When discussing how enterprises treat AI, we invoke language that describes different levels and perspectives of involvement, from the abstract to the detailed. Viewed as a top-down progression, these can be arranged as a hierarchy of organisational views, each providing a more concrete perspective.
At the top, we seek to answer the questions of why and who, establishing context and direction through values and principles, goals, obligations and governing rules. At the lower levels, work produces the information and evidence needed to support evaluation, inform decisions, manage exceptions and drive improvement.
Direction flows down the hierarchy, while evidence and operating experience inform evaluation, decisions and improvement. The views operate concurrently, with feedback capable of changing the direction and arrangements established above.
Between these points lies the organisational machinery that translates direction into action, action into evidence and evidence into accountable decisions. What sits between the head and the tail?
From Direction to Capability
Direction must be actualised through a Responsible AI management capability.
The next level, ‘Capability’, identifies what the organisation must be able to do to translate direction into coordinated action across the delivery, operation and governance of AI. It is not synonymous with a department, process or technology platform. It is a sustained organisational ability that various enterprises may establish through differing structures and levels of formality.
An AI management system provides the backbone for this capability. It establishes repeatable arrangements for pursuing objectives, allocating responsibilities, operating controls, evaluating performance and making improvements. ISO/IEC 42001 provides a structured foundation for these arrangements, but an AIMS does not supply every form of specialist judgement or method required to develop, provide and use AI responsibly.
A Responsible AI management capability must draw upon relevant legal, technical, operational and domain expertise, together with six contributing disciplines:
- Ethics
- Governance
- Quality Management
- Risk management
- Safety
- Assurance
These disciplines and their associated practices must interlace during delivery and operation, even where their work is organised separately. Coherence depends on the contributors involved working from a sufficiently consistent understanding of the AI use, its boundaries, operating conditions and the decisions their work must support. Without that common basis, each discipline may perform competently within its own remit while important issues remain between them.
Assurance Examines the Evidence
Assurance has a particular role within the management capability. It does not own the solution, operate every control or accept the resulting risks. It examines whether the relevant work has been performed and the intended outputs achieved, whether controls operate as intended, and whether the resulting evidence applies to the decision under consideration.
Sponsors and customers need to understand what the evidence demonstrates about a solution or operational change in its intended environment, which risks it addresses and where uncertainty remains. A structured AI assurance model helps ensure that appropriate evidence is obtained, interpreted and presented to support the decision at hand. Where evidence is drawn from several disciplines, differences in scope, assumptions and limitations must remain visible rather than being obscured by a broad-brush conclusion.
Responsible AI, Delivery and Operation
Responsible AI takes effect where its disciplines intersect with the delivery and operation of AI-enabled solutions. These cross-functional points allow policy objectives and specialist judgement to shape what delivery teams build, what operational teams run and what evidence reaches governance.
Several intersections are particularly important.
Defining the intended use and operating conditions
Business, domain, technical and Responsible AI contributors establish what the AI is expected to do, who or what it may affect, the reliance placed on its outputs and the constraints that must apply. This defines the relevant solution boundary and operating context.
Translating Objectives into Delivery Requirements
Policy objectives must be aligned with any given AI solution or change. If and when policy commitments are identified, they must be captured, made actionable and traceable. Delivery teams express them through solution requirements, design decisions, acceptance criteria, evidential requirements, and other controls, supported by expert guidance, where necessary. These tasks refine what must be implemented and establish the bar against which the delivery will be assessed.
Establishing the Readiness for Use
Readiness must be demonstrated against the requirements and acceptance criteria established during delivery. Before a material change enters live service, both must be reviewed and revised where necessary, and readiness must be demonstrated again.
Delivery teams provide evidence concerning the solution and its controls. Relevant domain specialists interpret it within their respective disciplines, while assurance evaluates whether the combined evidence supports an accountable decision regarding operational readiness. Assurance also works with the wider team to identify any conditions for entry into operation.
Maintaining responsible operation
Operational teams apply controls, perform human oversight, monitor performance and operating conditions, manage exceptions and respond to incidents or change. The resulting information is returned to the relevant disciplines so that risks, controls and earlier conclusions can be reassessed.
Each intersection requires clear responsibility for the work, its outputs and the decisions it informs.
An organisation needs a Responsible AI management capability proportionate to its AI uses, risks and operating context. That capability must sustain this coordination over time and ensure that those accountable have both the evidence to make decisions and the authority to implement them.