Intended use, claims and terms

What the framework is for

The AI Adoption Controls Framework sets out what an organisation needs in place to adopt AI well. It covers who owns each control, how to tell how far along the organisation is, and how its controls line up with published standards. It is for:

• leaders and AI governance leads who want a clear picture of where the organisation stands;
• assessors, internal audit and consultants who assess an organisation against it;
• teams who want a practical route to a defensible baseline.

What is assessed

The unit of assessment is the organisation, or a clearly defined part of it, such as a division or a group of services. An assessment is not a test of one AI system. Many criteria apply to “each use of AI”, so an assessor checks that the practice is in place and applied across the uses in scope, sampling where the number of uses is large.

An assessment starts with scoping: what is in scope, and which overlays apply (see below). It then scores each control from 0 to 5 using the rules in the assessor rulebook.

What a result means, and what it does not

• A control at Level 3 means the organisation meets every applicable Level 3 criterion for that control, on the evidence the assessor saw, at the date of the assessment.
• A result is a framework assessment. It is not certification against any standard and not a legal compliance opinion. It does not show that the organisation complies with ISO/IEC 42001, the EU AI Act or any other mapped source.
• Cross-references show where a control supports a source requirement, as the author interprets it. They help an organisation see where one piece of evidence may serve several purposes. They are not a substitute for reading the source.
• “Coverage of mapped items” describes the items selected from each source for mapping. It does not claim that every obligation in a source is covered.

Overlays

Every criterion is either core, applying to every organisation, or conditional on an overlay. During scoping the organisation records which overlays apply and why. A conditional criterion counts only when its overlay applies.

Code	Overlay	Applies when the organisation
PUB	Public body	is a public sector body, or acts on behalf of one, with public duties such as transparency and equality
PRV	Provides AI to others	offers AI services, products or models to customers, partners or the public
HIR	Regulated or high-impact use	has uses of AI that are regulated, high-risk under law, or could significantly affect people’s rights, safety or access to services
GEN	Generative AI	uses AI that generates text, images, audio, video or code
AGT	Agentic AI	uses AI that can act in other systems or act with some autonomy, including through tools
BLD	Builds or tunes its own models	trains, fine-tunes or otherwise develops models or AI components itself

Glossary

Term	Meaning in this framework
Use of AI	A distinct application of AI to a purpose in the organisation, whether built, bought, embedded in another product or used as a general tool. The unit recorded in the AI inventory (GOV-06).
In scope	Within the boundary set at scoping. “Every use of AI” means every use within that boundary.
Higher risk	A use rated at the upper tiers of the organisation’s own risk classification (RSK-01, RSK-02), or one covered by the HIR overlay.
Provider	An organisation that develops AI, or has it developed, and places it on the market or provides it to others under its own name.
Deployer	An organisation that uses AI under its own authority, whoever built it.
AI from others	AI the organisation obtains from suppliers, including AI features embedded in products it buys.
Evidence	A record that shows a practice exists and is applied: a document, a register entry, a log, a decision record, a sample of completed work, or a corroborated interview.
Criterion	One testable outcome within a control’s Level 3. Each has an ID such as GOV-01.2.
Baseline	Level 3. The point at which a control is met.
Target	The level the organisation has agreed to reach for a control. Normally 3. A target below 3 needs a recorded rationale, an approver and a review date.
At target	The current level equals or exceeds the agreed target. This is different from reaching the baseline.

Assessor rulebook

These rules make results repeatable: two assessors with the same evidence should reach the same level.

1. Scope first

1. Record the boundary of the assessment: which parts of the organisation, and which uses of AI.
2. Record which overlays apply (PUB, PRV, HIR, GEN, AGT, BLD), with a one-line reason for each decision.
3. A criterion tied to an overlay that does not apply is left out. It is neither met nor failed. A criterion tagged with more than one overlay applies when any of them applies.
4. A whole control is N/A only when every one of its criteria is tied to overlays that do not apply, or when the assessor records a specific reason that is approved by the assessment sponsor.

2. Statuses before a level

Every control ends the assessment with exactly one status:

Status	Use when	Counts in scores?
Scored (0 to 5)	Enough evidence was seen to place the control at a level	Yes
Insufficient evidence	The control was looked at, but the evidence could not support a level	No. It is listed separately, and is not treated as 0
Not assessed	The control was not looked at in this assessment	No. It is listed separately
N/A	Rule 1.4 applies, with the reason recorded	No

Level 0 means confirmed absence: the evidence shows that nothing is in place. “We don’t know” is insufficient evidence, not 0.

3. Placing the level

1. Level 3: every applicable Level 3 criterion is met. One unmet applicable criterion means the control is not at Level 3.
2. Levels 4 and 5: Level 3 must be met first. Each higher level must then be fully met on its own descriptor. Levels are cumulative and are never skipped.
3. Levels 1 and 2: use the descriptors. As a rule, Level 2 is in place in part of the organisation, or in place but not enforced or not owned. Level 1 is individual effort with nothing documented.
4. Never round up. If the evidence sits between two levels, record the lower one and note what is missing.
5. Record every criterion. For each applicable Level 3 criterion, record met, not met or not evidenced, so a partial result shows exactly what is outstanding.

4. Evidence

1. Each scored control has at least one evidence reference. A level of 3 or more with no evidence reference is invalid.
2. Recency: evidence should be current, which normally means within the last 12 months or the last review cycle. Older evidence needs a note explaining why it still holds.
3. Sampling: where a criterion applies to “each use”, sample enough uses to be confident: all of them if there are five or fewer, otherwise at least five, chosen to include higher-risk uses. Record what was sampled.
4. Interviews alone can support Level 1 or 2. Level 3 needs a record.
5. Contradictory evidence: go with the evidence that shows actual practice (registers, logs, completed records) over evidence that shows intent (policies, plans), and note the conflict.
6. Inherited controls (a parent body’s or a supplier’s) count where the organisation can show they apply to it and it can rely on them, for example through a written agreement or assurance report.
7. Confidence: record high, medium or low for each scored control. Low confidence is reported, and is not hidden in the level.

5. Targets

1. The default target is 3, the baseline.
2. A target below 3 needs a recorded rationale, an approver and a review date. A criterion that is required by law or regulation cannot be lowered by a local target.
3. Results are always reported twice: against the Level 3 baseline and against the agreed target. Lowering a target never changes the baseline result.

6. Independence

1. The person who operates a control should not be the only person who scores it. Assurance and monitoring controls (the MON domain) should be scored or challenged by someone independent of their operation.
2. Record the assessor, and the reviewer or challenger, for each scored control in the higher-risk domains (GOV, RSK, SEC), and for any control scored at Level 4 or 5.

7. Reporting

Lead with the distribution of levels and the share of controls at the Level 3 baseline, then the share at target, the counts of insufficient evidence, not assessed and N/A, and the critical gaps. The mean level may be shown for trends, but only as a descriptive average: the 0 to 5 scale is ordered, and the steps between levels are not equal.