Portfolio & Use Cases ยท POR-05
Proportionate business case
Each use of AI has a business case scaled to its size and risk that states expected benefits, full costs and assumptions, and is approved before significant commitment.
Why it matters
A business case forces the question of whether AI is the right answer and gives a baseline to judge the use against later. Making it proportionate stops small, low-risk uses being held up by paperwork meant for large investments.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Uses go ahead without a stated case; benefits are assumed rather than described. |
| 2 Developing | Business cases are written for some uses, often large ones, but costs or benefits are incomplete or not quantified. |
| 3 Defined | Every use of AI has a plain-language business case, scaled by a template to its size and risk, covering problem, benefits, costs, assumptions and options, approved at a gate. |
| 4 Managed | Business case assumptions are revisited at later gates, and cases that no longer hold lead to a recorded decision to continue, change or stop. |
| 5 Optimising | Estimates are calibrated against actual costs and benefits from past uses, so cases become more accurate over time. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- POR-05.1 A business case template is scaled by the size and risk of the use.
- POR-05.2 Every use of AI has a business case prepared with the template.
- POR-05.3 Each business case states in plain language the problem the use solves, its benefits, one-off and running costs, assumptions, and options including not using AI.
- POR-05.4 Each business case is approved at the right gate.
Assessment questions
- Does each use of AI have a business case, and how does its depth vary with size and risk?
- Does the case include running costs as well as set-up costs?
- When were the assumptions in a live use's case last checked?
- The business case template and guidance on proportionality
- Approved business cases for a sample of uses of different sizes
How to reach Level 3
- Create a business case template with a short version for small, low-risk uses and a fuller one for large or high-risk uses.
- Require each case to state in plain language the problem solved, benefits, one-off and running costs, assumptions and options, including not using AI.
- Set which gate approves the business case for each size and risk level (POR-04) and apply it to every use.
Common pitfalls
- Leaving out running costs such as usage charges and support (see OPM-03).
- Not considering a non-AI option, so AI is assumed to be the answer.
Starter artefacts
- Scaled business case template
- Cost checklist for one-off and running costs
Ownership and sequence
- Accountable
- business owner
- Contributors
- delivery lead, ai governance lead
- Depends on
- POR-04
- Roadmap step
- 5
- Lifecycle
- design, acquire_build
Cross-references
| AI Cyber Security Code of Practice | 2.1 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Description and rationale partial |
| GDS AI Playbook | P6 partial |
| ISO/IEC 42001 | A.6.2.2 partial |
| JSP 936 Part 1 | para 28 direct; para 52 partial |
| MITRE AI Maturity Model | P6.1 direct |
| NIST AI RMF 1.0 | MAP 1.1 partial; MAP 1.4 direct; MAP 1.6 partial; MAP 2.1 partial; MAP 3.1 direct; MAP 3.2 partial; MAP 5.1 partial; MANAGE 2.1 partial |
| UK Data and AI Ethics Framework | Transparency 1 direct; Transparency 2 partial; Transparency 8 partial; Societal impact 1 direct; SAT 1.1 direct; SAT 1.2 partial; SAT 2.10 direct |
| UNESCO AI Maturity Framework | 1.2 partial; 1.4 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.