AACF
Portfolio & Use Cases ยท POR-06

Safe experimentation

Staff can try AI quickly within defined guardrails covering approved environments, data limits, time limits and exit criteria.

Why it matters

People learn what AI can do by trying it, and blocking all experiments pushes them towards unapproved tools. Clear guardrails make fast trials possible while keeping sensitive data and live services out of reach until a use has been properly assessed.

Levels
0 AbsentConfirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0.
1 InitialNo sanctioned route to experiment; trials happen informally, often with unapproved tools or real data.
2 DevelopingSome teams have a place or permission to experiment, but rules on data, duration and exit are unclear or inconsistent.
3 DefinedA documented experimentation route with approved environments, data rules, time limits and exit criteria is open to all teams and used.
4 ManagedExperiments are logged and checked against the guardrails, breaches are acted on, and the route's speed and take-up are measured.
5 OptimisingGuardrails and environments are adjusted from what experiments reveal, so the route stays fast and safe as tools and needs change.
Level 3 criteria

Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).

  1. POR-06.1 A documented experimentation route names the approved environments for trying AI.
  2. POR-06.2 The experimentation route sets rules on what data may be used.
  3. POR-06.3 The experimentation route sets time limits and exit criteria for experiments.
  4. POR-06.4 The experimentation route is available to all teams.
  5. POR-06.5 Teams use the experimentation route.
Assessment questions
  • If a team wants to try an AI tool, where and how can they do it safely?
  • What data may and may not be used in an experiment?
  • How is an experiment ended, and what happens to its data and findings?
Evidence an assessor would expect
  • The experimentation rules, covering environments, data, time limits and exit
  • A log of recent experiments with their start, end and outcome
How to reach Level 3
  1. Provide one or more approved environments where staff can try AI tools safely (see TEC-01).
  2. Write simple rules on what data may and may not be used in experiments (see SEC-04 and DAT-05).
  3. Set a default time limit and exit criteria for each experiment, with a route into the pipeline (POR-03) if it succeeds.
  4. Document the route, make it available to all teams and check it is used.

Common pitfalls

  • Making the route so slow that staff experiment with unapproved tools instead (see TEC-08).
  • Allowing experiments to run on with no end date until they become live services by default.

Starter artefacts

  • Experimentation guardrails note
  • Experiment registration form with time limit and exit criteria
Ownership and sequence
Accountable
delivery lead
Contributors
security lead, data owner, ai governance lead
Depends on
GOV-01, TEC-01
Roadmap step
4
Lifecycle
design, acquire_build
Cross-references
AI Cyber Security Code of Practice6.3 partial
JSP 936 Part 1para 85 partial
MITRE AI Maturity ModelP3.1 partial; P4.1 partial; P4.3 partial
UNESCO AI Maturity Framework1.5 direct; 3.4 partial

direct: this control at Level 3 meets the item. partial: it covers part of it.