People & Skills ยท PPL-08
Support for staff using AI
People using AI day to day can get practical help, current guidance and answers to their questions quickly from a known place.
Why it matters
Training fades and tools change. People who cannot get help when they are stuck either stop using AI or find their own ways round problems, which is where mistakes and unsafe use start.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Help depends on knowing someone who understands the tool. |
| 2 Developing | Some guidance or a help channel exists for particular tools or teams, but it is hard to find or not kept current. |
| 3 Defined | A known, resourced support route gives current guidance on every approved AI tool, including its limits and security risks, and tells users promptly of security changes. |
| 4 Managed | Use of support, common questions and response times are measured, and recurring problems feed changes to guidance, learning or tools. |
| 5 Optimising | Support is shaped by how people actually use AI, and good practice from users is captured and shared back. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- PPL-08.1 A known support route offers guidance, examples and answers for every approved AI tool.
- PPL-08.2 The support route is resourced.
- PPL-08.3 Guidance is updated when approved tools change.
- PPL-08.4 Guidance for each approved tool states its known limitations, failure modes and residual security risks, and what users should do about them.
- PPL-08.5 Users are told promptly of changes to approved tools that affect security.
Assessment questions
- Where does someone go when they are unsure how to use an AI tool safely or well?
- Who keeps the guidance current when tools change?
- What are the most common questions, and what has changed as a result?
- The support route and guidance, with update dates
- Support request data or logs showing common themes and actions
- Tool guidance stating limitations, failure modes and residual risks
How to reach Level 3
- Set up one known support route for all approved AI tools (TEC-01), such as an intranet page with a question channel, and give it named people with time to run it.
- Write guidance for each approved tool with examples, known limitations, failure modes and residual security risks, and what users should do about each.
- Agree a routine with the owners of each tool so guidance is updated whenever the tool changes.
- Set up a way to tell users promptly about security-relevant changes, such as a short notice on the support page and a message to users.
Common pitfalls
- Relying on a champions network (CUL-06) alone, which is a peer network and not a resourced support route.
- Publishing guidance at launch and never updating it when the tool changes.
- Describing only what a tool can do and leaving out where it fails.
Starter artefacts
- AI support page and question channel
- Per-tool guidance template with limitations section
- Security change notice template
Cross-references
| AI Cyber Security Code of Practice | 3.2 direct; 7.2 partial; 10.2 direct; 11.1 partial |
|---|---|
| EU AI Act | Art 26(1) partial |
| GDS AI Playbook | P1 partial |
| ISO/IEC 42001 | A.8.2 partial; A.9.2 partial |
| JSP 936 Part 1 | para 48 partial |
| MITRE AI Maturity Model | P6.4 partial |
| NIST AI RMF 1.0 | MANAGE 1.4 partial |
| UNESCO AI Maturity Framework | 3.1 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.