Anonymous assessment

We maintain an inventory of material AI use cases, systems and accountable owners.

Each material AI use has a documented purpose, users and intended business outcome.

AI uses are classified by consequence, autonomy and data sensitivity.

Higher-risk AI uses require stronger approval, testing and oversight.

Data used by AI has documented sources, permissions and confidentiality/privacy restrictions.

We control whether sensitive organisational data may be sent to external AI providers.

Material AI is evaluated against task-specific quality and failure criteria before deployment.

We retain evidence of evaluations and known limitations for consequential AI uses.

Consequential AI-supported decisions have explicit human review and escalation rules.

People responsible for oversight have sufficient information and authority to challenge or stop the AI-enabled process.

AI agents/tools use least privilege and deterministic authorisation for protected actions.

High-impact actions such as payment, deletion, publication or contractual commitment require appropriate approval.

We assess material AI/model providers for security, data handling, resilience and contractual dependency.

We understand material provider/model concentration and have proportionate exit or continuity plans.

Material changes to models, prompts, tools or workflows are versioned and retested.

We can identify which material AI configuration/version was operating when an important decision or incident occurred.

AI failures, misuse, complaints and unexpected behaviour have an incident and escalation process.

Material AI incidents generate corrective actions and lessons that feed back into governance.

AI use cases are periodically reviewed for realised value, cost, risk and continued justification.

We can retire or disable AI capabilities that no longer meet business, risk or performance requirements.