1. Vision

A. RAI principles have been documented and published

A. Initial efforts to communicate RAI principles have been made

AND
B. RAI principles are being adopted, with few departments / employees trying to integrate them into their work

A. RAI principles are well-communicated across the org. through optional trainings / workshops

AND
B. Integration of RAI principles into daily operations is underway (as required based on use cases), with departments beginning to align their activities accordingly

A. Principles are reinforced through mandatory trainings and leadership role modelling

AND
B. RAI practices aligned with RAI principles are embedded in the org. culture and consistently applied in all applicable operations

AND
C. Regular assessments and updates of RAI principles are conducted in line with the established visions

A. Recognition from leadership on the importance of RAI, laying the foundation for future executive sponsorship

A. Steps taken to engage key stakeholders and executive sponsors in RAI discussions with sporadic communication and occasional meetings

A. Strong alignment and active support from key stakeholders and executive sponsors with continuous, transparent communication and collaboration

AND
B. Executive sponsors champion RAI initiatives, driving them forward by allocating adequate resources and budget as needed, integrating RAI principles into the org’s strategic priorities and regularly communicating vision

A. Initial awareness of AI risks with preliminary approach to manage these risks

AND
B. In the early stages of understanding the risk appetite

A. Efforts to develop a structured strategy to manage AI risks have begun

AND
B. Started to define risk appetite, laying the groundwork for full implementation

A. Risk strategy established and in the process of being integrated into all functions across the organisation

AND
B. Risk appetite outlines the types and levels of risk the organisation is willing to accept, though not fully embedded across all levels of the organisation

A. Mature risk strategy aligned with the organisation’s strategic goals, leveraging KRIs and existing frameworks effectively

AND
B. Risk appetite is regularly reviewed and updated to reflect changes in the business environment and technological advancements

A. Basic awareness of applicable legal and regulatory requirements

AND
B. Compliance efforts are reactive and ad-hoc

A. Recognise the importance of legal regulations (local and global) with initial steps taken to identify relevant laws and standards

AND
B. Compliance processes are still developing with a dedicated team or role that monitors relevant laws, regulations, and industry standards

A. Well developed framework for ensuring alignment with all relevant legal and regulatory requirements

AND
B. Addressed interoperability between local regulations and broader regulations as required (e.g., industry-specific)

A. Stays ahead of regulatory changes and local/global policies through continuous monitoring, engagement with legal experts and external reviews

AND
B. Open dialogue and strong relationship with regulators and authorities (as applicable)