Governance & Accountability
Sets out who is accountable for AI, how decisions about AI are made and recorded, and how the organisation keeps sight of the AI it uses. Governance here should be proportionate: light enough that low-risk use is not slowed, firm enough that high-risk use cannot happen without the right people deciding.
AI policy
The organisation has an approved AI policy that states which uses of AI are permitted, which need approval and which are not allowed, and keeps it current.
Executive accountability
A named senior executive is accountable for the organisation's use of AI, with a defined remit, and reports on it to the board or equivalent.
Decision rights proportionate to risk
Decision rights for approving, changing and retiring uses of AI are defined, scaled to risk, and followed.
Oversight forum
A cross-functional forum oversees AI use, risk and performance, with terms of reference, the right membership and a clear link to the organisation's main governance.
Named owners for each use of AI
Every use of AI has named owners for the business outcome, the data, the technology and its assurance, recorded where others can find them.
AI inventory
The organisation keeps a current inventory of the AI it uses, including AI built into bought products and services, with enough detail to govern it.
Integration with existing governance
AI governance works through the organisation's existing risk, information, data protection, security and procurement governance rather than alongside it.
Policy compliance and exceptions
Compliance with the AI policy is monitored, and exceptions are requested, approved, recorded and reviewed.
Public transparency about AI use
The organisation publishes information about how and why it uses AI, to the extent its obligations and public role require, and keeps it current.
Review and disclosure of AI-generated content
The organisation has approved rules for reviewing and disclosing AI-generated content that it releases or relies on, so people know when AI was used.