AACF
Roles

Data owner

Accountable for the data an AI use depends on.

Often held by
a chief data officer, head of data or the information asset owner for the data concerned
Accountable for
8 controls
Contributes to
21 controls
Relies on
Delivery lead (6), AI governance lead (5), Business owner (3), Risk lead (3), Executive sponsor (1), Security lead (1)
Supports
Delivery lead (9), Business owner (5), AI governance lead (3), Risk lead (2), Security lead (2)

Accountable for

This role answers for each of these controls reaching the level the organisation has set, and holds the evidence.

Data & Information

  • DAT-01

    Data strategy supports AI

    The organisation's data strategy states what its planned uses of AI need from data and sets out how those needs will be met.

    With: Executive sponsor, AI governance lead, Delivery lead.

    Evidence an assessor would expect
    • The approved data strategy, with the sections covering AI needs
    • A data action plan or roadmap linked to the AI roadmap, with owners and progress
    • The approved data architecture
  • DAT-02

    Data ownership and stewardship

    Every data set used by AI has a named accountable owner and day-to-day stewards who understand the data and look after it.

    With: AI governance lead, Business owner.

    Evidence an assessor would expect
    • A register of data owners and stewards covering data used by AI
    • Role descriptions or terms of reference setting out owner and steward responsibilities
    • Examples of owners approving or declining a use of their data
  • DAT-03

    Data quality fit for purpose

    The quality of data used by each AI system is assessed against what that use needs, and shortfalls are fixed or their effects managed before and during live use.

    With: Delivery lead, Business owner.

    Evidence an assessor would expect
    • Data quality requirements for a sample of uses of AI
    • Data quality assessment results and the remediation actions that followed
  • DAT-04

    Finding and understanding data

    Data available for AI is catalogued and described well enough that people can find it, understand what it means and its limits, and use it correctly.

    With: Delivery lead, AI governance lead.

    Evidence an assessor would expect
    • The data catalogue, with sample entries for data used by AI
    • The process for adding and updating catalogue entries
  • DAT-05

    Lawful and fair use of data

    Before data is used in an AI system, its use is confirmed as lawful, consistent with the purpose for which it was collected, and fair to the people it describes.

    With: Risk lead, Business owner, AI governance lead.

    Evidence an assessor would expect
    • Recorded decision on privacy enhancing techniques for each training or tuning data set that holds personal data
    • Records of lawful basis, purpose compatibility and fairness for a sample of uses of AI
    • Data protection advice or sign-off on those uses
    • Notices telling people how their data and inputs are used, accessed and stored
  • DAT-06

    Records management for AI

    Retention and records rules cover what AI systems take in and produce, including prompts, outputs and the decisions they supported, and are applied in practice.

    With: Risk lead, Delivery lead, AI governance lead.

    Evidence an assessor would expect
    • Retention schedule or records policy entries covering AI inputs, outputs and decisions
    • Configuration records showing retention settings in AI tools
    • Results of a retrieval or deletion check
    • Retention settings for AI system logs
  • DAT-07

    Controlled access and sharing

    AI systems and their users can reach only the data they need for the agreed purpose, and data is shared into and out of AI systems only under agreed rules.

    With: Security lead, Delivery lead.

    Evidence an assessor would expect
    • Access approvals and the latest access review for a sample of AI systems
    • Data sharing agreements covering AI use
  • DAT-08

    Provenance of training and test data

    For data used to train, tune or test AI, the organisation knows and records where it came from, what rights it holds over it, and any limits on its use.

    With: Delivery lead, Risk lead.

    Evidence an assessor would expect
    • Provenance records for training and test data sets
    • Licence or rights documentation for externally sourced data
    • Links between data sets and the models or versions that used them
    • Preparation, labelling and synthetic data records

Contributes to

Another role is accountable; this one does part of the work or supplies what it needs.

Governance & Accountability

Risk, Ethics & Compliance

  • RSK-03

    Impact assessment before deployment

    Before a use of AI goes live, its likely effects on people and groups (including equality, privacy, rights and safety) and on society and the environment are assessed to a depth that matches its risk, and the findings are acted on.

    Accountable: Business owner.

  • RSK-04

    Legal and regulatory obligations

    The organisation keeps a current view of the laws, regulations and standards that apply to its use of AI, with an owner for each obligation and a way of checking it is met.

    Accountable: Risk lead.

  • RSK-06

    Fairness and bias management

    Unfair bias is identified, tested for and reduced at each stage of a use of AI, from design through to live operation.

    Accountable: Business owner.

  • RSK-08

    Explanation and challenge for affected people

    People affected by decisions that AI supports can find out that AI was involved, get an explanation they can understand, and challenge the outcome through a route that can change it.

    Accountable: Business owner.

  • RSK-09

    Risk of AI from suppliers

    Before AI in a bought product or service is used, and when it changes, the organisation assesses what it does, how it uses data, how the supplier changes the model, and what assurance the supplier offers.

    Accountable: Risk lead.

Portfolio & Use Cases

  • POR-06

    Safe experimentation

    Staff can try AI quickly within defined guardrails covering approved environments, data limits, time limits and exit criteria.

    Accountable: Delivery lead.

  • POR-09

    Retiring uses of AI

    Uses of AI that no longer earn their place are withdrawn through a planned process that covers users, dependent processes and disposal or retention of models and data.

    Accountable: Business owner.

Operating Model & Delivery

Technology & Platforms

AI Security

Measure & Improve