Scale What You Do to Who You Are and What You Are Doing

Why it exists

Apply each obligation at the depth your situation demands, no more and no less — because a framework applied uniformly is wrong for almost everyone. Held to the same standard, the demands that are prudent for a bank training its own model would crush a small firm buying a subscription, and the light touch appropriate for that small firm would be reckless for the bank. Proportionality is what makes one framework fit both. It is not a discount or a licence to skip; it is the deliberate calibration of every requirement to the factors that actually determine risk.

What determines your level

Three questions decide what applies to you, and they are independent of one another. Relevance — which controls concern you at all — is decided by your role with respect to each system (consumer, deployer, developer; roles add up), fixed by the sourcing decision of Domain 1, and by the properties of each use: whether it decides about people, whether the AI acts, whether it processes personal data. Depth — the tier at which each relevant control applies — is decided by the criticality of the use and the rules that bind you: the class of each use (minimal or limited → Baseline; high-risk → Advanced), its criticality (low → Baseline; medium → Enhanced; high → Advanced), and the rules you operate under (general data-protection law only → Baseline; sector regulation, or deployer obligations under an AI-specific regime → Enhanced; provider obligations for high-risk or general-purpose AI → Advanced), read from the applicability map. For each system, the depth is the strongest of those three; for organisation-scoped obligations — the committee, the security programme, the responsibility matrix, the indicator set — it is set by the rules that bind you. A consequential use therefore raises the obligations attached to that system to the top, but does not by itself oblige a small organisation to constitute a committee at Advanced. Your role does not raise the depth: building a low-stakes internal classifier does not put you at Advanced, and using a purchased tool to shortlist job applicants puts that system at Advanced although you built nothing. Mode — how you meet each applicable control — is decided by your size and capacity: light (micro and small), standard (medium), full (large), as the table below defines for the obligations most often made applicable to small organisations. Size never removes a control. Your current maturity decides only the sequence: the gap between the applicable controls and those already evidenced is your plan, and the first-stage scope of “Where to start” is its head. In short: role determines relevance, criticality determines depth, and size determines the mode of implementation.

Light mode for obligations a consequential use raises on a small organisation

What to actually do

• Determine your profile, and let it decide what applies and how deep. Establish your role, the properties, class and criticality of each use, the rules that bind you, your size, and your maturity. Your role and the properties of your uses decide which obligations are relevant; the criticality of each use and your rules decide the tier at which each applies; your size decides only how you meet them. The rules are explicit and reproducible — two organisations with the same profile land on the same obligations — but the inputs are judgements: record how you classified each use and why a rule does or does not apply, so the reading can be reviewed.
• Never let ‘small’ become an excuse to skip the Baseline. Proportionality scales how you meet an obligation and how far you extend it; it never removes the Baseline, which every organisation running AI meets regardless of size. A small organisation does less than a large one — but not less than the floor.
• Re-derive the profile when your situation changes. A change of role — beginning to fine-tune a model, entering a regulated use — or a change in the rules that apply to you moves your profile and therefore your obligations. Re-read the profile on those events, so the framework tracks your real exposure rather than the one you had at first adoption.

Controls

Evidence

The recorded organisational profile; the derivation of tiers from it; re-derivation records against change events.