AI governance lead
Runs AI governance day to day: policy, register, forum secretariat.
- Often held by
- a head of AI governance or chief AI officer, or a governance, digital or data lead given the role
- Accountable for
- 16 controls
- Contributes to
- 42 controls
- Relies on
- Risk lead (11), Business owner (10), Delivery lead (9), Security lead (5), Executive sponsor (3), Data owner (3), People lead (3)
- Supports
- Executive sponsor (17), Business owner (6), Delivery lead (5), Data owner (5), Risk lead (4), People lead (3), Security lead (2)
Accountable for
This role answers for each of these controls reaching the level the organisation has set, and holds the evidence.
Horizon scanning and external expectations
The organisation tracks changes in AI technology, regulation, peer practice and public expectation, and feeds what it finds into its AI strategy.
With: Risk lead, Delivery lead, Security lead.
Evidence an assessor would expect
- Horizon scanning outputs, such as briefings or a log of developments
- Records showing findings were considered by the forum or in strategy papers
Oversight forum
A cross-functional forum oversees AI use, risk and performance, with terms of reference, the right membership and a clear link to the organisation's main governance.
With: Executive sponsor, Risk lead, Security lead, Data owner, People lead.
Evidence an assessor would expect
- Terms of reference and membership list
- Agendas, minutes and a decision or action log
Named owners for each use of AI
Every use of AI has named owners for the business outcome, the data, the technology and its assurance, recorded where others can find them.
With: Business owner, Data owner, Delivery lead.
Evidence an assessor would expect
- Ownership fields in the AI inventory
- Evidence that ownership is updated on staff changes
- Ownership handover records with residual risk acceptance
AI inventory
The organisation keeps a current inventory of the AI it uses, including AI built into bought products and services, with enough detail to govern it.
With: Delivery lead, Security lead, Business owner.
Evidence an assessor would expect
- For each agent: the tools, systems and data it can act on, and its approval thresholds
- The inventory itself, with a recent update date
- The process or form that adds and removes entries
- Regulatory classification and reasons recorded against inventory entries
Integration with existing governance
AI governance works through the organisation's existing risk, information, data protection, security and procurement governance rather than alongside it.
With: Risk lead, Security lead, Data owner.
Evidence an assessor would expect
- Process maps or guidance showing the AI steps in existing governance
- Examples of AI cases handled through those routes
- The AI step in safety and quality management, and hazard analyses for uses that could cause physical harm
Policy compliance and exceptions
Compliance with the AI policy is monitored, and exceptions are requested, approved, recorded and reviewed.
With: Risk lead, Security lead.
Evidence an assessor would expect
- Compliance check records or reports
- The exceptions register, with approvals and expiry dates
Review and disclosure of AI-generated content
The organisation has approved rules for reviewing and disclosing AI-generated content that it releases or relies on, so people know when AI was used.
With: Risk lead, Business owner.
Evidence an assessor would expect
- The approved rules for reviewing and disclosing AI-generated content, with owner and approval record
- A sample of released content and internal records showing review and disclosure
- The legal disclosure requirements the rules were checked against
Ethical principles in practice
The organisation has adopted ethical principles for AI and applies them through a working review route that can change or stop a use of AI.
With: Risk lead, Business owner, People lead.
Evidence an assessor would expect
- Record of trade-offs between principles, with alternatives and reasons
- The adopted principles and the terms of reference for the review route
- Records of ethical reviews and their outcomes
- Principles assessments at the outset and the approval tier they informed
Idea intake open to all staff
Anyone in the organisation can propose a use of AI through a simple, well-known route, and every proposal is acknowledged and considered.
With: Business owner, Delivery lead.
Evidence an assessor would expect
- The intake form or route, with its owner and how it is publicised
- A log of recent proposals showing acknowledgement and outcome
Agreed prioritisation criteria
Proposed uses of AI are ranked against published criteria covering value, feasibility, risk, cost and strategic fit, applied the same way to every proposal.
With: Executive sponsor, Business owner, Risk lead, Delivery lead.
Evidence an assessor would expect
- The published prioritisation criteria and scoring method
- Scoring records for a sample of recent proposals
Pipeline register of proposed uses
A single register records every proposed and in-flight use of AI with its status, owner and decision history, and hands each entry to the AI inventory when it goes live.
With: Business owner, Delivery lead.
Evidence an assessor would expect
- The pipeline register, with a recent update date
- Decision history for a sample of entries
- Examples of entries handed over to the AI inventory
Stage gates from idea to retirement
Each use of AI passes through defined stages (explore, pilot, scale, operate, retire), with entry and exit criteria checked at each gate.
With: Business owner, Delivery lead, Risk lead.
Evidence an assessor would expect
- Design decision record for each use, updated at each gate
- The documented stage-gate model with entry and exit criteria
- Gate decision records for a sample of uses
Safe to raise concerns
Anyone can raise a concern or report a problem with AI without fear of blame, and can see what was done about it.
With: People lead, Risk lead.
Evidence an assessor would expect
- Guidance describing the route for raising AI concerns
- A log of concerns raised, with responses and outcomes
- Staff survey results on confidence in speaking up
Learning from what did not work
Experiments and uses of AI that fail or are stopped are reviewed without blame, and the lessons are recorded and shared.
With: Delivery lead, Business owner.
Evidence an assessor would expect
- Review records for stopped or failed AI work
- A lessons log or library, with evidence it is used in new proposals
AI incidents and near misses
AI incidents and near misses that are not security incidents, such as wrong outputs, harm to people or misuse, are reported, investigated and learned from.
With: Business owner, Delivery lead, Risk lead.
Evidence an assessor would expect
- The AI incident process and definition
- The incident and near miss log, with investigations and actions
- Examples of how affected people were told about lesser incidents
Re-assessing AI maturity
The organisation re-runs this framework's assessment on a set cycle, compares results with earlier ones, and acts on the gaps it finds.
With: Executive sponsor, Risk lead.
Evidence an assessor would expect
- Completed assessments from at least two rounds
- The improvement plan with owners and progress
Contributes to
Another role is accountable; this one does part of the work or supplies what it needs.
AI ambition aligned to organisational strategy
The organisation has a stated ambition for AI that is derived from its own strategy and objectives, and that leaders and staff can describe.
Accountable: Executive sponsor.
Where AI will and will not be used
The organisation has decided, and recorded with reasons, the areas of its work where AI is encouraged, where it is allowed only under conditions, and where it is ruled out.
Accountable: Executive sponsor.
Investment and funding for AI
The organisation has a defined approach to funding AI, covering what is paid for centrally and locally, how long commitments last, and how requests for money are judged.
Accountable: Executive sponsor.
Organisation-level value case
The organisation has stated the value it expects from AI across its work, by type of value, with the assumptions behind each estimate written down.
Accountable: Executive sponsor.
Multi-year AI roadmap tied to planning
The organisation has a phased AI roadmap that is linked to its business and financial planning cycles and shows the points where it will decide whether to proceed.
Accountable: Executive sponsor.
Stakeholder input to strategy
Staff, their representatives, service users, partners and, where relevant, the public and regulators have a real opportunity to shape the AI strategy, and the organisation can show what changed as a result.
Accountable: Executive sponsor.
Strategy review cycle
The AI strategy is reviewed on a set cycle and whenever defined triggers occur, and each change is recorded with its reason.
Accountable: Executive sponsor.
AI policy
The organisation has an approved AI policy that states which uses of AI are permitted, which need approval and which are not allowed, and keeps it current.
Accountable: Executive sponsor.
Executive accountability
A named senior executive is accountable for the organisation's use of AI, with a defined remit, and reports on it to the board or equivalent.
Accountable: Executive sponsor.
Decision rights proportionate to risk
Decision rights for approving, changing and retiring uses of AI are defined, scaled to risk, and followed.
Accountable: Executive sponsor.
Public transparency about AI use
The organisation publishes information about how and why it uses AI, to the extent its obligations and public role require, and keeps it current.
Accountable: Executive sponsor.
AI risk appetite
The board or equivalent has approved a statement of how much AI risk the organisation will accept, broken down by kind of risk, and it is used in decisions.
Accountable: Executive sponsor.
AI risk assessment method
The organisation uses one consistent, documented method to assess the risks of each use of AI, and the results feed its corporate risk management.
Accountable: Risk lead.
Impact assessment before deployment
Before a use of AI goes live, its likely effects on people and groups (including equality, privacy, rights and safety) and on society and the environment are assessed to a depth that matches its risk, and the findings are acted on.
Accountable: Business owner.
Legal and regulatory obligations
The organisation keeps a current view of the laws, regulations and standards that apply to its use of AI, with an owner for each obligation and a way of checking it is met.
Accountable: Risk lead.
Explanation and challenge for affected people
People affected by decisions that AI supports can find out that AI was involved, get an explanation they can understand, and challenge the outcome through a route that can change it.
Accountable: Business owner.
Proportionate business case
Each use of AI has a business case scaled to its size and risk that states expected benefits, full costs and assumptions, and is approved before significant commitment.
Accountable: Business owner.
Safe experimentation
Staff can try AI quickly within defined guardrails covering approved environments, data limits, time limits and exit criteria.
Accountable: Delivery lead.
Pilot to production decisions
Every pilot ends in a recorded decision to scale, extend or stop, made against criteria and evidence agreed before the pilot started.
Accountable: Business owner.
Reuse across the organisation
Successful patterns, components and lessons from uses of AI are recorded so others can find them, and are reused before anything new is built.
Accountable: Delivery lead.
Retiring uses of AI
Uses of AI that no longer earn their place are withdrawn through a planned process that covers users, dependent processes and disposal or retention of models and data.
Accountable: Business owner.
Target operating model for AI
The organisation has a defined, approved operating model that states who builds, buys, runs and supports AI, and what is done centrally and what locally.
Accountable: Executive sponsor.
Build, buy or configure approach
A consistent, documented method decides for each use of AI whether to configure tools already owned, procure, build, or wait, and the reasons are recorded.
Accountable: Delivery lead.
Collaboration and sharing
The organisation works with peer organisations and partners to share AI solutions, lessons and capacity where this serves its aims.
Accountable: Executive sponsor.
Data strategy supports AI
The organisation's data strategy states what its planned uses of AI need from data and sets out how those needs will be met.
Accountable: Data owner.
Data ownership and stewardship
Every data set used by AI has a named accountable owner and day-to-day stewards who understand the data and look after it.
Accountable: Data owner.
Finding and understanding data
Data available for AI is catalogued and described well enough that people can find it, understand what it means and its limits, and use it correctly.
Accountable: Data owner.
Lawful and fair use of data
Before data is used in an AI system, its use is confirmed as lawful, consistent with the purpose for which it was collected, and fair to the people it describes.
Accountable: Data owner.
Records management for AI
Retention and records rules cover what AI systems take in and produce, including prompts, outputs and the decisions they supported, and are applied in practice.
Accountable: Data owner.
Approved AI tools and platforms
The organisation keeps a current list of approved AI tools and platforms, each with clear conditions of use, and staff know where to find it.
Accountable: Delivery lead.
Unapproved AI tools
Use of unapproved AI tools is detected, and people using them are steered to an approved alternative or a route to get their need met.
Accountable: Delivery lead.
AI security baseline
The organisation has adopted a recognised AI security baseline, built it into its security standards, and applies it to every use of AI.
Accountable: Security lead.
Preventing information leakage through AI
Sensitive information is protected from exposure through AI tools, prompts, training and outputs, with rules staff understand and technical measures that enforce them.
Accountable: Security lead.
AI literacy for all staff
Everyone in the organisation has a baseline understanding of what AI is, what it can and cannot do, and how to use it safely under the organisation's policy.
Accountable: People lead.
Support for staff using AI
People using AI day to day can get practical help, current guidance and answers to their questions quickly from a known place.
Accountable: People lead.
Internal communication about AI
Staff receive clear, honest and regular communication about what AI is being used for, why, and what it means for them.
Accountable: Executive sponsor.
Champions and communities
Networks of champions and communities of practice, with time and support to do so, spread know-how about AI and good practice across the organisation.
Accountable: People lead.
Public and customer trust
The organisation understands how the people it serves view its use of AI and takes that into account in its decisions and how it explains itself.
Accountable: Executive sponsor.
Benefits tracking
Whether the expected benefits of AI arrive is tracked and reported, for each use and across the portfolio, and shortfalls are acted on.
Accountable: Business owner.
Independent assurance reviews
Uses of AI are reviewed by people independent of their delivery, with the depth and frequency of review proportionate to risk.
Accountable: Risk lead.
Reporting to leadership
Leadership and the board receive consolidated, evidence-based reporting on AI use, performance, benefits, incidents and risk, on a set cycle.
Accountable: Executive sponsor.
Serious AI incidents and external notification
The organisation defines serious AI incidents, can suspend a use of AI when needed, and tells suppliers, regulators and affected people through set routes and within set deadlines.
Accountable: Risk lead.