Business owner
Owns the business outcome a given AI use serves.
- Often held by
- the head of the service, product or function that the AI use supports
- Accountable for
- 12 controls
- Contributes to
- 46 controls
- Relies on
- Delivery lead (9), AI governance lead (6), Risk lead (5), Data owner (5), People lead (2), Executive sponsor (1)
- Supports
- Delivery lead (12), Executive sponsor (11), AI governance lead (10), People lead (5), Risk lead (3), Data owner (3), Security lead (2)
Accountable for
This role answers for each of these controls reaching the level the organisation has set, and holds the evidence.
Impact assessment before deployment
Before a use of AI goes live, its likely effects on people and groups (including equality, privacy, rights and safety) and on society and the environment are assessed to a depth that matches its risk, and the findings are acted on.
With: Risk lead, Data owner, AI governance lead.
Evidence an assessor would expect
- The impact assessment template and guidance on proportionality
- Completed and signed-off assessments for recent deployments
- Records of mitigations and their completion
- Impact assessment reviews during live use
Fairness and bias management
Unfair bias is identified, tested for and reduced at each stage of a use of AI, from design through to live operation.
With: Data owner, Delivery lead, Risk lead.
Evidence an assessor would expect
- The documented approach to fairness and bias
- Bias test results and mitigation records for recent uses
- Live fairness monitoring reports
Human oversight proportionate to risk
Each use of AI has human oversight designed to match its risk, stating who reviews, at which point, and with what authority to override or stop it.
With: Delivery lead, Risk lead, People lead.
Evidence an assessor would expect
- List of agent actions that need a person's approval, with approval records
- Documented oversight models for in-scope uses of AI
- Training records for people in oversight roles
- Override and review data from live uses
Explanation and challenge for affected people
People affected by decisions that AI supports can find out that AI was involved, get an explanation they can understand, and challenge the outcome through a route that can change it.
With: Risk lead, Data owner, AI governance lead.
Evidence an assessor would expect
- Notices or communications telling people AI is involved
- The documented explanation and challenge route
- A log of challenges and their outcomes
- Notices shown to people at first contact with AI services
Proportionate business case
Each use of AI has a business case scaled to its size and risk that states expected benefits, full costs and assumptions, and is approved before significant commitment.
With: Delivery lead, AI governance lead.
Evidence an assessor would expect
- The business case template and guidance on proportionality
- Approved business cases for a sample of uses of different sizes
Pilot to production decisions
Every pilot ends in a recorded decision to scale, extend or stop, made against criteria and evidence agreed before the pilot started.
With: Delivery lead, AI governance lead.
Evidence an assessor would expect
- Pilot plans showing success and stop criteria
- Recorded scale, extend or stop decisions with supporting evidence
Retiring uses of AI
Uses of AI that no longer earn their place are withdrawn through a planned process that covers users, dependent processes and disposal or retention of models and data.
With: Delivery lead, Data owner, AI governance lead.
Evidence an assessor would expect
- Withdrawal impact assessment and notice to users and affected people for each retired use
- The retirement process and its triggers
- Records of a completed retirement, including data and model disposal
- AI inventory entries marked as retired
Involving people in AI design and evaluation
Evaluations and research that involve people have their informed consent, ethics review and protection, use participants who represent those the service will serve, and for significant uses draw on the communities affected.
With: Delivery lead, Risk lead.
Evidence an assessor would expect
- Consent and ethics review records for evaluations involving people
- Participant recruitment records showing how representation was sought
- Engagement records for significant uses, with the input received and the organisation's response
- Research plans showing the risk assessment for researchers
Adoption support for affected teams
Teams whose work changes because of AI get practical support through the change, and actual adoption is tracked against what was planned.
With: People lead, Delivery lead.
Evidence an assessor would expect
- Support plans for teams affected by recent rollouts
- Adoption tracking data compared with planned levels
Performance measures and baselines
Each use of AI has agreed performance measures and a recorded baseline of current performance before it goes live.
With: Delivery lead, Data owner.
Evidence an assessor would expect
- Measure definitions and baseline data for a sample of uses of AI
- Stage gate records showing measures were checked
- Recorded risks that cannot yet be measured, with their proxy indicators
- Reliance measures compared with accuracy for live uses
Benefits tracking
Whether the expected benefits of AI arrive is tracked and reported, for each use and across the portfolio, and shortfalls are acted on.
With: Executive sponsor, AI governance lead.
Evidence an assessor would expect
- Benefits tracking records for a sample of uses of AI
- Portfolio benefits report comparing forecast and actual results
User feedback
Feedback from people who use AI and people affected by it is gathered on a regular basis, analysed, and acted on.
With: Delivery lead.
Evidence an assessor would expect
- Feedback channels and a sample of feedback received
- Records of feedback reviews and resulting changes
Contributes to
Another role is accountable; this one does part of the work or supplies what it needs.
AI ambition aligned to organisational strategy
The organisation has a stated ambition for AI that is derived from its own strategy and objectives, and that leaders and staff can describe.
Accountable: Executive sponsor.
Where AI will and will not be used
The organisation has decided, and recorded with reasons, the areas of its work where AI is encouraged, where it is allowed only under conditions, and where it is ruled out.
Accountable: Executive sponsor.
Investment and funding for AI
The organisation has a defined approach to funding AI, covering what is paid for centrally and locally, how long commitments last, and how requests for money are judged.
Accountable: Executive sponsor.
Organisation-level value case
The organisation has stated the value it expects from AI across its work, by type of value, with the assumptions behind each estimate written down.
Accountable: Executive sponsor.
Multi-year AI roadmap tied to planning
The organisation has a phased AI roadmap that is linked to its business and financial planning cycles and shows the points where it will decide whether to proceed.
Accountable: Executive sponsor.
Stakeholder input to strategy
Staff, their representatives, service users, partners and, where relevant, the public and regulators have a real opportunity to shape the AI strategy, and the organisation can show what changed as a result.
Accountable: Executive sponsor.
Decision rights proportionate to risk
Decision rights for approving, changing and retiring uses of AI are defined, scaled to risk, and followed.
Accountable: Executive sponsor.
Named owners for each use of AI
Every use of AI has named owners for the business outcome, the data, the technology and its assurance, recorded where others can find them.
Accountable: AI governance lead.
AI inventory
The organisation keeps a current inventory of the AI it uses, including AI built into bought products and services, with enough detail to govern it.
Accountable: AI governance lead.
Public transparency about AI use
The organisation publishes information about how and why it uses AI, to the extent its obligations and public role require, and keeps it current.
Accountable: Executive sponsor.
Review and disclosure of AI-generated content
The organisation has approved rules for reviewing and disclosing AI-generated content that it releases or relies on, so people know when AI was used.
Accountable: AI governance lead.
AI risk assessment method
The organisation uses one consistent, documented method to assess the risks of each use of AI, and the results feed its corporate risk management.
Accountable: Risk lead.
Ethical principles in practice
The organisation has adopted ethical principles for AI and applies them through a working review route that can change or stop a use of AI.
Accountable: AI governance lead.
Idea intake open to all staff
Anyone in the organisation can propose a use of AI through a simple, well-known route, and every proposal is acknowledged and considered.
Accountable: AI governance lead.
Agreed prioritisation criteria
Proposed uses of AI are ranked against published criteria covering value, feasibility, risk, cost and strategic fit, applied the same way to every proposal.
Accountable: AI governance lead.
Pipeline register of proposed uses
A single register records every proposed and in-flight use of AI with its status, owner and decision history, and hands each entry to the AI inventory when it goes live.
Accountable: AI governance lead.
Stage gates from idea to retirement
Each use of AI passes through defined stages (explore, pilot, scale, operate, retire), with entry and exit criteria checked at each gate.
Accountable: AI governance lead.
Reuse across the organisation
Successful patterns, components and lessons from uses of AI are recorded so others can find them, and are reused before anything new is built.
Accountable: Delivery lead.
Build, buy or configure approach
A consistent, documented method decides for each use of AI whether to configure tools already owned, procure, build, or wait, and the reasons are recorded.
Accountable: Delivery lead.
Running cost management
The ongoing cost of each AI service, including usage-based charges, is known, forecast, assigned to an owner and kept within agreed limits.
Accountable: Delivery lead.
Supplier performance and exit
AI suppliers are managed against agreed performance measures, and each critical AI service has a tested route to exit or replace the supplier.
Accountable: Delivery lead.
Delivery standards for AI
AI work is delivered by multidisciplinary teams using user-centred methods to defined delivery standards.
Accountable: Delivery lead.
Service management for live AI
Every live AI service has defined support, change and problem management arrangements, including handling of changes to models and prompts.
Accountable: Delivery lead.
Continuity when AI fails
Services that depend on AI can continue safely when the AI is unavailable, degraded or producing wrong results, through planned fallbacks that have been tested.
Accountable: Delivery lead.
Data ownership and stewardship
Every data set used by AI has a named accountable owner and day-to-day stewards who understand the data and look after it.
Accountable: Data owner.
Data quality fit for purpose
The quality of data used by each AI system is assessed against what that use needs, and shortfalls are fixed or their effects managed before and during live use.
Accountable: Data owner.
Lawful and fair use of data
Before data is used in an AI system, its use is confirmed as lawful, consistent with the purpose for which it was collected, and fair to the people it describes.
Accountable: Data owner.
Integration with existing systems
AI is connected to core systems through supported, documented interfaces that the organisation can maintain, change and switch off.
Accountable: Delivery lead.
Managing models in live use
Models, prompts and their configuration are versioned and released under control, so the organisation knows what is running and can roll back to a known good version.
Accountable: Delivery lead.
Testing and evaluation before release
Before release, each AI system is tested for accuracy, robustness and behaviour against acceptance criteria agreed in advance, and released only if it meets them.
Accountable: Delivery lead.
Technology change and refresh
The organisation plans for changes to models, suppliers and platforms, including suppliers withdrawing models, so that AI services continue without disruption.
Accountable: Delivery lead.
AI threat modelling
Each use of AI has its AI-specific threats assessed before it goes live and again when it changes, and the results shape its design and controls.
Accountable: Security lead.
AI in security incident response
Security incident management covers incidents involving AI, with playbooks, people who have the skills to handle them, and the ability to contain an affected AI service quickly.
Accountable: Security lead.
Skills assessment
The organisation knows which AI skills it has and which it needs, by role and group, and uses this to plan learning, recruitment and workforce decisions.
Accountable: People lead.
Role-based learning
People can get learning matched to what their role needs to do with AI, beyond the baseline for all staff, and use it in their work.
Accountable: People lead.
Workforce planning for AI
The expected effect of AI on roles, numbers and skills is planned for openly, with affected staff and their representatives informed and involved, and decisions made fairly.
Accountable: People lead.
Planned approach to AI change
AI adoption is managed as organisational change, with a change plan, named sponsors and the resources to carry it out.
Accountable: Executive sponsor.
Staff and representative engagement
Staff and their representatives, including trade unions where present, are involved early in decisions about AI that affect their work, and their input is considered and answered.
Accountable: People lead.
Learning from what did not work
Experiments and uses of AI that fail or are stopped are reviewed without blame, and the lessons are recorded and shared.
Accountable: AI governance lead.
Champions and communities
Networks of champions and communities of practice, with time and support to do so, spread know-how about AI and good practice across the organisation.
Accountable: People lead.
Public and customer trust
The organisation understands how the people it serves view its use of AI and takes that into account in its decisions and how it explains itself.
Accountable: Executive sponsor.
Monitoring live AI
Live AI is monitored against its measures for accuracy, drift, misuse and unexpected behaviour, with thresholds that trigger action.
Accountable: Delivery lead.
AI incidents and near misses
AI incidents and near misses that are not security incidents, such as wrong outputs, harm to people or misuse, are reported, investigated and learned from.
Accountable: AI governance lead.
Independent assurance reviews
Uses of AI are reviewed by people independent of their delivery, with the depth and frequency of review proportionate to risk.
Accountable: Risk lead.
Reporting to leadership
Leadership and the board receive consolidated, evidence-based reporting on AI use, performance, benefits, incidents and risk, on a set cycle.
Accountable: Executive sponsor.
Serious AI incidents and external notification
The organisation defines serious AI incidents, can suspend a use of AI when needed, and tells suppliers, regulators and affected people through set routes and within set deadlines.
Accountable: Risk lead.