Enter once, for the organisation as a whole. Go as deep as your organisation letter, and implement in your mode.
Why it exists
Measure the governance, or accept that it is a belief system. Every dimension in this domain produces things that can be counted — systems without owners, tools discovered outside the register, findings left open, incidents, suppliers assessed or not — and if you do not count them, you will discover their state the way organisations always do: during the incident. Build the indicators, and build the path that carries them upward to the level that can act on them.
What to actually do
Track indicators that demand an action, not indicators that decorate a slide. Choose measures whose movement tells someone to do something specific: the number of AI systems without a named owner (each one is an accountability gap to close); tools discovered in use but absent from the register (each one enters the intake process); critical security findings open past their deadline; AI incidents and their resolution; suppliers overdue for assessment; systems whose behaviour has drifted from what was validated. A raw count of “AI projects under way” tells no one to do anything; retire measures like it.
Treat regulatory compliance as a live, measured indicator — not an annual checkbox. Report, on every cycle, the organisation’s standing against the AI rules that apply to it in every jurisdiction where it operates: what applies, what is met, what is open, and who owns each gap. The rules and the threat landscape both move faster than a yearly review; an annual compliance exercise certifies the past, not the present.
Publish outward transparency where your use of AI warrants it. Beyond telling individuals when they are dealing with AI (already mandated in Strategy and Direction), maintain — where you are regulated or public-facing — a standing account of what AI you use, for what purposes, and under what oversight. Expectations of this kind are hardening into obligations in several jurisdictions; publishing on your own terms, before you are compelled to, is both cheaper and more credible.
Carry the reporting upward through named bodies, at proportionate depth. Route the indicators from the AI committee to the risk function to the board, with each level receiving the depth it needs: the committee sees every measure, the risk function sees the trends and the exceptions, the board sees the exposures that could hurt the organisation and the decisions only it can take. Reporting that stops at the committee governs the committee; the point is to reach the level that owns the consequence.
Controls
Baseline1 controls
Control 55
Verify, on a standing basis, that every AI system has an owner.
BaselineDetectiveall rolesthe whole organisation
What it is
The simplest and most revealing single check in this domain; exceptions are risks, not paperwork.
How to implement it · Steps
Hold a named owner (a person, not a team) for every AI system in the inventory
Check at least monthly, or every committee cycle, for blank owners and owners who have left or moved
Cross-check owners against the leavers and movers list from HR
Log each ownerless system as a risk, assign a new owner within a set deadline, and escalate if missed
Report the count of ownerless systems to the committee
How to start
Go through the inventory today, list every system whose owner is blank or has left, and assign each one.
Evidence
Dated check records showing ownerless systems found and when each was assigned.
Mode: light / standard / full
light
The owner-manager reviews the inventory spreadsheet each month and assigns owners directly.
standard
The AI lead runs the check with HR data and reports exceptions to the committee.
full
An automated check compares the inventory with the staff directory and opens a ticket for each gap.
Enhanced4 controls
Control 56
Define and operate the AI indicator set.
EnhancedDetectiveall rolesthe whole organisation
What it is
Actionable measures, each with a named owner and a defined response when it moves.
How to implement it · Minimum structure
Starter set: systems without owner; tools found outside the register; critical security findings past deadline; AI incidents open and resolved; suppliers overdue for assessment; systems drifted from validated behaviour
Per indicator: definition, data source, owner, frequency
Per indicator: threshold and the response required when it is crossed
Retire counts that prompt no action, such as the number of AI projects under way
Review the set once a year
How to start
Define the six starter indicators on one page, each with owner and threshold, and produce the first values by hand.
Evidence
The indicator definitions and the dated values, with the responses taken when thresholds were crossed.
Mode: light / standard / full
light
The AI lead tracks three or four of the indicators in a spreadsheet each month.
standard
The governance function maintains the full set in a shared dashboard fed partly by hand.
full
A dedicated function operates the set with owners across security, procurement and risk, and reviews thresholds annually.
Control 57
Report to the governance bodies on a fixed cycle.
EnhancedDetectiveall rolesthe whole organisation
What it is
Committee, risk function, and board each receive their level of the picture, on schedule.
How to implement it · Minimum structure
Calendar fixed a year ahead: e.g. committee monthly or quarterly, risk function quarterly, board at least twice a year
Committee pack: every indicator, open items, decisions needed
Risk function pack: trends, exceptions, risks above appetite
Board pack: exposures that could harm the organisation and decisions only the board can take
Minutes record decisions, owners and deadlines
How to start
Set the reporting calendar for the next twelve months and send the first committee pack.
Evidence
The reporting calendar, and the packs and minutes for each cycle.
Mode: light / standard / full
light
Where there is no separate risk function or board, the AI lead reports to management on the fixed dates.
standard
The governance function prepares the three packs from one data set on the calendar.
full
A secretariat runs the cycle; packs are generated from the indicator set and board reporting is tracked for follow-up.
Control 58
Report regulatory standing as a continuous indicator.
EnhancedDetectiveall rolesthe whole organisation
What it is
Applicable rules, current status, open gaps, and gap owners — every cycle, not every year.
How to implement it · Minimum content
Rule: each AI, data-protection and sector rule that applies, per jurisdiction where you operate
Requirement: the specific obligation and the systems it affects
Status: met, partly met or open, with a pointer to the evidence
Gap owner and deadline for each open item
Changes since last cycle: new rules, guidance, dates of entry into force
Cycle summary for the committee pack: counts met and open, overdue gaps
How to start
Build a register of the rules that apply to your AI use, with status and owner, and put its summary in the next committee pack.
Evidence
The regulatory register and its summary in every cycle's report.
Mode: light / standard / full
light
A named person keeps the register in a spreadsheet, with an external adviser checking it once a year.
standard
Legal or compliance maintains it and updates status each cycle.
full
The compliance function runs it with regulatory-change monitoring and links each gap to the risk register.
Control 59
Publish external transparency reporting where your exposure warrants it.
EnhancedPreventiveall rolesthe whole organisation
What it is
On your own initiative, in the form your regulators and public expect.
How to implement it · Minimum structure
Decision whether it is warranted: regulated activity, public-facing services, or AI used in decisions about people
What AI the organisation uses and for what purposes
Oversight: where humans review, and how people can ask questions or contest an outcome
Summary of the data the AI uses
Contact point; update on material change and at least annually
How to start
Decide and record whether your exposure warrants it; if so, draft one web page on your AI uses, purposes and oversight and have management approve it.
Evidence
The published statement with date and approval, or the recorded decision that it is not warranted.
Mode: light / standard / full
light
A short page on the website, written and approved by the owner-manager.
standard
Communications and legal draft it from the inventory and the committee approves it.
full
A maintained transparency report generated from the inventory, reviewed by legal and approved at senior level.
Advanced1 controls
Control 60
Automate the oversight and extend it to board level.
AdvancedDetectiveall rolesthe whole organisation
What it is
Indicators generated from the systems themselves rather than assembled by hand, with board reporting as a standing item.
Refresh at least weekly; crossing a threshold alerts the indicator owner
Flag missing or stale data feeds instead of showing old values
Keep the history of indicator values for trend and audit
AI oversight as a standing board agenda item, with the pack drawn from the same data
How to start
Pick the indicator most often assembled by hand and connect it directly to its source system.
Evidence
The automated dashboard with its data sources, and board agendas showing the standing item.
Mode: light / standard / full
light
A spreadsheet fed by scheduled exports from the inventory and ticketing system, with AI as a fixed item at management meetings.
standard
The governance function automates the main indicators and reports to the board on a fixed agenda slot.
full
A data team runs automated pipelines and alerting, with board reporting generated from the dashboard every cycle.
Evidence
The indicator definitions and dashboards; owner-coverage checks; committee, risk, and board packs; the regulatory-standing reports; published transparency material; the incident log.