
- What stages does a use of AI pass through, and what must be true to pass each gate?
- Who decides at each gate, and where is the decision recorded?
- Have any uses reached live service without passing the expected gates?
- Design decision record for each use, updated at each gate
- The documented stage-gate model with entry and exit criteria
- Gate decision records for a sample of uses
How to reach Level 3
- Define stages for each use, such as explore, pilot, scale, operate and retire.
- Write entry and exit criteria for each stage, scaled to risk tier so low-risk uses move quickly.
- Apply the stages to every use and record each gate decision in the pipeline register (POR-03).
- Keep a record of key design decisions and assumptions, with reasons, for each use and update it at each gate.
Common pitfalls
- Applying the same heavy gates to every use regardless of risk.
- Recording gate outcomes but not the design decisions and assumptions behind them.
Starter artefacts
- Stage gate criteria by risk tier
- Design decision and assumptions log template
Ownership and sequence
- Accountable
- ai governance lead
- Contributors
- business owner, delivery lead, risk lead
- Depends on
- GOV-03
- Roadmap step
- 4
- Lifecycle
- design, acquire_build, deploy, operate, retire
Cross-references
| Algorithmic Transparency Recording Standard | Scope timing and updates partial |
|---|---|
| EU AI Act | Art 17 partial |
| GDS AI Playbook | P5 direct |
| ISO/IEC 42001 | 8.1 direct; A.6.1.3 partial; A.6.2.3 partial; A.6.2.5 partial |
| JSP 936 Part 1 | para 13 direct; para 15 partial; para 50 partial; para 102 partial; para 137 partial; para 188 partial |
| MITRE AI Maturity Model | P4.1 partial |
| NIST AI RMF 1.0 | MANAGE 1.1 direct |
| UK Data and AI Ethics Framework | Transparency 2 direct; Transparency 8 direct; Societal impact 6 direct; SAT 1.10 direct; SAT 3.9 direct |
| UNESCO AI Maturity Framework | 5.1 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.