Executive sponsor
Senior executive accountable for AI across the organisation.
- Often held by
- the chief executive, chief operating officer or another member of the executive committee
- Accountable for
- 18 controls
- Contributes to
- 11 controls
- Relies on
- AI governance lead (17), Business owner (11), Risk lead (5), Delivery lead (5), People lead (4), Security lead (1)
- Supports
- People lead (4), AI governance lead (3), Delivery lead (2), Data owner (1), Business owner (1)
Accountable for
This role answers for each of these controls reaching the level the organisation has set, and holds the evidence.
AI ambition aligned to organisational strategy
The organisation has a stated ambition for AI that is derived from its own strategy and objectives, and that leaders and staff can describe.
With: AI governance lead, Business owner.
Evidence an assessor would expect
- The approved AI ambition or strategy, showing links to organisational objectives
- Approval record from the board or executive committee
- Decision papers that refer to the ambition
Where AI will and will not be used
The organisation has decided, and recorded with reasons, the areas of its work where AI is encouraged, where it is allowed only under conditions, and where it is ruled out.
With: AI governance lead, Risk lead, Business owner.
Evidence an assessor would expect
- The approved statement of strategic boundaries, with reasons
- Cross-references between the boundaries, the risk appetite and the AI policy
Investment and funding for AI
The organisation has a defined approach to funding AI, covering what is paid for centrally and locally, how long commitments last, and how requests for money are judged.
With: AI governance lead, Business owner, Delivery lead.
Evidence an assessor would expect
- The documented funding approach or investment framework for AI
- Budget papers showing AI allocations, including any multi-year commitments
- Records of recent funding decisions against the stated criteria
Organisation-level value case
The organisation has stated the value it expects from AI across its work, by type of value, with the assumptions behind each estimate written down.
With: Business owner, AI governance lead.
Evidence an assessor would expect
- The organisation-level value case, with assumptions recorded
- Strategy or funding papers that draw on it
- A comparison of the value case with tracked benefits
Multi-year AI roadmap tied to planning
The organisation has a phased AI roadmap that is linked to its business and financial planning cycles and shows the points where it will decide whether to proceed.
With: AI governance lead, Delivery lead, Business owner.
Evidence an assessor would expect
- The approved roadmap, with phases and decision points
- Business or financial planning documents that reference it
- Records of decisions taken at roadmap decision points
- Roadmap entries for enabling capability, data and compute capacity, with dependencies
Stakeholder input to strategy
Staff, their representatives, service users, partners and, where relevant, the public and regulators have a real opportunity to shape the AI strategy, and the organisation can show what changed as a result.
With: AI governance lead, People lead, Business owner.
Evidence an assessor would expect
- The stakeholder engagement plan for the strategy
- A record of input received and how the strategy responded
Strategy review cycle
The AI strategy is reviewed on a set cycle and whenever defined triggers occur, and each change is recorded with its reason.
With: AI governance lead.
Evidence an assessor would expect
- Strategy version history or change log, with reasons
- Papers and minutes from the most recent review
AI policy
The organisation has an approved AI policy that states which uses of AI are permitted, which need approval and which are not allowed, and keeps it current.
With: AI governance lead, Risk lead, Security lead.
Evidence an assessor would expect
- The approved policy, with owner, approval record and review date
- Communication or training records showing staff were told about it
- Change history showing reviews have happened
- A stated scope for AI governance, and version control and retention for governance documents
- Practices banned by law included in the prohibited list
Executive accountability
A named senior executive is accountable for the organisation's use of AI, with a defined remit, and reports on it to the board or equivalent.
With: AI governance lead.
Evidence an assessor would expect
- Terms of reference, role description or scheme of delegation naming the accountable executive
- Board or executive committee papers and minutes covering AI
Decision rights proportionate to risk
Decision rights for approving, changing and retiring uses of AI are defined, scaled to risk, and followed.
With: AI governance lead, Risk lead, Business owner.
Evidence an assessor would expect
- Documented decision rights or approval matrix by risk tier
- A sample of approval records for recent uses of AI
Public transparency about AI use
The organisation publishes information about how and why it uses AI, to the extent its obligations and public role require, and keeps it current.
With: AI governance lead, Business owner.
Evidence an assessor would expect
- Published transparency records or statements
- Reconciliation of published records against the inventory
- Registration records where the law requires them
- Publication decisions with reasons, update records, and pre-release checks showing reasons for anything withheld
AI risk appetite
The board or equivalent has approved a statement of how much AI risk the organisation will accept, broken down by kind of risk, and it is used in decisions.
With: Risk lead, AI governance lead.
Evidence an assessor would expect
- The approved AI risk appetite statement, with approval record and review date
- Approval records for uses of AI that refer to the appetite
- Risk reports comparing exposure with the appetite
Target operating model for AI
The organisation has a defined, approved operating model that states who builds, buys, runs and supports AI, and what is done centrally and what locally.
With: Delivery lead, AI governance lead, People lead.
Evidence an assessor would expect
- The approved operating model document, with owner and review date
- Team remits or service catalogue entries that reflect the model
Collaboration and sharing
The organisation works with peer organisations and partners to share AI solutions, lessons and capacity where this serves its aims.
With: Delivery lead, AI governance lead.
Evidence an assessor would expect
- Membership or partnership records and agreements
- Examples of solutions or lessons shared or reused
- Partnership agreements stating principles, data and intellectual property terms
Planned approach to AI change
AI adoption is managed as organisational change, with a change plan, named sponsors and the resources to carry it out.
With: People lead, Business owner, Delivery lead.
Evidence an assessor would expect
- The AI change plan, with sponsors, resources and timescales
- Change plans or impact assessments for recent uses of AI
Internal communication about AI
Staff receive clear, honest and regular communication about what AI is being used for, why, and what it means for them.
With: People lead, AI governance lead.
Evidence an assessor would expect
- The communication plan and a sample of recent messages
- Staff survey or pulse results on understanding of AI use
Public and customer trust
The organisation understands how the people it serves view its use of AI and takes that into account in its decisions and how it explains itself.
With: Business owner, AI governance lead.
Evidence an assessor would expect
- Research, surveys or panel findings on public or customer views of AI use
- Decision records showing those views were considered
Reporting to leadership
Leadership and the board receive consolidated, evidence-based reporting on AI use, performance, benefits, incidents and risk, on a set cycle.
With: AI governance lead, Risk lead, Business owner.
Evidence an assessor would expect
- Recent leadership or board reports on AI
- Minutes recording discussion and actions arising
- Signed assurance statements with their evidence, where required
Contributes to
Another role is accountable; this one does part of the work or supplies what it needs.
Oversight forum
A cross-functional forum oversees AI use, risk and performance, with terms of reference, the right membership and a clear link to the organisation's main governance.
Accountable: AI governance lead.
Agreed prioritisation criteria
Proposed uses of AI are ranked against published criteria covering value, feasibility, risk, cost and strategic fit, applied the same way to every proposal.
Accountable: AI governance lead.
Running cost management
The ongoing cost of each AI service, including usage-based charges, is known, forecast, assigned to an owner and kept within agreed limits.
Accountable: Delivery lead.
Data strategy supports AI
The organisation's data strategy states what its planned uses of AI need from data and sets out how those needs will be met.
Accountable: Data owner.
Technology change and refresh
The organisation plans for changes to models, suppliers and platforms, including suppliers withdrawing models, so that AI services continue without disruption.
Accountable: Delivery lead.
Leadership capability
Leaders understand AI well enough to set direction for it, question proposals and risks, and make informed decisions about its use.
Accountable: People lead.
Workforce planning for AI
The expected effect of AI on roles, numbers and skills is planned for openly, with affected staff and their representatives informed and involved, and decisions made fairly.
Accountable: People lead.
Bringing in and keeping expertise
The organisation recruits and keeps the AI expertise it needs and uses external experts in a way that transfers knowledge, so that capability stays when contracts end.
Accountable: People lead.
Staff and representative engagement
Staff and their representatives, including trade unions where present, are involved early in decisions about AI that affect their work, and their input is considered and answered.
Accountable: People lead.
Benefits tracking
Whether the expected benefits of AI arrive is tracked and reported, for each use and across the portfolio, and shortfalls are acted on.
Accountable: Business owner.
Re-assessing AI maturity
The organisation re-runs this framework's assessment on a set cycle, compares results with earlier ones, and acts on the gaps it finds.
Accountable: AI governance lead.