Technology & Platforms ยท TEC-02
Reference architecture for AI
Agreed architecture patterns set out how AI components fit into the technology estate, and new uses of AI follow them or record why not.
Why it matters
Without shared patterns each team solves the same problems differently, which raises cost and leaves an estate that is hard to support or secure. A small set of agreed patterns speeds delivery and makes AI services easier to run and change.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No agreed patterns; each use of AI is designed from scratch. |
| 2 Developing | Some patterns or preferred approaches exist, but they are informal, partial or not used consistently. |
| 3 Defined | Owned reference patterns cover the common uses of AI, are applied through design review, and build in explainability, traceability and guardrails proportionate to risk. |
| 4 Managed | Conformance with the patterns is checked and reported, and departures are tracked to see whether they show a pattern needs to change. |
| 5 Optimising | Patterns are updated from delivery experience, operating data and technology change, and retired when better approaches arrive. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- TEC-02.1 Documented reference patterns with an owner cover the common ways AI is used in the estate.
- TEC-02.2 The patterns are applied through design review, and departures are recorded and approved.
- TEC-02.3 The patterns build in explainability and traceability of outputs.
- TEC-02.4 The degree of explainability each use of AI needs is set by its risk and audience.
- TEC-02.5 The patterns build in input and output guardrails proportionate to risk.
- TEC-02.6 Guardrails are re-evaluated when obligations or the risk assessment change.
- TEC-02.7 Where the organisation builds or offers generative AI, the patterns mark its outputs as AI-generated in a machine-readable way. BLD PRV
Assessment questions
- Are there agreed patterns for how AI fits into your technology estate, and who owns them?
- How is a new use of AI checked against them at design stage?
- What happens when a team needs to depart from a pattern?
- The reference architecture or pattern library for AI
- Design review records showing patterns applied or departures approved
- Output marking in generative AI patterns, where applicable
How to reach Level 3
- Document reference patterns for the common ways AI is used in the estate, with an owner.
- Build into the patterns explainability and traceability of outputs, at a level set by risk and audience, and input and output guardrails proportionate to risk.
- Where the organisation builds or offers generative AI, include machine-readable marking of outputs as AI-generated.
- Apply the patterns through design review, recording and approving any departure.
- Re-evaluate guardrails when obligations or the risk assessment change.
Common pitfalls
- Writing patterns so abstract that design reviewers cannot tell whether a design follows them.
- Setting the same explainability level for every use regardless of risk.
Starter artefacts
- Reference pattern set
- Design review checklist
- Departure record
Ownership and sequence
- Accountable
- delivery lead
- Contributors
- security lead, data owner
- Depends on
- None
- Roadmap step
- 1
- Lifecycle
- design, acquire_build
Cross-references
| AI Cyber Security Code of Practice | 4.2 direct; 6.1 partial; 8.1 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Tool specification partial |
| EU AI Act | Art 50(2) direct; Art 12 partial; Art 14 partial |
| ISO/IEC 42001 | A.4.5 partial |
| JSP 936 Part 1 | para 49c direct; para 150 partial |
| MITRE AI Maturity Model | P1.2 direct; P4.3 direct; P5.1 partial |
| NIST AI 600-1 | R8 partial |
| NIST AI RMF 1.0 | MEASURE 2.9 direct |
| UK Data and AI Ethics Framework | Transparency 5 partial; Transparency 11 direct; SAT 2.5 direct; SAT 4.5 partial; SAT 4.6 partial; SAT 4.9 partial |
| UNESCO AI Maturity Framework | 3.3 direct; 4.3 direct; 4.5 partial; 5.5 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.