Findings, strategy and governance reports

Worked example

Paragraphs

• Wattlegrove Group is at an early stage of AI capability (1.7, Initial). AI is being used, but the organisation cannot yet see, own or steer that use. It is approaching Repeatable. Capability is balanced: domain scores range from 1.4 to 2.1, so no single area is holding the rest back; the whole organisation needs to move together.
• The foundations are not yet in place. There is no AI risk appetite, the list of AI in use is incomplete, impact assessments are not done, and AI incidents are not recognised or recorded. Every other improvement depends on these four.
• The strongest domains are Platform, architecture and security (2.1), built on an assessed cloud landing zone, and People, capability and culture (2.0), where the Copilot pilot has a change plan and champions. The weakest are Risk, assurance and transparency (1.4) and Use-case delivery and value (1.4): nothing is tiered or gated, and no pilot has a decision date.
• Three obligations need action now. The EU AI Act’s AI literacy duty has applied since 2 February 2025 and its transparency duty for AI that talks to people since 2 August 2026; the EU website’s chat assistant does not tell customers they are talking to AI. From 10 December 2026 the Privacy Act requires the privacy policy to explain automated decisions that use personal information and significantly affect people; the recruitment platform’s candidate ranking is one such decision and is not disclosed.
• The assessment found eight AI uses, of which five were on Wattlegrove’s list. Three were found during the assessment, including the candidate ranking feature, which the vendor switched on in 2025 and which nobody owns. In the staff survey (214 responses), 41 percent had used an AI tool for work without being sure it was approved, and 33 percent sometimes rely on AI output without checking it.

Decisions sought

• Endorse the target of a defined practice (Level 3) in every domain within 24 months, with oversight and testing of AI that affects people at Level 4.
• Fund the dedicated uplift team that sets the roadmap’s capacity.
• Appoint the Chief AI Officer with written authority, including to pause AI use, and establish the AI governance committee within 90 days.
• Direct the privacy, people and customer teams to meet the EU AI Act and Privacy Act obligations in the first 90 days.
• Set the first re-assessment for October 2027, with a light re-score in April 2027.

Worked example

Paragraphs

• This assessment covered the whole of Wattlegrove Group (600 staff, including the Netherlands sales subsidiary) using the organisation edition of the AI Capability Maturity Assessment. It was assessor-led by two UHS Logic assessors with an independent quality reviewer, and ran from 17 August to 9 October 2026.
• The evidence base comprised 63 documents, records and system configurations; 19 interviews across nine roles; two frontline focus groups; five workshops; and an anonymous staff survey that received 214 responses (36 percent of staff, above the validity threshold of 90).
• Each of the 40 criteria was scored at the highest level whose pass test was met, in half-level steps where substantial parts of the next level were in place. Scores that rest on assertion alone are capped at Level 2. A domain’s score is the average of its five criteria, capped at one level above its weakest criterion, so that a missing foundation cannot be averaged away.
• Of the 40 criteria, 39 were scored on evidence seen and one on assertion: executives described quarterly board briefings on AI, but no papers were provided, so Executive evidence rhythm (1.5) is capped at Level 2. All scores were played back to the people who provided the evidence before this report was drafted.

Worked example

Paragraphs

• Wattlegrove’s overall score is 1.7 (Initial, approaching Repeatable). The foundations layer averages 1.8, ways of working 1.4 and practice 1.9: the organisation is weakest at the everyday disciplines of assessing, gating and delivering use cases.
• Of the 40 criteria, one is at Level 3 (Assessed AI platform), three are at 2.5, seventeen at Level 2, twelve at 1.5 and seven at Level 1. The seven at Level 1 are risk appetite and tiers, three lines of assurance, risk tiering, incident and near-miss management, decision records, lifecycle execution, and reuse. No domain was capped: each domain’s average is within one level of its weakest criterion.
• Read through the responsible AI overlay, impact and risk is weakest (1.1) and transparency and records next (1.3), while development and operation and people and culture both reach 2.0. Wattlegrove is better at building and running AI than at understanding and explaining its effects on people.

Table

Headers

• Domain
• Score
• Band
• Target (24 months)
• Gap

Rows

D1 Strategy and leadership	1.7	Initial, approaching Repeatable	3.0	1.3
D2 Governance and operating model	1.6	Initial	3.0	1.4
D3 Risk, assurance and transparency	1.4	Initial	3.4	2.0
D4 Data, knowledge and semantics	1.8	Initial, approaching Repeatable	3.0	1.2
D5 Platform, architecture and security	2.1	Repeatable	3.0	0.9
D6 Design and engineering practice	1.9	Initial, approaching Repeatable	3.5	1.6
D7 Use-case delivery and value	1.4	Initial	3.0	1.6
D8 People, capability and culture	2.0	Repeatable	3.0	1.0

Worked example

Domain

D3 Risk, assurance and transparency (score 1.4, target 3.4)

Paragraphs

• Risk, assurance and transparency is at an early stage (1.4, Initial): practice depends on individuals, nobody owns the outcome and little is written down.
• Strengths. The organisation has the beginnings of two practices. IT project gates exist and every system passes them before release (Lifecycle and gates, 2.0), and a privacy impact assessment was completed for the recruitment platform in 2024 (Impact assessments, 1.5). The Australian chat assistant tells customers it is automated.
• Gaps. Incident and near-miss management (1.0, target 3): AI problems are logged as IT tickets and no near misses are recorded. To reach Level 3, Wattlegrove needs an AI incident definition, a severity scale and a runbook naming who may halt a system, a register of incidents and near misses, and one rehearsal. Risk tiering (1.0, target 3): no use case is tiered, so the candidate ranking feature, which affects job applicants, receives the same attention as a meeting summary tool. Impact assessments (1.5, target 3): the 2024 assessment predates the ranking feature and no AI method exists; Level 3 needs a standard method applied to every in-scope use before deployment. Transparency and contestability (1.5, target 3): there is no statement of AI use and no inventory of decisions about people, the EU chat assistant gives no notice, and the privacy policy does not explain automated decisions. Lifecycle and gates (2.0, target 3): the IT gates test nothing AI-specific; the chat assistant went live without an AI review.
• Evidence state. All five criteria were scored on evidence seen. The survey corroborates the gaps: 36 percent of staff know how to report an AI problem, 21 percent believe reported problems lead to change, and 41 percent do not know when they must tell a customer that AI was involved.
• Risk. Harmful or unfair outcomes from the candidate ranking could go unnoticed, could not be explained to an applicant, and would not be recognised as an AI incident. Wattlegrove is already outside the EU AI Act’s transparency obligation for its EU chat assistant, and has two months to meet the Privacy Act’s automated-decision disclosure. Repeated chat assistant errors are being fixed as tickets without anyone looking for the pattern.
• Initiatives: I-307 and I-308 (inventory, privacy policy, statement and review paths), I-310 (incident runbook), I-301 and I-302 (impact assessments), I-305 (tiering), I-303 (lifecycle and gates).

Second example

Domain

D5 Platform, architecture and security (score 2.1, target 3.0)

Paragraphs

• Platform, architecture and security is emerging (2.1, Repeatable): good practice exists in places, but it depends on people rather than standards and is not yet followed everywhere.
• Strengths. Assessed AI platform (3.0): Azure AI services run inside a landing zone assessed by an external party in 2025, with residency documented for each service. This is Wattlegrove’s only criterion at Level 3 and the reason sensitive work can safely move onto approved AI.
• Gaps. Third-party and embedded AI (1.5, target 3): contracts carry no AI clauses and the recruitment vendor switched on candidate ranking without a decision by Wattlegrove. AI security controls (2.0, target 3): content filters are on, but there is no AI threat model and the chat assistant has never been tested for prompt injection. Approved tools (2.0, target 3): Copilot is approved, but no list is published, and 41 percent of surveyed staff had used a tool they were unsure was approved; this survey result also caps the criterion at Level 3 until detection works. Observability, halt and rollback (2.0, target 3): uptime is monitored, behaviour is not, and no halt procedure is written down.
• Evidence state. All five criteria were scored on evidence seen.
• Risk. Customer and employee information may be reaching public AI tools; vendor model changes can alter the chat assistant’s behaviour without notice; and the SmartFlow feature, which adjusts irrigation schedules within limits, has no documented way to be halted if it misbehaves.
• Initiatives: I-503 (approved tool list), I-507 (procurement checklist and clauses), I-509 (threat model and testing), I-505 (logging and behaviour monitoring), then I-506 (halt rehearsal).

Worked example

Paragraphs

• 1. AI use is wider than anyone can see. Eight AI uses were found, five of which were on Wattlegrove’s list. The candidate ranking feature and meeting summaries arrived through vendor updates, and 41 percent of staff had used a tool they were not sure was approved. Until the register is complete, no other control can be applied consistently. (I-203, I-503, I-507)
• 2. AI is shaping decisions about people without designed oversight. The recruitment platform ranks candidates, recruiters are told to ‘use judgment’, nothing records what they review, and applicants are not told AI is involved. One third of staff say they sometimes rely on AI output without checking it. (I-307, I-308, I-605, I-302, I-404)
• 3. Obligations are arriving without owners. The EU AI Act’s literacy and transparency duties already apply to Wattlegrove as a provider in the EU, and the Privacy Act’s automated-decision disclosure starts on 10 December 2026. No one has been asked to meet them. (I-801, I-307, I-308)
• 4. A sound platform without the governance to use it. The assessed landing zone is Wattlegrove’s strongest asset, but there is no appetite, committee, tiering or lifecycle to decide what should run on it. The platform can safely carry far more than the organisation can currently govern. (I-102, I-103, I-202, I-303)

Worked example

Paragraphs

• Ten criteria rate High: risk appetite, the register, impact assessments, risk tiering, transparency, incident management, classification and handling, decision records, third-party AI and oversight design. Twenty rate Medium and ten Low. The three most material risks, with Wattlegrove’s own uses, and the three compliance exposures:

Table

Headers

• Risk
• Criteria
• Exposure

Rows

Because AI incidents are not defined or recorded, a pattern of wrong or harmful chat assistant answers, or a biased ranking of candidates, could continue for months without anyone recognising it, damaging customers and applicants and exposing Wattlegrove to complaints it cannot answer.	3.5 (1.0), 3.2 (1.0)	High
Because the candidate ranking is not assessed, overseen or recorded, an applicant who is unfairly screened out could not be given an explanation or a human review, creating discrimination and privacy exposure.	3.1 (1.5), 6.2 (1.5), 4.4 (1.0)	High
Because there is no published tool list or enforced ceiling, customer and employee information may already be in public AI tools used by 41 percent of staff, outside any contract or retention control.	5.3 (2.0), 4.3 (2.0)	High
EU AI Act transparency (Article 50) for the EU chat assistant: obligation has applied since 2 August 2026.	3.4 (1.5)	Compliance: overdue
EU AI Act AI literacy (Article 4): measures to support literacy expected since 2 February 2025; 34 percent of staff have done the optional module.	8.1 (2.0)	Compliance: overdue
Privacy Act automated-decision transparency: privacy policy must explain qualifying automated decisions from 10 December 2026.	3.4 (1.5)	Compliance: due in 62 days

Worked example

Paragraphs

• Leaders chose the Balanced ambition over 24 months: a defined practice (Level 3) in every domain, with Risk, assurance and transparency and Design and engineering practice lifted to 3.5 because AI contributes to recruitment decisions. Risk, assurance and transparency is held to 3.4 by the pace rule, which allows one level of improvement per year. Platform, architecture and security was set to 3.0 because no supervised autonomy is planned within 24 months. The overall gap is 1.4 levels.
• The ten biggest gaps by priority are: 3.5 Incident and near-miss management, 1.0 to 3 (priority 27), next I-310 in the first 90 days; 6.2 Autonomy and human oversight design, 1.5 to 4 (22.5), next I-605 in the first 90 days; 3.1 Impact assessments, 1.5 to 3 (20.25), next I-301 in the first 90 days; 1.2 Risk appetite and tiers, 1.0 to 3 (18), next I-102 in the first 90 days; 3.2 Risk tiering in practice, 1.0 to 3 (18), next I-102; 2.3 Use-case register, 1.5 to 3 (13.5), next I-203 in the first 90 days; 3.4 Transparency and contestability, 1.5 to 3 (13.5), next I-307 in the first 90 days; 5.4 Third-party and embedded AI, 1.5 to 3 (13.5), next I-507 in months 3 to 6; 4.3 Classification and handling, 2.0 to 3 (13.5), next I-406 in the first 90 days; 6.3 Testing, evaluation and simulation, 2.0 to 4 (12), next I-603 in months 6 to 12.
• All twelve first-horizon initiatives are must-dos or quick wins. The AI Strategy and Roadmap sets out the full plan.

Worked example

Paragraphs

• Purpose. Wattlegrove uses AI to help farmers and councils use water well, to serve customers faster and to free our people for the work only they can do, with a named person accountable for every use.
• Vision. By October 2028, Wattlegrove will know every AI system it uses and who owns it; will assess and gate every use before it goes live, in proportion to its risk; will tell customers and applicants when AI is involved and give them a human to talk to; and will measure what each AI investment delivers.
• Ambition. A defined practice in every domain within 24 months, with oversight and testing of AI that affects people at Level 4. In this period AI may assist and draft (rungs 1 and 2). The SmartFlow feature continues to act within its fixed limits under the product’s existing safety design, but no new AI will act without per-action approval until halt and rollback have been rehearsed.
• Boundaries. Wattlegrove will not use AI to make hiring, discipline or credit decisions without a person deciding; will not put customer, employee or commercial-in-confidence information into tools not approved for it; and will not deploy AI to EU customers without the notices EU law requires.

Worked example

Paragraphs

• A named person answers for every use. AI never owns a decision; an accountable owner does. (Accountability.)
• Proportionate to risk. Light rules for assistants, full assurance for AI that affects people. (Wellbeing; reliability and safety.)
• Tell people when AI is involved, and give them a person. Customers, applicants and staff know when AI contributed and can ask a human to review it. (Transparency and explainability; contestability.)
• Understand the impact before go-live. No AI that affects people goes live without an impact assessment. This principle answers our weakest responsible AI dimension. (Fairness; human-centred values.)
• Approved tools, within their limits. Use the tools on the list, and only with the information each is approved for. (Privacy protection and security.)
• Evidence over assertion. We report what we can show, and we measure what AI delivers. (Accountability.)

Worked example

Paragraphs

• 1. Meet the obligations now due. EU AI Act literacy and transparency, and Privacy Act automated-decision disclosure. Workstreams: Governance and assurance; People and adoption. Measures: EU notice live on the chat assistant within 30 days; privacy policy updated before 10 December 2026.
• 2. Build the foundations. Appetite and tiers, a Chief AI Officer with authority, a committee that decides, a complete register and a short acceptable-use policy. Workstreams: Strategy and leadership; Operating model; Governance and assurance. Measures: all eight AI uses with an owner and a tier within six months; committee decision log in use.
• 3. Govern AI that affects people. Impact assessment, oversight design and decision records for the recruitment ranking first, then for any future people-affecting use. Workstreams: Governance and assurance; Engineering practice; Data and knowledge. Measures: ranking feature assessed and its review recorded within six months; zero people-affecting uses without an assessment.
• 4. Give staff approved tools and the skills to use them well. Workstreams: Platform and security; People and adoption. Measures: staff unsure whether a tool was approved below 15 percent at the next survey; training completion above 80 percent.
• 5. Make value measurable. Charters for pilots, an intake and a benefits register. Workstream: Use-case portfolio and value. Measures: every pilot with a decision date; every funded use case with a baseline.

Worked example

Paragraphs

• Strategic: the board’s Risk and Audit Committee oversees AI risk; the executive committee owns the strategy, appetite and investment; the Chief Operating Officer is executive sponsor. Governance: an AI governance committee chaired by the Chief AI Officer (the CTO, with a written delegation) replaces the informal working group. Operational: a named owner for each AI use, supported by a three-person AI centre of excellence. System: IT runs the platform and logging; the security lead owns AI controls and the tool list; legal and privacy own assessments and disclosure; records management owns retention.
• The full model is in the Governance and Operating Model recommendations.

Worked example

Paragraphs

• Forty-six initiatives were selected across the eight workstreams: twelve start in the first 90 days, ten in months 3 to 6, thirteen in months 6 to 12 and ten in months 12 to 24. One (I-606, enforcing autonomy in the platform) falls beyond 24 months because it depends on halt and rollback being rehearsed first.
• Governance and assurance (10 initiatives) carries the must-dos and most foundations: I-307 and I-308 (transparency and the privacy policy), I-310 (incident runbook), I-203 (register and discovery), I-301 and I-302 (impact assessment), I-202 (committee), I-305 (tiering), I-303 (lifecycle and gates). Start with the register; avoid a committee that never refuses anything.

Table

Headers

• Workstream
• Initiatives (horizon)

Rows

Strategy and leadership	I-102 (H1), I-103 (H1), I-101 (H2), I-105 (H3), I-104 (H4)
Governance and assurance	I-307 (H1), I-308 (H1), I-310 (H1), I-203 (H1), I-301 (H1), I-202 (H1), I-302 (H2), I-305 (H2), I-205 (H3), I-303 (H3)
Operating model	I-201 (H2), I-209 (H2), I-207 (H2)
Use-case portfolio and value	I-701 (H3), I-702 (H3), I-706 (H4), I-710 (H4), I-704 (H4), I-708 (H4)
Data and knowledge	I-406 (H1), I-404 (H3), I-408 (H3), I-403 (H4), I-401 (H4)
Platform and security	I-503 (H1), I-507 (H2), I-509 (H3), I-505 (H3), I-506 (H4)
Engineering practice	I-605 (H1), I-609 (H2), I-603 (H3), I-601 (H3), I-607 (H4), I-604 (H4); I-606 beyond 24 months
People and adoption	I-801 (H1), I-803 (H2), I-809 (H2), I-805 (H3), I-807 (H3)

Worked example

Paragraphs

• The roadmap puts obligations and foundations first, fits quick wins into the first 90 days, respects dependencies and keeps each horizon within the capacity leaders funded.
• Mobilise (0 to 90 days). Twelve initiatives using 18 of 18 capacity points: the three must-dos (I-307, I-308, I-801), then appetite and tiers (I-102), the incident runbook (I-310), the register and discovery sweep (I-203), the impact assessment method (I-301), tool ceilings (I-406), the Chief AI Officer’s authority (I-103), the committee (I-202), the approved tool list (I-503) and autonomy rules for each system (I-605). The two EU obligations are already overdue and are flagged as such.
• Establish (3 to 6 months). Ten initiatives using 18 of 18 points: owners for every use (I-201), the acceptable-use policy (I-803), the strategy (I-101), impact assessments for every in-scope use (I-302), the centre of excellence (I-209), procurement clauses (I-507), the RACI (I-207), independent tiering (I-305), design review (I-609) and the concern channel (I-809).
• Embed (6 to 12 months). Thirteen initiatives using 29 of 30 points, including intake (I-701), decision records (I-404), the executive review (I-105), the assurance map (I-205), pilot charters (I-702), the AI threat model (I-509), evaluation suites (I-603), logging and behaviour monitoring (I-505), champions (I-807) and the lifecycle and gates (I-303).
• Scale (12 to 24 months). Ten initiatives using 31 of 40 points, including the reference use case governed end to end (I-710), automated evaluation (I-604), the benefits register (I-704), data quality baselines (I-401) and halt and rollback rehearsal (I-506).

Worked example

Paragraphs

• The roadmap needs 96 effort points over 24 months: 22 small, 22 medium and one large initiative, about 97 to 158 person-months of effort excluding licences and platform costs. That is more than Wattlegrove could absorb from existing roles, which is why leaders funded a dedicated uplift team (an AI lead, two analysts and partner support) for 24 months and set capacity above the mid-size default.
• The largest single item is the reference use case (I-710), 6 to 9 months of work by the recruitment owner, HR systems and the centre of excellence. Business owners must free time to own their uses and present at gates; legal and privacy carry an early peak in the first 90 days.

Worked example

Table

Headers

• Measure
• Baseline (October 2026)
• Target

Rows

Overall maturity	1.7	3.0 or more by October 2028
AI uses on the register with owner and tier	5 of 8 (owner); 0 tiered	100 percent by April 2027
In-scope uses with a current impact assessment	0	100 percent by October 2027
Staff who have completed AI training	34 percent	80 percent by April 2027; 95 percent by October 2028
Staff unsure whether an AI tool they used was approved	41 percent	Below 15 percent at the October 2027 survey
Staff who know how to report an AI problem	36 percent	70 percent at the October 2027 survey
Near misses reported per quarter	0	Rising during 2027, then stable
Funded AI use cases with a benefit baseline	1 of 5	100 percent by October 2027

Paragraphs

• A rising count of reported near misses in 2027 will mean the reporting culture is working, not that AI has become less safe.

Worked example

Table

Headers

• Risk
• Mitigation
• Owner

Rows

The EU obligations are already overdue and the Privacy Act date is 62 days away.	Treat I-307, I-308 and I-801 as must-dos with weekly reporting to the executive sponsor until complete; put the EU chat notice live first.	Executive sponsor
The uplift team is funded but not yet recruited.	Use partner support for the first 90 days; recruit the AI lead before month 3.	Chief AI Officer
Owners named but not engaged, so the centre of excellence ends up owning use cases.	Owners present their own gate submissions; ownership written into position descriptions in year 2.	Executive sponsor
Longest dependency chain: register, then owners, then impact assessments, then the lifecycle and the reference use case.	Start the register in week 1; do not let the sweep exceed 10 weeks.	AI lead
A committee that discusses but never decides.	Terms of reference with decision rights from the first meeting; decision log reported quarterly.	Chief AI Officer

Worked example

Paragraphs

• Monthly, the AI governance committee reviews initiative status, blockers and decisions needed. Quarterly, the executive committee checks progress against planned uplift, reviews the dashboard and confirms and funds the next horizon. In April 2027 the centre of excellence re-scores the criteria targeted so far and re-runs four survey items; in October 2027 a full re-assessment sets the new baseline.
• The Chief AI Officer convenes a realignment review within 30 days if a domain achieves less than half its planned uplift at two consecutive quarterly checks, if any domain falls by half a level, if an obligation changes, after a serious AI incident, if Wattlegrove starts using AI that acts without per-action approval or makes decisions about people in a new area, or if a domain reaches its target three months early.

Worked example

Table

Headers

• Weeks
• Initiative
• Owner

Rows

1 to 2	EU chat notice live (part of I-308); I-103 Chief AI Officer’s written authority	Head of Customer Service; Board
1 to 6	I-307 Inventory of decisions about people and privacy policy update	Legal and privacy lead
1 to 10	I-203 Register and discovery sweep	AI lead
1 to 12	I-801 Mandatory foundational AI training	People and capability
2 to 4	I-202 AI governance committee (first meeting by week 4)	Executive sponsor
2 to 6	I-102 Risk appetite and tier criteria	Executive sponsor
3 to 6	I-503 Approved tool list; I-406 Tool ceilings	Security lead
3 to 8	I-310 Incident runbook, register and rehearsal	Security lead
5 to 10	I-301 Impact assessment method and intake screening	Legal and privacy lead
6 to 12	I-605 Autonomy and approval rules, starting with the candidate ranking	Recruitment owner
6 to 13	I-308 Transparency statement and human review paths	Legal and privacy lead
13	Executive review of the first 90 days	Executive committee

Paragraphs

• Decisions needed now: endorse the targets, fund the uplift team, sign the Chief AI Officer’s delegation and name the members of the AI governance committee.

Worked example

Table

Headers

• Role
• Accountabilities
• Today

Rows

Board Risk and Audit Committee	Oversees AI risk; receives an AI report twice a year.	Change: AI not yet on its agenda
Executive sponsor (Chief Operating Officer)	Owns AI outcomes for the executive; chairs the quarterly executive AI review.	New
Chief AI Officer (CTO, with written delegation)	Runs the register, lifecycle and tool list; chairs the committee; can pause any AI use.	Change: named by email, no authority
AI governance committee	Decides use cases, tiers, gates, approved tools and exceptions.	New: replaces the working group
AI centre of excellence (three people)	Runs intake, register and lifecycle; supports owners; reports the dashboard.	New
Use-case owners	Answer for each AI use; present gate submissions; attest annually.	Change: five of eight named informally, none acknowledged
Security lead	AI controls, threat model, tool ceilings, incident runbook.	Change
Legal and privacy	Impact assessment review, automated-decision disclosure, review paths, EU obligations.	Change
Records manager	Retention of AI content; legal holds.	Change
Internal audit	Independent assurance of AI governance from 2027.	Change
Champions	Help colleagues and feed back problems; two hours a week.	Change: six informal champions

Paragraphs

• Wattlegrove’s model is deliberately small: a three-person enabling team under the CTO and a monthly committee, growing only if the portfolio grows.

Worked example

Table

Headers

• Forum
• Chair
• Cadence
• Decides
• Escalates to

Rows

Board Risk and Audit Committee	Committee chair	Twice a year on AI	Oversight of AI risk and appetite	Board
Executive committee AI review	Executive sponsor	Quarterly	Strategy, appetite, investment, out-of-appetite uses	Board
AI governance committee	Chief AI Officer	Monthly, with out-of-cycle gate decisions	Use cases, tiers, gates, approved tools, exceptions within appetite	Executive committee
Intake triage	AI centre of excellence lead	Weekly	Standard decisions under delegation; routing	AI governance committee

Paragraphs

• The AI working group is retired once the committee has met three times; its members join the committee or the champion network.

Worked example

Table

Headers

• Decision
• Accountable
• Responsible
• Consulted

Rows

Set AI strategy and risk appetite	Executive committee	Chief AI Officer	Committee, security, privacy and legal
Approve a use case and its tier	AI governance committee	Use-case owner	Security, privacy and legal, centre of excellence
Decide at a gate	AI governance committee	Use-case owner	Security, privacy and legal
Approve an AI tool or model	AI governance committee	Security lead	IT, privacy and legal
Pause or stop an AI use	Chief AI Officer	IT	Use-case owner
Respond to an AI incident	Use-case owner	Security lead	Privacy and legal, Chief AI Officer
Publish the transparency statement	Chief AI Officer	Legal and privacy	Owners

Paragraphs

• Worked example: the recruitment vendor switches on a new AI feature. Platform and tool decision: the vendor must disclose it under the new contract clause; security assesses it; the committee decides at its next meeting whether and how it may be used; the register is updated.
• Worked example: a team wants Copilot to summarise customer complaints. Standard decision: registered under the Copilot entry by the centre of excellence within days, within the tool’s ceiling; no committee decision needed.

Worked example

Table

Headers

• Tier
• Indicative criteria
• Gates

Rows

Low	Assistive; no decisions about people; information within the tool’s ceiling; easily reversed	G3 and G5; register entry; standard monitoring
Medium	Drafts or analysis a person approves; customer-facing; moderate sensitivity	G1, G3, G4 and G5; evaluation suite; quality sampling
High	Contributes to decisions about people (for example recruitment); acts within bounds on physical systems; sensitive information	All five gates; decision records; human review path; executive sign-off

Paragraphs

• At Wattlegrove the candidate ranking and the SmartFlow scheduling feature are high tier; the chat assistant and forecasting model are medium; Copilot and the coding assistant are low. The candidate ranking goes through the full lifecycle first, as the reference use case.

Worked example

Table

Headers

• Line
• Who
• What they do for AI
• Evidence

Rows

First	Use-case owners, IT	Operate controls: assessments, approvals, logging, halt	Gate records, approval logs, monitoring
Second	Security, privacy and legal, risk	Set standards and test that first-line controls operate	Quarterly control tests, assessment quality samples
Third	Internal audit	Independent assurance of the whole model	First AI audit in the third quarter of 2027

Paragraphs

• The committee watches five health measures monthly: register coverage, assessments current, gate decisions recorded before go-live, incidents and near misses reported, and training completion.

Worked example

Paragraphs

• 1. Sign the Chief AI Officer’s delegation, including authority to pause any AI use (I-103).
• 2. Establish the AI governance committee with the terms of reference attached and retire the working group (I-202).
• 3. Fund the three-person AI centre of excellence (I-209).
• 4. Endorse the risk appetite and tier criteria (I-102) and the lifecycle and gates (I-303).
• 5. Ask the Board Risk and Audit Committee to add AI to its agenda twice a year and to the internal audit plan (I-205).
• At Level 4 the model grows into approval routing built into tools, a dashboard generated from the register and monitoring, and an internal audit of AI each year.