Domain 04

AI

AI inventory, risk classification, AI policies, AI agents and human/non-human accountability.

What AI means in practice

AI usage is growing faster than policy and oversight can keep up. AI governance brings the same ownership/controls/evidence model to AI applications and agents.

AI inventory & risk classification

An up-to-date inventory of which AI applications and agents exist, and the risk level attached to each.

AI policy & agents

Clear rules for using AI tools, and for what AI agents may and may not do autonomously.

Human/non-human accountability

A responsible human for every AI agent, just as for every employee.

Recognise this?

A recognisable pattern: employees adopt AI tools without IT having visibility or policy in place, and no one has defined who's accountable when an AI agent acts autonomously.

See AI adoption in Use Cases & Outcomes for how this is addressed in practice.

Starting point

One domain, the same operating model.

AI doesn't stand alone — it shares ownership, controls and evidence with the other domains. See how the 90-day approach makes that concrete.

See the 90-day approach→