Strategy & Value ยท STR-02
Where AI will and will not be used
The organisation has decided, and recorded with reasons, the areas of its work where AI is encouraged, where it is allowed only under conditions, and where it is ruled out.
Why it matters
Staff and suppliers need to know where effort is welcome and where it is not, before they invest time in a proposal. Stating the reasons lets people apply the boundaries to cases the list does not name, and lets the organisation revisit them when the reasons change.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No stated boundaries; whether AI is suitable for an area is argued case by case, if at all. |
| 2 Developing | Some areas are informally favoured or avoided, but this is not written down, not reasoned, or not agreed by leadership. |
| 3 Defined | Approved strategic boundaries say where AI is encouraged, conditional or ruled out and why, fit the risk appetite and the policy, and keep some decisions with people. |
| 4 Managed | Proposals and live uses are checked against the boundaries, and pressure on them (repeated requests in a ruled-out area, for example) is reported and considered. |
| 5 Optimising | Boundaries are adjusted from evidence such as outcomes, incidents and external change, and the reasons for each change are published internally. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- STR-02.1 Approved strategic boundaries set out the areas where AI is encouraged, allowed only under conditions, or ruled out, with the reason for each.
- STR-02.2 The strategic boundaries are consistent with the approved AI risk appetite (RSK-01).
- STR-02.3 The AI policy (GOV-01) reflects the strategic boundaries.
- STR-02.4 The strategic boundaries name the kinds of decision that must always be taken by a person.
Assessment questions
- Which areas of your work are you actively seeking to use AI in, and which have you ruled out?
- What reasons are recorded for the areas that are ruled out or conditional?
- How do the boundaries show up in the AI policy and in how proposals are judged?
- The approved statement of strategic boundaries, with reasons
- Cross-references between the boundaries, the risk appetite and the AI policy
How to reach Level 3
- Work through the organisation's main areas of work and sort each into encouraged, conditional or ruled out for AI, writing the reason for each choice.
- Check each boundary against the approved risk appetite (RSK-01) and adjust any that would accept more risk than it allows.
- List the kinds of decision that must always be taken by a person, such as those with serious effects on someone's rights or livelihood.
- Get the boundaries approved and make sure the AI policy (GOV-01) reflects them, including the decisions reserved for people.
Common pitfalls
- Recording the categories without the reasons, so nobody can apply them to a new case.
- Setting boundaries that contradict the risk appetite or the policy, leaving staff unsure which applies.
Starter artefacts
- AI boundaries table with encouraged, conditional and ruled-out areas and reasons
- List of decisions reserved for people
Cross-references
| EU AI Act | Art 5 partial |
|---|---|
| GDS AI Playbook | P6 partial |
| ISO/IEC 42001 | 4.3 partial; A.9.3 partial |
| JSP 936 Part 1 | para 125 partial |
| MITRE AI Maturity Model | P1.1 direct |
| NIST AI RMF 1.0 | GOVERN 3.2 partial |
| UNESCO AI Maturity Framework | 1.2 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.