Book a demo Start free

Product

Product overview Agents Automations Apps Code (Beta) Integrations Governed Runtime Security

Where Renly runs

Windows app Android app Inside other AI apps

Solutions

Finance Sales Operations People and HR Marketing Enterprise

Resources

Pricing Docs Academy Blog Compare Support

AI governance and capability

AI governance framework AI governance assessment AI capability maturity AI maturity assessment
Book a demo Sign in
On this pageHow to read
  1. How to read an initiative
  2. The eight playbooks
  3. Governance and assurance
  4. Use-case portfolio and value
  5. Operating model
  6. Strategy and leadership
  7. Data and knowledge
  8. Platform and security
  9. Engineering practice
  10. People and adoption
  11. The library: 80 initiatives
  12. 1. Strategy and leadership
  13. 2. Governance and operating model
  14. 3. Risk, assurance and transparency
  15. 4. Data, knowledge and semantics
  16. 5. Platform, architecture and security
  17. 6. Design and engineering practice
  18. 7. Use-case delivery and value
  19. 8. People, capability and culture

AI Capability Maturity Assessment · Part IV. From findings to roadmap

Initiative library and playbooks

43 minute read · Version 1.0.0

In this chapter

80 initiatives that close specific gaps, each with the criteria it lifts and by how much, prerequisites, effort, duration, owner and measures; and eight playbooks that group them into workstreams with moving parts, recommendations, pitfalls and a cadence.

  1. How to read an initiative
  2. The eight playbooks
  3. Governance and assurance
  4. Use-case portfolio and value
  5. Operating model
  6. Strategy and leadership
  7. Data and knowledge
  8. Platform and security
  9. Engineering practice
  10. People and adoption
  11. The library: 80 initiatives
  12. 1. Strategy and leadership
  13. 2. Governance and operating model
  14. 3. Risk, assurance and transparency
  15. 4. Data, knowledge and semantics
  16. 5. Platform, architecture and security
  17. 6. Design and engineering practice
  18. 7. Use-case delivery and value
  19. 8. People, capability and culture

How to read an initiative

The library holds 80 initiatives. Each one lifts named criteria from one level to another, so a gap in the results points straight at the work that closes it. The roadmap method selects initiatives from this library, adds their prerequisites and sequences them.

Effort S
Small: up to about 6 weeks for a small team, mostly decisions and documents. (1 points)
Effort M
Medium: 2 to 3 months of focused work, or a change touching several teams. (3 points)
Effort L
Large: 3 to 9 months, a program with dedicated resourcing or platform build. (8 points)

A quick win can be done within the first 90 days with little cost. The library is vendor-neutral; where Renly helps with each initiative is set out separately in the docs.

The eight playbooks

Initiatives are delivered through workstreams. Each playbook names its lead, its moving parts, the order to do things in, the traps, and the measures that show it is working.

WS-GOV Governance and assurance

Lead: AI lead or AI centre of excellence · Domains: 2. Governance and operating model, 3. Risk, assurance and transparency

Give every AI use a known owner, a recorded decision and assurance in proportion to its risk, so obligations are met by design and audit evidence exists before anyone asks for it.

Moving parts

Register
The single list of AI in use, including embedded vendor AI and staff tools, refreshed by discovery and fed by intake and procurement.
Governance committee
The cross-functional body with decision rights over use cases, tiers, gates, approved tools and exceptions, keeping a decision log.
Risk tiers
Written criteria that set assurance depth: light for assistive tools, full for decisions about people or autonomous action.
Lifecycle and gates
The path every use case travels from intake to retirement, with go or no-go decisions recorded at each gate.
Impact assessment
The pre-deployment assessment of effects on people, privacy, fairness, security and lawfulness, refreshed on change.
Transparency and review
The public statement, the inventory of AI-assisted decisions about people, privacy policy disclosures and the human review path.
Incident process
Definitions, severity scale, runbook with halt authority, notification map, register and monthly pattern review.
Assurance lines
Owners operate controls, oversight functions test them, internal audit assures them.

Recommendations, in order

  1. Open the register first and run the discovery sweep under an amnesty; every other governance step depends on knowing what exists.
  2. Stand up the committee with decision rights in its terms of reference from the first meeting, and log every decision, including refusals.
  3. Adopt the tier criteria before the lifecycle, so the lifecycle can scale its gates by tier instead of treating every use the same.
  4. Assess high-tier and people-affecting uses first; do not let low-risk assistive tools queue behind them.
  5. Adopt and rehearse the incident runbook early: it is cheap, and the first real incident is the worst time to write it.
  6. Inventory decisions about people before writing the transparency statement, so the statement describes uses, not tools.
  7. Move gates into change and deployment controls once they work on paper, so governance cannot be bypassed under delivery pressure.
  8. Put AI in the internal audit plan once the lifecycle has run for two quarters; audit then tests something real.

Pitfalls

  • A committee that discusses but never refuses or conditions anything
  • A register built from project lists only, missing embedded vendor AI
  • Assessments completed after go-live to justify decisions already made
  • Gates owned by the team being gated

Measures

  • Share of in-scope uses on the register with owner, tier and current assessment (target 100 percent)
  • Gate decisions recorded before go-live (target 100 percent)
  • Committee decision turnaround (median days)
  • Near misses reported per quarter (a healthy, non-zero rate)
  • Days to update the transparency statement after a material register change

Cadence: Weekly register and intake triage; monthly committee; quarterly executive review; annual statement review, runbook rehearsal and internal audit planning.

Initiatives: I-202, I-203, I-204, I-205, I-206, I-301, I-302, I-303, I-304, I-305, I-306, I-307, I-308, I-309, I-310, I-311

WS-PORT Use-case portfolio and value

Lead: AI lead or AI centre of excellence · Domains: 7. Use-case delivery and value

Turn AI demand into a prioritised portfolio of use cases that are chosen deliberately, delivered through the lifecycle, graduated or stopped on evidence, and measured for value.

Moving parts

Intake
One front door capturing value, risk, feasibility and tier for every idea.
Portfolio
The prioritised set of use cases with recorded choices to do, defer or refuse, reviewed at least quarterly.
Pilot charters
Success criteria and a decision date set before any pilot starts.
Graduation test
Value, risk, operational readiness and whole-of-life cost checked before scale.
Benefits register
Baselines, owners, measures and quarterly results, shortfalls included.
Pattern catalogue
Approved, owned, versioned patterns carrying their assurance evidence, checked before new builds.
Reference use case
One priority use case governed end to end, used to prove and improve the lifecycle.

Recommendations, in order

  1. Route every idea, including executive requests and vendor offers, through the same intake; exemptions are where unmanaged risk enters.
  2. Charter every running pilot within the first 90 days and decide the future of any pilot older than six months.
  3. Take benefit baselines before go-live; a baseline cannot be reconstructed afterwards.
  4. Choose one priority use case as the reference case and run it through every gate, capturing templates and evidence as reusable patterns.
  5. Prioritise with a consistent score of value, risk and feasibility, and record refusals with reasons.
  6. Measure benefits from operational data, not satisfaction surveys alone, and report shortfalls as plainly as successes.
  7. Make reuse the default: intake asks which catalogue pattern applies before approving a new build.

Pitfalls

  • Pilot purgatory: pilots that neither scale nor stop
  • Benefits estimated once in a business case and never measured
  • Several teams building the same assistant
  • Prioritisation by sponsor seniority

Measures

  • Pilots with charter and decision date (target 100 percent)
  • Median time from intake to decision
  • Share of funded use cases with a baseline and quarterly benefit measure
  • Share of new use cases built on catalogue patterns
  • Pilots stopped or reshaped on evidence each year (expected to be non-zero)

Cadence: Weekly intake triage; quarterly portfolio prioritisation; quarterly benefit reporting; graduation decisions on each pilot’s decision date.

Initiatives: I-701, I-702, I-703, I-704, I-705, I-706, I-707, I-708, I-709, I-710

WS-OPM Operating model

Lead: Executive sponsor or Chief AI Officer · Domains: 1. Strategy and leadership, 2. Governance and operating model, 8. People, capability and culture

Define who does what: the accountable roles, the enabling team, decision rights, the support tiers and the rhythm that keeps AI governance running without depending on a few individuals.

Moving parts

Accountable roles
Executive sponsor or Chief AI Officer, accountable owners per use case, data stewards, champions.
Enabling team
A small AI centre of excellence that runs the register and lifecycle, supports owners, maintains templates and reports the dashboard. It enables; it does not own use cases.
Decision rights
A RACI with one accountable role per decision, decision categories by significance, and an escalation path.
Forums
The executive committee (direction), the AI governance committee (decisions), working groups (delivery).
Support tiers
Self-service guidance, champions, the enabling team, specialist functions, external partners.
Rhythm
A standing calendar of reviews from weekly triage to annual re-assessment.

Recommendations, in order

  1. Give the Chief AI Officer or executive sponsor written authority, including to pause AI use, before standing up the committee they chair.
  2. Fund the enabling team before the committee’s first meeting; without it the committee has no secretariat and owners have no support.
  3. Name one accountable owner per use case at business-executive level, brief them, and have them present their own gate submissions.
  4. Write the RACI and decision categories in the first month, then delegate standard decisions so the committee sees only what needs it.
  5. Stand up champions in every major area with time allocated, recruited from survey volunteers.
  6. Encode decision rights in tooling (approval routing, autonomy settings) once they are stable, so the right person is asked automatically.

Pitfalls

  • The enabling team owns use cases by default because owners were never engaged
  • Two roles both believe they are accountable for the same decision
  • Champions named but given no time
  • Over-engineering: a model too heavy to run

Measures

  • Use cases with an acknowledged owner (target 100 percent)
  • Escalations resolved within the target time
  • Support requests resolved at the first or second tier
  • Champion coverage of business areas (target 100 percent)

Cadence: Monthly committee; quarterly executive review and champion network review; annual review of roles, RACI and the operating model itself.

Initiatives: I-201, I-207, I-208, I-209, I-210

WS-STRAT Strategy and leadership

Lead: Executive sponsor or Chief AI Officer · Domains: 1. Strategy and leadership

Set the direction, appetite and investment discipline for AI, and give leaders an evidence rhythm that lets them govern rather than react.

Moving parts

Strategy
Purpose, ambition, priority areas and boundaries, endorsed and communicated.
Risk appetite
Tolerance by dimension, tier definitions and decision-makers per tier.
Executive authority
A sponsor and AI lead with written authority, budget and the right to say no.
Investment discipline
A gated portfolio with whole-of-life costs.
Evidence rhythm
A quarterly dashboard generated from systems of record, and board reporting.

Recommendations, in order

  1. Keep the strategy short and decisive: purpose, ambition, a few priorities and explicit boundaries.
  2. Agree the risk appetite and tiers alongside the strategy, not after it.
  3. Start the quarterly executive review with a simple dashboard now and automate its sources later.
  4. Release AI funding in tranches at gates and record the evidence for each release.
  5. Refresh strategy and appetite yearly from operating evidence and the maturity re-assessment.

Pitfalls

  • A technology roadmap presented as a strategy
  • Comfortable dashboard numbers accepted without question
  • Funding licences ahead of use cases

Measures

  • Strategy endorsed and communicated
  • Funded initiatives mapped to priorities (target 100 percent)
  • Executive decisions minuted from dashboard evidence each quarter

Cadence: Quarterly executive review; twice-yearly board reporting; annual strategy and appetite refresh.

Initiatives: I-101, I-102, I-103, I-104, I-105, I-106, I-107, I-108, I-109

WS-DATA Data and knowledge

Lead: Chief Data Officer or data owner · Domains: 4. Data, knowledge and semantics

Make the data and knowledge AI depends on fit for purpose, correctly handled and recorded, so AI outputs can be trusted, explained and kept.

Moving parts

Data quality
Owners, thresholds, baselines and monitoring for priority domains.
Vocabulary and knowledge
Glossaries and curated, owned, current knowledge sources.
Handling ceilings
Sensitivity ceilings per tool, enforced technically.
Decision records
Minimum fields for every in-scope AI decision, tamper-evident and used.
Records and retention
AI content mapped to retention classes, legal holds tested.

Recommendations, in order

  1. Set and publish tool ceilings in the first 90 days; it is the cheapest data protection available.
  2. Curate the knowledge sources assistants use before widening access to them.
  3. Define the decision-record standard from the inventory of decisions about people, and apply it to those systems first.
  4. Map AI content to retention rules before chat histories accumulate under vendor defaults.

Pitfalls

  • Assistants indexed on every document store
  • Logs that rotate before anyone needs them
  • Training as the only control on sensitive information

Measures

  • Priority domains with a quality baseline
  • In-scope decisions with complete records
  • AI tools with a configured retention setting matching policy

Cadence: Monthly data quality review for production AI; quarterly ceiling and retention review; annual vocabulary review.

Initiatives: I-401, I-402, I-403, I-404, I-405, I-406, I-407, I-408, I-409, I-410

WS-PLAT Platform and security

Lead: CIO or CTO · Domains: 5. Platform, architecture and security

Provide an assessed, observable and secure place for AI to run, a list of approved tools good enough that staff prefer them, and the ability to stop and reverse any AI system.

Moving parts

Reference architecture
An assessed landing zone with identity, network, logging and model access.
AI security controls
AI threats mapped to controls, tested before release and monitored.
Approved tools
A published list with uses and ceilings, and detection of use outside it.
Vendor AI
Procurement checklist, contract clauses and assessment of embedded features.
Observability and halt
Central logging, behaviour monitoring, agent identities, rehearsed halt and rollback.

Recommendations, in order

  1. Publish the approved tool list in the first month, including the sensitivity ceiling for each tool.
  2. Add AI clauses to procurement templates now and apply them at every renewal.
  3. Centralise logging for in-scope AI before raising any system’s autonomy.
  4. Rehearse halt and rollback before production for every high-tier system, and give each agent its own identity.
  5. Test agents with tools for prompt injection before release.

Pitfalls

  • Blocking public tools without offering a good approved alternative
  • Vendor AI features left on by default
  • Agents running under people’s credentials

Measures

  • Unapproved AI use (survey and detection) trending down
  • In-scope systems with a rehearsed halt
  • New tool requests decided within target time

Cadence: Quarterly approved tool review; control mapping refresh with each control framework release; annual halt rehearsal for high-tier systems.

Initiatives: I-501, I-502, I-503, I-504, I-505, I-506, I-507, I-508, I-509, I-510

WS-ENG Engineering practice

Lead: Engineering or architecture lead · Domains: 6. Design and engineering practice

Make AI systems specified, bounded, tested and reversible, so autonomy can be extended safely on evidence.

Moving parts

Specification
Behaviour, constraints, failure modes and fallback written before build.
Autonomy and oversight
Allowed, ask-first and prohibited actions per system, enforced by the platform, with reviewers who have time and information.
Evaluation
Suites with agreed pass criteria, run on every change, with shadow runs for higher tiers.
Code and content assurance
Review, scanning and licence gates for AI-generated work.
Secure and safe design
Misuse, failure and harm reviewed and signed off before release.

Recommendations, in order

  1. Adopt the specification template and the autonomy matrix together; the matrix is a section of the specification.
  2. Build an evaluation suite for each in-scope system before its next model update, not after.
  3. Run higher-tier systems in shadow before they act, and compare with current practice.
  4. Monitor approval and override rates; a near-perfect approval rate in seconds is a finding.
  5. Raise autonomy only through a gate that cites measured performance.

Pitfalls

  • Accepting provider model updates untested
  • Approval steps that have become rubber stamps
  • Coding agents with production credentials

Measures

  • In-scope systems with a signed specification and evaluation suite
  • Releases blocked by failed evaluations (expected to be non-zero)
  • Median review time per approval for high-tier actions

Cadence: Evaluation on every change; quarterly review of approval and override rates; design review before each release.

Initiatives: I-601, I-602, I-603, I-604, I-605, I-606, I-607, I-608, I-609, I-610

WS-PEOPLE People and adoption

Lead: People and capability (HR and learning) · Domains: 8. People, capability and culture

Give every person the literacy, rules, support and confidence to use AI well, and build a culture that reports problems early.

Moving parts

Foundational training
Mandatory, tracked, required before tool access.
Role-based capability
Capability map, sourcing plan and learning paths for owners, approvers and builders.
Acceptable use
A one or two page policy that staff know.
Champions and support
A resourced network in every area and tiered support.
Reporting culture
A visible concern channel, answered reports and changes communicated back.

Recommendations, in order

  1. Publish the acceptable-use policy and open the concern channel in the first month.
  2. Make training mandatory, report completion by area monthly, and tie new tool access to completion.
  3. Recruit champions from survey volunteers and give them time.
  4. Train approvers and reviewers for their role before they act on high-tier systems.
  5. Tell staff what changed because of their reports.

Pitfalls

  • Counting enrolment as completion
  • A long policy nobody reads
  • Blaming the first person who reports a mistake

Measures

  • Training completion by area (target 95 percent)
  • Survey awareness of acceptable-use rules (target 85 percent)
  • Share of staff who saw an AI problem and reported it

Cadence: Monthly completion reporting; quarterly champion network review; survey at each re-assessment.

Initiatives: I-801, I-802, I-803, I-804, I-805, I-806, I-807, I-808, I-809, I-810

The library: 80 initiatives

1. Strategy and leadership 9 initiatives

I-101 Effort M

Write and endorse the AI strategy

Draft a short AI strategy that states purpose, ambition, three to six priority areas and explicit boundaries, test it with business leaders and staff representatives, have it endorsed by the board or accountable authority, and communicate it to all staff.

Lifts
1.1 from 1 to 3
Prerequisites
None
Owner
Executive sponsor or Chief AI Officer
Duration
8 to 12 weeks
Measures
Strategy endorsed by the planned date; At least 90 percent of staff reached by the communication within 30 days; Every funded AI initiative mapped to a priority area

I-102 Quick win Effort S

Agree the AI risk appetite and tier criteria

Write an AI risk-appetite statement covering harm to people, legal exposure, privacy, security and reputation; define at least three tiers with written criteria (decisions about people, data sensitivity, reversibility, autonomy); name the decision-maker for each tier; state what is outside appetite; and have it endorsed.

Lifts
1.2 from 1 to 3; 3.2 from 1 to 2
Prerequisites
None
Owner
Executive sponsor or Chief AI Officer
Duration
4 to 6 weeks
Measures
Appetite and tier criteria endorsed; Decision-maker named for every tier; Share of register entries tiered against the criteria

I-103 Quick win Effort S

Appoint the Chief AI Officer with written authority

Appoint or confirm the Chief AI Officer or executive sponsor, and issue a delegation instrument covering the register, gate decisions, the approved tool list and the authority to pause any AI use, with a budget line and a reporting line to the executive committee.

Lifts
1.3 from 1 to 3
Prerequisites
None
Owner
Board or accountable authority
Duration
2 to 4 weeks
Measures
Delegation instrument signed; Budget line established; Authority used and recorded within 12 months where warranted

I-104 Effort M

Manage AI investment as a gated portfolio

Build a portfolio register of every funded AI initiative with cost, stage and owner; add whole-of-life cost (operation, monitoring, assurance, retirement) to the business case template; and release funding in tranches at lifecycle gates.

Lifts
1.4 from 1 to 3
Prerequisites
I-102, I-203
Owner
Chief Financial Officer or finance lead
Duration
2 to 3 months
Measures
Portfolio coverage of funded AI initiatives (target 100 percent); Business cases with whole-of-life cost; Pilots with a funded decision point

I-105 Quick win Effort S

Stand up the quarterly executive AI review

Make AI a standing item at the executive committee at least quarterly, using a one-page dashboard covering register coverage, assessments, gate decisions, incidents and near misses, overrides and benefits, with a standing question for each measure; report to the board at least twice a year.

Lifts
1.5 from 1 to 3
Prerequisites
I-203
Owner
Executive sponsor or Chief AI Officer
Duration
6 weeks
Measures
Standing item held every quarter; Dashboard measures defined with sources; Board reports delivered twice a year

I-106 Effort M

Generate the executive dashboard from systems of record

Replace hand-compiled figures with measures drawn directly from the register, incident log, monitoring and benefits register; document each measure’s source; and minute the decisions taken because of the evidence.

Lifts
1.5 from 3 to 4
Prerequisites
I-105, I-505
Owner
CIO or CTO
Duration
3 to 6 months
Measures
Measures sourced automatically (target 100 percent); Hours to produce the quarterly dashboard; Decisions minuted from dashboard evidence each year

I-107 Effort M

Gate funding on evidence and act on it

Record each funding release at a gate with the evidence considered, report actual against planned cost and benefit quarterly, and stop or reshape at least the pilots whose evidence does not support continuing.

Lifts
1.4 from 3 to 4
Prerequisites
I-104, I-702
Owner
Chief Financial Officer or finance lead
Duration
Two quarters
Measures
Funding releases with recorded evidence (target 100 percent); Quarterly actual-against-plan reports; Pilots stopped or reshaped on evidence

I-108 Effort S

Refresh strategy and appetite from operating evidence

Hold an annual strategy and appetite refresh that uses the dashboard, incident and override data, benefits and the maturity re-assessment as its inputs, records decisions not to proceed, and folds AI priorities into the corporate plan.

Lifts
1.1 from 3 to 5; 1.2 from 3 to 5
Prerequisites
I-101, I-102, I-106
Owner
Executive sponsor or Chief AI Officer
Duration
Annual, about 6 weeks each cycle
Measures
Refresh held each year; Changes traced to evidence; AI priorities present in the corporate plan

I-109 Effort S

Write AI accountability into executive performance agreements

Add AI accountabilities to the performance agreements of every executive whose portfolio runs AI, and record each use of the AI lead’s authority to pause, refuse or condition a use.

Lifts
1.3 from 3 to 4
Prerequisites
I-103
Owner
Board or accountable authority
Duration
Next performance cycle
Measures
Executives with AI accountabilities in their agreements; Uses of the pause or refuse authority recorded

2. Governance and operating model 10 initiatives

I-201 Quick win Effort S

Name an accountable owner for every AI use case

Assign one accountable owner at business-executive level to every in-scope use case on the register, brief each owner on the role, obtain written acknowledgement, and record owner changes within 30 days.

Lifts
2.1 from 1 to 3
Prerequisites
I-203
Owner
AI lead or AI centre of excellence
Duration
4 to 6 weeks
Measures
In-scope uses with an acknowledged owner (target 100 percent); Owner changes recorded within 30 days

I-202 Quick win Effort S

Establish the AI governance committee with decision rights

Constitute a committee chaired by the Chief AI Officer with endorsed terms of reference naming its decision rights (use cases, tiers, gates, approved tools, exceptions), membership from security, privacy, legal, data, risk and business areas, a quorum rule, a monthly cadence and a decision log.

Lifts
2.2 from 1 to 3
Prerequisites
I-103
Owner
Executive sponsor or Chief AI Officer
Duration
4 weeks
Measures
Terms of reference endorsed; Meetings held monthly with quorum; Decision log maintained, including refusals and conditions

I-203 Quick win Effort M

Open the register and run the first discovery sweep

Create the use-case register with defined fields (owner, purpose, tier, stage, assessment status, data used, vendor), then run a discovery sweep of procurement records, software features, analytics teams and staff use (through the survey), under an amnesty, and add everything found.

Lifts
2.3 from 1 to 3
Prerequisites
None
Owner
AI lead or AI centre of excellence
Duration
6 to 10 weeks
Measures
Register fields populated for at least 90 percent of entries; Embedded vendor AI entries present; Gap between survey-reported tools and register closed

I-204 Effort M

Feed the register from intake and procurement, and reconcile it

Make intake and procurement create register entries so new AI cannot be adopted without one, run discovery at least twice a year, and reconcile the register with procurement records and the approved tool list, resolving variances.

Lifts
2.3 from 3 to 4
Prerequisites
I-203, I-701, I-507
Owner
Procurement and contract management
Duration
3 months
Measures
New AI acquisitions with a register entry at purchase (target 100 percent); Reconciliation variances resolved within 30 days

I-205 Quick win Effort S

Map the lines of assurance and put AI in the audit plan

Produce an assurance map assigning AI responsibilities to owners, oversight functions and internal audit; build second-line review into the lifecycle; and add an AI audit to the internal audit plan within 18 months.

Lifts
2.4 from 1 to 3
Prerequisites
None
Owner
Risk, compliance and internal audit
Duration
6 weeks
Measures
Assurance map endorsed; AI audit scheduled in the internal audit plan

I-206 Effort M

Complete the first internal audit of AI governance

Audit AI governance against the published criteria auditors use (strategy, accountabilities, policies and risk, impact assessment, controlled deployment, monitoring), test that controls operate on a sample of use cases, and track findings to closure; second-line functions begin testing first-line controls.

Lifts
2.4 from 3 to 4
Prerequisites
I-205, I-202, I-303
Owner
Risk, compliance and internal audit
Duration
3 months
Measures
Audit completed; Findings closed by agreed dates; Second-line control tests performed each quarter

I-207 Quick win Effort S

Write decision rights, a RACI and the escalation path

Document a RACI for the main AI decisions with one accountable role each, define decision categories (standard, use case, platform and tool, strategic) with who decides and indicative turnaround, and document the escalation path with worked examples.

Lifts
2.5 from 1 to 3
Prerequisites
I-202
Owner
AI lead or AI centre of excellence
Duration
4 weeks
Measures
RACI endorsed with a single accountable role per decision; Escalations logged with outcome and time

I-208 Effort M

Delegate standard decisions and route approvals through tooling

Write delegation rules so standard decisions no longer reach the committee, test the RACI against real cases each year, review the committee’s effectiveness annually, and configure approval routing in workflow and agent platforms so the right person is asked automatically.

Lifts
2.2 from 3 to 4; 2.5 from 3 to 4
Prerequisites
I-207
Owner
AI governance committee
Duration
3 months
Measures
Share of decisions made under delegation; Committee decision turnaround; Approvals routed automatically for AI in scope

I-209 Effort M

Stand up the AI centre of excellence

Fund and staff a small enabling team under the Chief AI Officer that runs the register and lifecycle, triages intake, supports owners through assessments and gates, maintains templates and the approved tool list, runs the champion network and reports the dashboard. It enables; it does not own use cases.

Lifts
2.2 from 2 to 3; 7.2 from 2 to 3
Prerequisites
I-202
Owner
Executive sponsor or Chief AI Officer
Duration
2 to 3 months
Included when
Added automatically when 250 or more staff in scope and criterion 2.2 below 3.
Measures
Team funded and staffed; Intake triaged within target time; Owners supported through gates

I-210 Effort S

Run annual owner attestation and close ownership gaps

Ask every owner to attest annually that their use case’s controls run, have owners present their own gate submissions, and link the leaver and transfer process to the register so ownership gaps are detected and fixed within a set time.

Lifts
2.1 from 3 to 4
Prerequisites
I-201
Owner
AI lead or AI centre of excellence
Duration
2 to 3 months
Measures
Attestations complete (target 100 percent); Ownership gaps fixed within the target time

3. Risk, assurance and transparency 11 initiatives

I-301 Quick win Effort S

Adopt an impact assessment method and screen at intake

Adopt one impact assessment method (the DTA tool for agencies; an ISO/IEC 42005-aligned method for others), integrate it with privacy impact assessment, set refresh frequency by tier, and screen every new idea at intake.

Lifts
3.1 from 1 to 2
Prerequisites
I-102
Owner
Legal, privacy and records lead
Duration
4 to 6 weeks
Measures
Method adopted; New ideas screened at intake (target 100 percent)

I-302 Effort M

Complete impact assessments for high-tier and existing use cases

Complete pre-deployment assessments for every in-scope use case, starting with high-tier and people-affecting uses, link each to the register, and track mitigations to completion.

Lifts
3.1 from 2 to 3
Prerequisites
I-301, I-201
Owner
Use-case owner or business lead
Duration
3 to 6 months
Measures
In-scope uses with a current assessment (target 100 percent); Mitigations closed by agreed dates

I-303 Effort M

Adopt the assurance lifecycle and readiness gates

Adopt a lifecycle from intake to retirement with go or no-go gates (design complete, testing or simulation passed, governance validated, shadow proven, organisationally ready), pass conditions scaled by tier, and recorded decisions by the right authority.

Lifts
3.3 from 1 to 3
Prerequisites
I-202, I-102
Owner
AI governance committee
Duration
2 to 3 months
Measures
Lifecycle endorsed; In-scope use cases with recorded gate decisions (target 100 percent)

I-304 Effort M

Enforce gates in change and deployment controls

Make change and deployment processes check for a recorded gate decision before any AI component reaches production, track gate conditions to closure, and measure gate cycle time.

Lifts
3.3 from 3 to 4
Prerequisites
I-303
Owner
CIO or CTO
Duration
3 to 6 months
Measures
Releases blocked for missing gate decisions (expected to be non-zero at first); Median gate cycle time

I-305 Effort S

Tier every use case independently against the criteria

Assign tiers at intake by someone other than the proposer, using the written criteria, record the rationale, flag high-tier uses on the register and route them to the full lifecycle.

Lifts
3.2 from 1 to 3
Prerequisites
I-102, I-203
Owner
Risk, compliance and internal audit
Duration
6 weeks
Measures
Use cases tiered by an independent role (target 100 percent); High-tier uses identified and routed

I-306 Effort S

Refresh assessments and tiers on change, and calibrate tiering

Trigger re-assessment and re-tiering on material change (model, data, autonomy, population affected) and on a schedule by tier, have the second line sample assessment quality, and run a yearly calibration in which two assessors tier a sample independently.

Lifts
3.1 from 3 to 4; 3.2 from 3 to 4
Prerequisites
I-302, I-305
Owner
Risk, compliance and internal audit
Duration
2 to 3 months
Measures
Assessments refreshed after material change (target 100 percent); Calibration agreement rate; Tier distribution reported

I-307 Quick win Effort S

Inventory decisions about people and explain them in the privacy policy

List every decision about people that AI contributes to, including through vendor features, confirm which fall within automated-decision disclosure obligations, and update the privacy policy to explain them where the law requires.

Lifts
3.4 from 1 to 2
Prerequisites
None
Owner
Legal, privacy and records lead
Duration
4 to 6 weeks
Measures
Inventory of AI-assisted decisions about people complete; Privacy policy updated before the legal deadline

I-308 Effort M

Publish the transparency statement and design human review paths

Publish a statement describing how the organisation uses AI (by use, not by tool), reviewed at least yearly; for each decision type in the inventory, tell affected people that AI is involved and document how they obtain human review; and confirm the privacy policy explains automated decisions where the law requires.

Lifts
3.4 from 2 to 3
Prerequisites
I-307
Owner
Legal, privacy and records lead
Duration
2 to 3 months
Measures
Statement published and reviewed within 12 months; Decision types with a documented review path (target 100 percent)

I-309 Effort M

Test disclosures and track review requests

Test notices and review paths through complaint sampling or mystery shopping, log every request for human review with its outcome and time taken, report the figures, and update the statement whenever the register changes materially.

Lifts
3.4 from 3 to 4
Prerequisites
I-308, I-404
Owner
Legal, privacy and records lead
Duration
3 months
Measures
Review requests logged with outcome; Median days to complete a review; Statement updated within 30 days of a material change

I-310 Quick win Effort S

Adopt the AI incident runbook and register, and rehearse it

Define an AI incident and near miss, adopt a severity scale and runbook naming who may halt a system and the notification map, open an incident and near-miss register, and rehearse the runbook once.

Lifts
3.5 from 1 to 3
Prerequisites
None
Owner
CISO or security lead
Duration
6 weeks
Measures
Runbook endorsed; Rehearsal held with time to halt measured; Register open and in use

I-311 Effort S

Review near misses monthly and close corrective actions

Review incidents and near misses monthly at the committee for patterns, run post-incident reviews that identify the failed control, track corrective actions to closure and measure time to contain.

Lifts
3.5 from 3 to 4
Prerequisites
I-310, I-202
Owner
AI governance committee
Duration
From month 3, ongoing
Measures
Near misses reported per quarter (healthy and stable or rising); Corrective actions closed on time; Median time to contain

4. Data, knowledge and semantics 10 initiatives

I-401 Effort M

Baseline data quality for priority AI data domains

Name owners for the data domains feeding AI, define quality dimensions and thresholds, measure a baseline, and add a data fitness check to use-case assessments.

Lifts
4.1 from 1 to 3
Prerequisites
I-203
Owner
Chief Data Officer or data owner
Duration
3 months
Measures
Priority domains with owner, thresholds and baseline; Assessments including a data fitness check

I-402 Effort M

Monitor data quality for production AI

Monitor quality of data feeding production AI against thresholds with alerts and defined responses (degrade, pause or human review), and test representativeness for every use that affects people.

Lifts
4.1 from 3 to 4
Prerequisites
I-401, I-505
Owner
Chief Data Officer or data owner
Duration
3 to 6 months
Measures
Production AI data domains monitored (target 100 percent); Alerts responded to within target time; People-affecting uses with a representativeness test

I-403 Effort M

Curate knowledge sources and agree the vocabulary

Inventory the knowledge sources AI tools draw on, give each an owner and a currency rule, remove superseded content, and agree a maintained glossary for priority domains that AI specifications reference.

Lifts
4.2 from 1 to 3
Prerequisites
None
Owner
Chief Data Officer or data owner
Duration
3 months
Measures
Knowledge sources with owner and currency rule (target 100 percent); Superseded documents removed from AI retrieval; Glossary maintained for priority domains

I-404 Effort M

Adopt a decision-record standard for in-scope uses

Define the minimum record for each in-scope AI decision (subject, policy applied, model and version, sources, confidence, human approvals, rationale reference), apply it first to systems that contribute to decisions about people, and retain the records.

Lifts
4.4 from 1 to 3
Prerequisites
I-307
Owner
Engineering or architecture lead
Duration
2 to 3 months
Measures
In-scope systems producing complete records (target 100 percent)

I-405 Effort M

Make decision records tamper-evident and monitor completeness

Protect decision records against alteration (for example hash chaining or write-once storage), make them queryable, monitor completeness with alerts for gaps, and answer reviews, complaints and audits from them.

Lifts
4.4 from 3 to 4
Prerequisites
I-404
Owner
Engineering or architecture lead
Duration
3 months
Measures
Record completeness rate; Reviews and audits answered from records

I-406 Quick win Effort S

Set and publish a sensitivity ceiling for each AI tool

Assess each approved AI tool and set its ceiling (sensitivity or classification level, and whether personal information is allowed), publish the ceilings to staff with the approved tool list, and map data flows for in-scope use cases.

Lifts
4.3 from 1 to 3
Prerequisites
None
Owner
CISO or security lead
Duration
4 to 6 weeks
Measures
Approved tools with a published ceiling (target 100 percent); In-scope data flows mapped

I-407 Effort M

Enforce sensitivity ceilings technically

Enforce ceilings with sensitivity labels, data loss prevention, masking of identifiers and routing, detect and report breaches, and require approval for exceptions.

Lifts
4.3 from 3 to 4
Prerequisites
I-406
Owner
CISO or security lead
Duration
3 to 6 months
Measures
Tools with technical enforcement; Breaches detected and handled

I-408 Effort M

Map AI content to retention rules and configure tools

Map AI content types (business prompts and outputs, decision records, agent action logs) to retention classes, configure each AI tool’s retention to match, and tell staff when AI-assisted work must be saved as a record.

Lifts
4.5 from 1 to 3
Prerequisites
None
Owner
Records manager
Duration
2 to 3 months
Measures
AI tools with retention configured to policy; Staff guidance published

I-409 Effort S

Test legal holds and disposal for AI content

Test applying a legal hold to AI content, run and evidence scheduled disposal, and include AI content when answering discovery or information requests.

Lifts
4.5 from 3 to 4
Prerequisites
I-408
Owner
Records manager
Duration
2 months
Measures
Legal hold test passed; Disposal runs evidenced

I-410 Effort M

Evaluate answers against curated sources and resolve conflicts

Measure the currency and coverage of retrieval sources, evaluate answer quality against them, detect conflicting sources, and resolve conflicts through a defined process.

Lifts
4.2 from 3 to 4
Prerequisites
I-403, I-603
Owner
Chief Data Officer or data owner
Duration
3 months
Measures
Answer accuracy against curated sources; Source conflicts resolved within target time

5. Platform, architecture and security 10 initiatives

I-501 Effort L

Approve an AI reference architecture on an assessed platform

Document an AI reference architecture (landing zone, identity, network, logging, model access), assess it at the right level for the information it will hold, move in-scope AI workloads onto it, and record hosting and residency for each AI service.

Lifts
5.1 from 1 to 3
Prerequisites
None
Owner
CIO or CTO
Duration
3 to 6 months
Measures
In-scope AI workloads on the platform (target 100 percent); AI services with documented residency

I-502 Effort M

Enforce platform guardrails as code

Encode platform guardrails (policy definitions, network controls, logging on by default) as code, detect deviations, and give the platform an operating owner, capacity plan and service levels.

Lifts
5.1 from 3 to 4
Prerequisites
I-501
Owner
CIO or CTO
Duration
3 months
Measures
Guardrails defined as code; Deviations resolved within target time

I-503 Quick win Effort S

Publish the approved AI tool and model list

Publish a list of approved AI tools and models stating permitted uses and the sensitivity ceiling for each, define how staff request a new tool and how fast it is decided, and provision access through identity groups.

Lifts
5.3 from 1 to 3
Prerequisites
None
Owner
CISO or security lead
Duration
4 weeks
Measures
List published to all staff; Median days to decide a new tool request

I-504 Effort M

Detect and follow up unapproved AI use

Detect use of unapproved AI services through network, browser, expense and software discovery, follow up each finding by offering the approved alternative, review the list quarterly, and track provider model changes.

Lifts
5.3 from 3 to 4
Prerequisites
I-503
Owner
CISO or security lead
Duration
3 months
Measures
Unapproved AI use trending down (detection and survey); Quarterly list reviews held

I-505 Effort M

Centralise logging and monitor AI behaviour

Send logs from in-scope AI systems to a central platform, define behaviour measures (quality samples, drift indicators, override rates, cost) with thresholds, and document a halt and rollback procedure with named authority for each system.

Lifts
5.5 from 1 to 3
Prerequisites
None
Owner
CIO or CTO
Duration
3 months
Measures
In-scope systems centrally logged (target 100 percent); Systems with defined behaviour measures and a halt procedure

I-506 Effort M

Rehearse halt and rollback, and give agents their own identities

Rehearse halt and rollback for every high-tier system with time to halt measured, configure alerts on behaviour thresholds with defined responses, and give each agent a unique identity with least-privilege permissions so its actions are attributable.

Lifts
5.5 from 3 to 4
Prerequisites
I-505, I-310
Owner
CIO or CTO
Duration
2 to 3 months
Measures
High-tier systems rehearsed within 12 months (target 100 percent); Median time to halt; Agents with unique identities (target 100 percent)

I-507 Quick win Effort M

Adopt an AI procurement checklist and contract clauses

Apply an AI assurance checklist to new procurements and renewals, and add standard clauses covering data use (no training on organisational data without consent), disclosure of AI features and model changes, security, audit rights and exit; assess embedded features before enabling them.

Lifts
5.4 from 1 to 3
Prerequisites
None
Owner
Procurement and contract management
Duration
2 to 3 months
Measures
Procurements and renewals using the checklist (target 100 percent); Contracts with AI clauses

I-508 Effort M

Monitor vendor AI and act on change notices

Monitor vendor AI in operation (data flows, feature changes, incidents), act on model-change notifications received under contract, and reassess high-risk suppliers annually.

Lifts
5.4 from 3 to 4
Prerequisites
I-507, I-203
Owner
Procurement and contract management
Duration
Ongoing from month 3
Measures
Change notices actioned within target time; High-risk suppliers reassessed each year

I-509 Effort M

Map AI threats to controls and test before release

Publish an AI usage policy, build an AI threat model (prompt injection, data poisoning, model theft, insecure output handling, excessive agency), map threats to implemented controls for in-scope systems, and security test each AI application before release.

Lifts
5.2 from 1 to 3
Prerequisites
None
Owner
CISO or security lead
Duration
2 to 3 months
Measures
In-scope systems with a threat model and mapped controls; Releases with an AI security test (target 100 percent)

I-510 Effort M

Red-team high-tier systems and monitor AI attacks

Run adversarial testing on every high-tier system, add detection for AI-specific attacks and unusual agent actions, and refresh the control mapping with each release of the governing control framework.

Lifts
5.2 from 3 to 4
Prerequisites
I-509
Owner
CISO or security lead
Duration
3 months, then per system
Measures
High-tier systems red-teamed; Detection rules in operation; Mapping refreshed after each framework release

6. Design and engineering practice 10 initiatives

I-601 Quick win Effort S

Adopt an AI specification template and design gate

Adopt a specification template (purpose, scope, inputs, constraints, autonomy and decision rights, success and failure measures, fallback, human roles) and require a signed-off specification at the design gate for every in-scope component.

Lifts
6.1 from 1 to 3
Prerequisites
None
Owner
Engineering or architecture lead
Duration
4 to 6 weeks
Measures
In-scope components with a signed specification (target 100 percent)

I-602 Effort M

Version specifications and trace them to tests

Version each specification with the system it describes, derive test cases and monitoring thresholds from it, and require a specification change for any change in behaviour.

Lifts
6.1 from 3 to 4
Prerequisites
I-601, I-603
Owner
Engineering or architecture lead
Duration
3 months
Measures
Specifications linked to releases; Specification items traced to tests

I-603 Effort M

Build evaluation suites with agreed pass criteria

For each in-scope system, build an evaluation suite covering typical, edge and adversarial cases (and fairness where people are affected), agree pass criteria with the owner, record results at the testing gate, and run higher-tier systems in shadow before they act.

Lifts
6.3 from 1 to 3
Prerequisites
None
Owner
Engineering or architecture lead
Duration
2 to 3 months
Measures
In-scope systems with an evaluation suite (target 100 percent); High-tier systems shadowed before acting

I-604 Effort M

Run evaluations on every change and review them independently

Run evaluations automatically on every model, prompt, tool or data change and block release on failure, measure shadow agreement with current practice, and have results reviewed by someone independent of the builder.

Lifts
6.3 from 3 to 4
Prerequisites
I-603
Owner
Engineering or architecture lead
Duration
3 months
Measures
Changes evaluated before release (target 100 percent); Releases blocked by failed evaluations; Shadow agreement rate

I-605 Quick win Effort S

Set autonomy and approval rules for each system

For each in-scope system, document which actions are allowed, need a person’s approval, or are prohibited, and design each human participation point (role, information shown, authority to change the outcome); record approvals.

Lifts
6.2 from 1 to 3
Prerequisites
I-102
Owner
Use-case owner or business lead
Duration
6 weeks
Measures
In-scope systems with an autonomy and approval matrix (target 100 percent)

I-606 Effort M

Enforce autonomy in the platform and watch approval rates

Enforce autonomy settings in the platform, bind each approval to exactly what was reviewed, monitor approval and override rates and time per approval to detect rubber-stamping, and change autonomy only through a gate.

Lifts
6.2 from 3 to 4
Prerequisites
I-605, I-506
Owner
Engineering or architecture lead
Duration
3 months
Measures
Systems with platform-enforced autonomy; Approval and override rates reviewed quarterly; Autonomy changes with a gate record

I-607 Quick win Effort S

Put review and scanning gates on AI-generated code and content

Set a policy for AI-generated code and content, require human review plus security scanning and licence checks at merge, and review and label material AI-generated content for external audiences where required.

Lifts
6.4 from 1 to 3
Prerequisites
None
Owner
Engineering or architecture lead
Duration
4 to 6 weeks
Measures
Repositories with merge gates and scanning (target 100 percent); External content reviewed before publication

I-608 Effort M

Record provenance of AI-assisted work and measure its quality

Record automatically which changes were AI-assisted, compare defect and vulnerability rates with a baseline, and target review effort where defects concentrate.

Lifts
6.4 from 3 to 4
Prerequisites
I-607
Owner
Engineering or architecture lead
Duration
3 months
Measures
AI-assisted changes with provenance recorded; Defect rate in AI-assisted work against baseline

I-609 Quick win Effort S

Adopt a secure-and-safe design review for AI

Adopt an AI-specific design checklist (misuse cases, fail-closed behaviour, fallback to manual, data minimisation, harm analysis) completed before release, with sign-off by security and the owner.

Lifts
6.5 from 1 to 3
Prerequisites
None
Owner
CISO or security lead
Duration
4 to 6 weeks
Measures
In-scope releases with a signed design review (target 100 percent)

I-610 Effort S

Feed incidents and threat models into design reviews

Draw on threat models, incident lessons and evaluation results in every design review, track issues to closure before release, and analyse findings across systems to update shared patterns.

Lifts
6.5 from 3 to 4
Prerequisites
I-609, I-311
Owner
CISO or security lead
Duration
3 months
Measures
Design issues closed before release; Cross-system findings analysis completed each year

7. Use-case delivery and value 10 initiatives

I-701 Quick win Effort M

Create a single AI intake and prioritise the portfolio

Make one intake the required route for every AI idea, capturing value, risk, feasibility and tier; prioritise the portfolio against the strategy’s priority areas each quarter; record deferred and refused ideas with reasons.

Lifts
7.1 from 1 to 3
Prerequisites
I-102, I-203
Owner
AI lead or AI centre of excellence
Duration
6 to 8 weeks
Measures
New use cases entering through intake (target 100 percent); Quarterly prioritisation held; Refusals recorded with reasons

I-702 Quick win Effort S

Charter every pilot with success criteria and a decision date

Require a one-page charter for every pilot setting success criteria, a decision date and the graduation test (value, risk, operational readiness and whole-of-life cost) before it starts, and charter pilots already running.

Lifts
7.3 from 1 to 3
Prerequisites
None
Owner
AI lead or AI centre of excellence
Duration
4 weeks
Measures
Pilots with charter and decision date (target 100 percent)

I-703 Quick win Effort S

Decide the future of stalled pilots

Review every pilot running for more than six months against its charter and decide, on evidence, to scale, reshape or stop it; record the decision and the lessons.

Lifts
7.3 from 2 to 3
Prerequisites
I-702
Owner
Executive sponsor or Chief AI Officer
Duration
6 weeks
Measures
Pilots older than six months with a recorded decision (target 100 percent); Resources released from stopped pilots

I-704 Effort M

Baseline and register benefits for every funded use case

Define measurable benefits for each funded use case, take a baseline before go-live, name an owner and a measurement method, and report the benefits register to the executive at least twice a year.

Lifts
7.4 from 1 to 3
Prerequisites
I-701
Owner
Chief Financial Officer or finance lead
Duration
2 to 3 months
Measures
Funded use cases with a baseline (target 100 percent); Benefits reports to the executive twice a year

I-705 Effort M

Measure benefits from operational data each quarter

Measure benefits from operational data rather than surveys alone, report quarterly against targets with shortfalls and their causes, and use benefit evidence in scale and stop decisions.

Lifts
7.4 from 3 to 4
Prerequisites
I-704
Owner
Chief Financial Officer or finance lead
Duration
3 months
Measures
Benefits measured from operational data; Shortfalls reported; Scale or stop decisions citing benefit evidence

I-706 Effort S

Track each use case’s lifecycle stage and schedule reviews

Record the current lifecycle stage of every use case with evidence links for completed stages and dated transitions, and schedule reviews for every operating use case.

Lifts
7.2 from 1 to 3
Prerequisites
I-203, I-303
Owner
AI lead or AI centre of excellence
Duration
6 weeks
Measures
Entries with current stage and evidence (target at least 90 percent); Operating uses with a scheduled review (target 100 percent)

I-707 Effort M

Measure the delivery pipeline and act on it

Measure intake decision time, stage progress, overdue reviews and time to graduation; have an independent function sample stage evidence; make graduation decisions on time with operating owners in place before go-live; and retire use cases deliberately.

Lifts
7.1 from 3 to 4; 7.2 from 3 to 4; 7.3 from 3 to 4
Prerequisites
I-701, I-706, I-702
Owner
AI lead or AI centre of excellence
Duration
3 months
Measures
Median intake decision time; Overdue reviews escalated; Graduation decisions made on time; Retirements recorded

I-708 Effort M

Build a pattern catalogue and check for reuse at intake

Catalogue approved patterns, templates and shared components with owners and versions, and make intake check for a reusable pattern before approving a new build.

Lifts
7.5 from 1 to 3
Prerequisites
I-701
Owner
Engineering or architecture lead
Duration
3 months
Measures
Catalogue published with owners; Intake decisions with a reuse check (target 100 percent)

I-709 Effort M

Attach assurance evidence to patterns and measure reuse

Attach assessment, test and control evidence to each pattern so reuse shortens gates, version and retire patterns, and measure the share of new use cases built on them.

Lifts
7.5 from 3 to 4
Prerequisites
I-708, I-603
Owner
Engineering or architecture lead
Duration
3 months
Measures
Share of new use cases on catalogue patterns; Gate time saved through reuse

I-710 Effort L

Govern one priority use case end to end as the reference case

Choose one priority use case and take it through every stage and gate of the lifecycle with full evidence, using it to prove the framework, fix friction and produce reusable templates and patterns.

Lifts
7.2 from 2 to 3; 3.3 from 2 to 3
Prerequisites
I-303, I-301, I-605, I-603
Owner
Use-case owner or business lead
Duration
6 to 9 months
Included when
Added automatically when criterion 3.3 below 3 and a target of at least 3 for 3. Risk, assurance and transparency or 3 for 6. Design and engineering practice.
Measures
Reference case passed every gate with evidence; Templates and patterns published from it; Lifecycle changes made from its lessons

8. People, capability and culture 10 initiatives

I-801 Quick win Effort M

Make foundational AI training mandatory and track completion

Make foundational responsible-AI training mandatory for all staff (responsible use, information handling, verification, reporting), report completion by business area monthly, and require completion before new staff receive access to approved tools.

Lifts
8.1 from 1 to 3
Prerequisites
None
Owner
People and capability (HR and learning)
Duration
3 months
Measures
Completion by business area (target 80 percent at Level 3, 95 percent at Level 4); New staff complete before tool access

I-802 Effort S

Measure training effectiveness and refresh content yearly

Measure effectiveness (assessment results, survey confidence, observed handling errors), lift completion above 95 percent, and update content at least yearly from incidents and new tools.

Lifts
8.1 from 3 to 4
Prerequisites
I-801
Owner
People and capability (HR and learning)
Duration
6 months
Measures
Completion above 95 percent; Assessment pass rate; Content updated within 12 months

I-803 Quick win Effort S

Publish a short acceptable-use policy

Publish a one or two page acceptable-use policy covering approved tools, information ceilings, ownership of outputs, verification, disclosure, records and reporting; have staff acknowledge it.

Lifts
8.3 from 1 to 3
Prerequisites
I-503, I-406
Owner
CISO or security lead
Duration
2 to 4 weeks
Measures
Policy acknowledged by staff; Survey awareness at least 70 percent

I-804 Effort M

Monitor acceptable use and build rules into tools

Monitor compliance (unapproved tools, sensitive information entry, sampled outputs), handle breaches consistently, update the policy when tools change, and add warnings and blocks at the point of use.

Lifts
8.3 from 3 to 4
Prerequisites
I-803, I-504
Owner
CISO or security lead
Duration
3 months
Measures
Survey awareness above 85 percent; Breaches handled consistently; Point-of-use controls in place

I-805 Effort M

Map AI capability needs and plan sourcing

Map the roles and skills AI work needs (product ownership, evaluation, data stewardship, AI risk and assurance, AI security, agent design), where each sits, current gaps and a build, buy or borrow plan, and publish role-based learning paths.

Lifts
8.2 from 1 to 3
Prerequisites
None
Owner
People and capability (HR and learning)
Duration
2 to 3 months
Measures
Capability map published; Gaps with a sourcing decision (target 100 percent)

I-806 Effort M

Prepare owners, approvers and reviewers before they act

Train owners, approvers and reviewers for their specific role before they act on high-tier systems, measure capability against the map, and mitigate key-person risks.

Lifts
8.2 from 3 to 4
Prerequisites
I-805
Owner
People and capability (HR and learning)
Duration
3 months
Measures
Approvers of high-tier systems trained before acting (target 100 percent); Key-person risks with a mitigation

I-807 Quick win Effort S

Build a champion network and support tiers

Recruit champions in every major area (survey volunteers first) with time allocated, define support tiers from self-service to specialists, and track active use by area.

Lifts
8.4 from 1 to 3
Prerequisites
None
Owner
People and capability (HR and learning)
Duration
6 weeks
Measures
Champion coverage of major areas (target 100 percent); Active use by area reported monthly

I-808 Effort M

Measure meaningful use and target support

Measure adoption by meaningful use (tasks, outcomes, quality) by area and role, give targeted support to low-adoption areas, and change tools and guidance from champion feedback.

Lifts
8.4 from 3 to 4
Prerequisites
I-807
Owner
People and capability (HR and learning)
Duration
3 months
Measures
Meaningful-use measures by area; Low-adoption areas supported; Changes made from champion feedback

I-809 Quick win Effort S

Open an AI concern channel and answer every report

Open a visible channel for staff (and the public, where relevant) to raise AI concerns and report errors and near misses, answer every report, and brief managers to respond without blame.

Lifts
8.5 from 1 to 3
Prerequisites
None
Owner
AI lead or AI centre of excellence
Duration
4 weeks
Measures
Reports answered within target time (target 100 percent); Survey share of staff who saw a problem and reported it

I-810 Effort S

Close the loop on reports and measure calibrated trust

Tell staff what changed because of their reports, track near-miss reporting trends, and measure verification habits and calibrated trust through the survey at each re-assessment.

Lifts
8.5 from 3 to 4
Prerequisites
I-809, I-311
Owner
AI lead or AI centre of excellence
Duration
6 months
Measures
Changes communicated back to reporters; Trust-calibration survey items improving between surveys

This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.