2. Operating model

A. Select Evolving only if all criteria for that level are fully met; otherwise, choose Foundational

A. Initial steps underway to establish formal governance for implementing AI responsibly (e.g., AI governance committee)

AND
B. Some oversight and decision-making processes are embedded into select projects or departments

AND
C. Basic accountability mechanisms (e.g., accountability within teams) are starting to be introduced

A. Depending on the organisation's structure, include AI governance by amending existing governance forums or establishing a dedicated AI governance forum

AND
C. Essential accountability mechanisms (e.g., reporting of concerns) are established, with scope for improvement

AND
B. Clear oversight and decision-making embedded across different processes, projects and departments with input from leadership in alignment with org's goals

AND
C. Accountability mechanisms (e.g., performance reviews, KPI and OKR tracking) ensure transparency and responsibility for all stakeholders, with regular reviews and updates

A. Initial thinking has started around managing AI risks with preliminary definition of KRIs and integration with existing frameworks

A. Initial steps have been taken to build processes to manage AI risks, with some integration of KRIs and existing frameworks

AND
B. Processes are progressively being tailored to adapt to varying levels of risk severity and use case prioritisation considers relevant dimensions (incl. risk)

AND
C. AI risks categorisation has begun, but the risk taxonomy and risk profiles are still evolving

A. Processes in place for managing and adapting to varying levels of AI risks, heavily leveraging KRIs and existing frameworks

AND
B. Risk-based prioritisation is applied to most AI use cases (where necessary)

AND
C. Refined risk profiles tailored to risk appetite and risks are identified across a defined risk taxonomy with cross-team collaboration

A. Use of tools (e.g., workflow tools) to automate processes, as required, for identifying and managing AI risks and assessing their impact

AND
B. Risk-based use case evaluation framework prioritises business value while managing risks, ensuring AI risk management is closely aligned with the company's overall risk management strategies

A. Basic and essential roles and responsibilities have been defined, driven by individuals who see the importance of RAI

A. Specific roles (e.g., RAI champions, ethics officers, and RAI experts) are in-place in some pilot areas and starting to be operational

A. Most roles and responsibilities for managing RAI are operational within their respective functions (e.g., RAI champions established in a complete business function) and actively contributing to RAI initiatives

Optional
B. As required, create a centralised data and AI team, with dedicated cross-functional resources and a well-defined scope within the organisation

A. Roles and responsibilities are defined (e.g, through a RACI matrix / org chart) and integrated into the org structure, ensuring that ownership is shared across the org.

Optional
B. Highly effective centralised data and AI team in place managing and developing RAI talent, staffing RAI talent to teams, ensuring resources available, and coordinating between departments

A. Early stages of identifying the necessary skills for RAI and current skill gap

A. Established criteria for identifying and recruiting/upskilling individuals with the necessary skills

A. Effective process in place for identifying and recruiting/upskilling top talent with advanced technical skills, strong ethical awareness, and a deep commitment to RAI

AND
B. Growing pool of qualified candidates with RAI competencies (e.g., collaborating/partnering with PhD candidates, academia, start-ups)

A. Select Evolving only if all criteria for that level are fully met; otherwise, choose Foundational

A. AI development process varies across teams and is in the early stages of incorporating standard practices (e.g., documentation, customer testing, participatory design, and the "RAI by design" approach)

A. AI development process is increasing in structure and consistency, with more teams following established practices (e.g., documentation, customer testing, participatory design, and the "RAI by design" approach)

A. AI development process is systematic, repeatable and fully integrated into workflows with practices consistently adopted by all applicable teams (e.g., documentation, customer testing, participatory design, and the "RAI by design" approach)

A. Established basic registry/registries for documenting and tracking details of applicable AI use cases (incl. data, value, scope, costs, risks), but little sophistication and adoption (e.g., tracking in excel)

A. Applicable AI use cases are being tracked in silos through the use case registry/registries, with the organisation exploring tooling solutions for AI governance

A. AI governance platform established (through buy or build), but with limited functionality and AI use case registry/registries yet to be fully integrated into the platform

A. AI governance platform deployed enterprise-wide with uptake from all applicable teams (platform functionality includes workflow management, AI use case registry/registries, regulatory compliance management etc.)