Cross-reference
GDS AI Playbook
10 items: 10 met directly by a control at Level 3, 0 partly, 0 deliberately out of scope.
| Ref | Item (our description) | Controls | Note |
|---|---|---|---|
| P1 | You know what AI is and what its limitations are | PPL-01 direct, PPL-02 partial, PPL-08 partial | Asks for understanding of capability, limits and accuracy, and safe use; literacy (PPL-01) carries it. |
| P2 | You use AI lawfully, ethically and responsibly | RSK-04 direct, RSK-05 direct, DAT-05 direct, RSK-06 partial, RSK-03 partial | Early legal, compliance and data protection advice; equalities and fairness; intellectual property (IP sits partly with OPM-04). |
| P3 | You know how to use AI securely | SEC-01 direct, SEC-02 direct, SEC-04 partial | Secure by Design and the government Cyber Security Standard (SEC-01 baseline); AI-specific threats such as data poisoning and prompt injection (SEC-02). |
| P4 | You have meaningful human control at the right stages | RSK-07 direct, MON-02 partial, TEC-06 partial | Human validation of high-risk decisions and plans for intervention (RSK-07); monitoring behaviour (MON-02); testing before deployment where real-time review is impossible (TEC-06). |
| P5 | You understand how to manage the full AI life cycle | POR-04 direct, OPM-07 partial, TEC-05 partial, MON-02 partial, TEC-06 partial, POR-09 partial | Set-up, maintenance resource, updates, drift and bias monitoring, testing, and secure close-down at end of life. Spread across several controls by design. |
| P6 | You use the right tool for the job | OPM-02 direct, STR-02 partial, POR-05 partial | Includes being open to the conclusion that AI is not the right answer (OPM-02 "wait"; STR-02 where AI is not used). |
| P7 | You are open and collaborative | OPM-08 direct, POR-08 partial, CUL-06 partial, STR-07 partial, GOV-09 partial | Cross-government communities and reuse of ideas, code and infrastructure (OPM-08, POR-08, CUL-06); engaging civil society (STR-07); openness (GOV-09). |
| P8 | You work with commercial colleagues from the start | OPM-04 direct, RSK-09 partial | Early commercial advice; the same responsible-use expectations for in-house and procured AI; contract terms requiring supplier transparency. |
| P9 | You have the skills and expertise needed to implement and use AI solutions | PPL-03 direct, PPL-05 direct, PPL-02 direct, PPL-07 partial | Team skills to use, design, build and maintain (PPL-03, PPL-05); decision makers and SROs (PPL-02). |
| P10 | You use these principles alongside your organisation's policies and have the right assurance in place | GOV-07 direct, MON-05 direct, RSK-02 partial, GOV-01 partial | Follow organisation-specific policies (GOV-07), understand and mitigate risk (RSK-02), assurance (MON-05). |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.