Governing Intelligence · Part III. Putting it to work
14Recommendations and next steps
This framework is designed to be adopted, not admired. The steps below convert it into action, and they align with the policy’s phased 2026 deadlines. None is large; together they establish governed AI across the agency.
14.1The decisions required now
- Adopt this framework as the agency’s AI governance and assurance framework, and have the accountable authority endorse it.
- Designate the accountable official for AI strategy, confirm the Chief AI Officer appointment, and notify the DTA of the designations.
- Establish the AI Governance Committee with the terms of reference at Appendix C.
- Adopt the risk-tiering approach, the assurance lifecycle and the readiness gates.
- Open the use-case register, run the discovery sweep of Section 13.2, and bring the agency’s first priority use case to the committee as its first entry.
14.2A ninety-day mobilisation
| Weeks | Focus | Outcome |
|---|---|---|
| 1 to 3 | Decide and appoint | Framework adopted; accountable official and CAIO confirmed and notified; committee stood up. |
| 4 to 8 | Stand up the machinery | Register open and discovery sweep run; risk tiers and gates adopted; first impact assessment underway; secure enclave designed. |
| 9 to 13 | Prove it on a first use case | The agency’s first priority use case governed from intake through design assurance; transparency approach set; roadmap endorsed. |
14.3How Renly can help
Renly is a governed AI runtime built on the ideas in this framework, and it helps an agency put them into practice. Start with the free Governing Intelligence assessment, which places the agency against the five domains and produces a tailored strategy and roadmap. In operation, Renly gives agents and automations runtime controls of the kind Sections 8 to 10 describe: per-agent action rules that let an action go ahead, wait for a person, or never happen; approvals that are single-use, expire, and are bound to what the person reviewed; an Evidence Passport for each response, sealed into a per-organisation hash chain so tampering is detectable; and one-click halts for automations and computer use. On Enterprise, the AI Use Register gives each use a risk tier, a lifecycle and recorded gate decisions. The Renly Academy carries the baseline AI literacy every staff member needs. We would be glad to walk an agency through the ninety-day mobilisation together.
“Governed AI is not autonomy restrained; it is autonomy an agency can stand behind, prove, and answer for.”
The Governed Intelligence Model
Facts checked against official sources on 7 October 2026. Confirm obligations against the source instruments, which can change. This framework is not legal advice.