Organizational Strategy Organizational change
How well the organisation positions itself to get business value from AI.
2AI Strategy Development
Required from Implemented
Turning business outcomes into a practical, adaptable plan for where and how AI will contribute.
Goals
- Scope AI adoption so it fits the organization's mission and objectives.
- Set up a documented plan for adopting AI within that scope.
- Check AI progress routinely against business aims, values, and principles.
Typical actions
- Bring the right stakeholders together to frame where AI could help.
- Express AI targets as measurable outcomes tied to business priorities.
- Write down the strategy with milestones and criteria for success.
- Share the plan and its milestones with everyone it affects.
- Track progress through existing governance forums and report results openly.
- Revisit the strategy periodically, adjusting course based on what worked.
Evidence: AI strategy document · AI section of organizational strategy · Measurable business goals for AI · Communication plan · Internal AI progress newsletters · AI adoption project plan · Value stream map
Linked with:
AI Partnership Development, Future Ready Planning, Organizational Culture Evolution
3AI Partnership Development
Required from Aligned
Choosing external partners and vendors that fit the AI strategy and reassessing that fit over time.
Goals
- Stay informed about the shifting AI market and its surrounding ecosystem.
- Engage outside partners whose AI offerings match adoption goals.
- Review contracts and partnership terms so they support AI objectives.
Typical actions
- Set AI-specific partner criteria reflecting culture and risk tolerance.
- Scan market trends and new releases regularly to inform choices.
- Decide per need whether to buy, fine-tune, or build AI.
- Score candidate vendors on security, data handling, and responsible AI.
- Negotiate terms that avoid lock-in and clarify data and model ownership.
- Write performance targets and remedies for underdelivery into contracts.
Evidence: Competitive assessment · Market analysis · Trend analysis · Evaluation matrix · Gap analysis · AI contract checklists
Linked with:
AI Strategy Development, Experimentation, Organizational Culture Evolution, Risk Management, Supply Chain Management
3Organizational Structure Calibration
Required from Aligned
Reshaping existing processes and reporting lines so the organization can actually carry AI initiatives forward.
Goals
- Review processes to find what must change or be created for AI.
- Proactively check that the org structure supports building and running AI.
Typical actions
- Inventory the business and technical processes that AI will touch.
- Compare processes against the AI strategy on a recurring schedule.
- Refresh change-management practices to absorb the effects of AI.
- Assign clear owners for people, partners, and workflows in AI efforts.
- Assess whether the current structure delivers AI goals and ROI.
- Restructure teams where the review shows adoption is being held back.
Evidence: Mission and vision guidance · Org chart with AI roles · AI strategy · 360 Framework · Core functions list for AI
Linked with:
Organizational Culture Evolution
5Future Ready Planning
Required from Future Ready
Using quantitative models and external collaboration to build long-range AI roadmaps that hold up under different possible futures.
Goals
- Maintain analytic models for planning, tracking, and deploying AI capabilities.
- Refresh the AI strategy to cover several futures and time horizons.
- Build outside collaborations that shape the field and long-term vision.
Typical actions
- Build causal, statistical, or simulation models of AI's business impact.
- Forecast outcomes and failure rates, then check predictions against reality.
- Draft scenario sets covering market, risk, and technology shifts.
- Gather improvement ideas from staff, scouting, and peer benchmarking.
- Compare candidate roadmaps on cost, time, and resilience before choosing.
- Partner with academia and industry leaders and share lessons learned.
Evidence: Predictive analysis · Benchmark-based planning measurement framework · Future scenarios · Collaboration case studies
Linked with:
AI Strategy Development, Risk Management
Workforce and Culture Organizational change
Skills, training and the mindset needed to work well with AI.
1AI-Literate Workforce Development
Required from Exploratory
Hiring and growing people who have the know-how to put AI to good use in their jobs.
Goals
- Define and record the roles and skills that AI adoption requires.
- Provide training that builds and keeps AI skills current.
Typical actions
- Map which roles and skills the unit needs for AI work.
- Tie AI training completion to career progression and workforce planning.
- Compare team skills against peers in the industry or community.
- Set training requirements for each AI-related role.
- Build or source AI courses, then run them for staff.
- Track training completion and follow up on gaps.
Evidence: KSA assessments · Role and job family descriptions · Skills survey analysis · Skills taxonomy or framework · Workforce gap analysis · Training guidelines · Responsible AI training materials
Linked with:
Organizational Culture Evolution
3Organizational Culture Evolution
Required from Aligned
Shifting the organization's mindset toward an AI-native way of working through HR practices and steady communication.
Goals
- Foster an open, collaborative culture that keeps learning.
- Bring in and grow people who fit the AI-oriented culture.
- Monitor and steer how ready the workforce is for AI.
Typical actions
- Invite staff to experiment with AI and help shape the strategy.
- Survey stakeholders, including affected groups, on how they view AI efforts.
- Recognize and reward teams that advance AI adoption.
- Spot roles likely to shrink and reskill those people early.
- Add AI adoption contributions to individual goals and objectives.
- Create career paths in AI specialties the organization will need.
Evidence: Culture and mindset documentation · Cultural adoption metric · Town halls and newsletters
Linked with:
AI-Literate Workforce Development, AI Partnership Development, AI Strategy Development, Human-in-the-Lead Automation, Organizational Structure Calibration
Workflow Re-Engineering Organizational change
Experimenting with AI and redesigning how work gets done, with measurement.
1Experimentation
Required from Exploratory
Trying out AI use cases in controlled settings to learn whether AI-powered workflows are worth pursuing.
Goals
- Build prototypes to test assumptions, involve stakeholders, and surface risks.
- Run live trials to confirm prototypes and their business and technical risks.
Typical actions
- Pick candidate use cases from business and workflow opportunities.
- Scope the smallest useful AI feature set and iterate on it.
- Check prototypes against compliance and enterprise requirements early.
- Set go-live criteria covering performance, controls, and user readiness.
- Provide a realistic sandbox for testing and gathering data.
- Analyze trial results and rank recommendations for deployment.
Evidence: Experiment plans · Experimentation dashboards · Experiment resource plans · UX and HCI artifacts · Sandbox reference documents · Experiment results · Recommendations · Close-out artifacts
Linked with:
AI Architecting, AI Partnership Development, Business Workflow Innovation, Data Lifecycle Management, Data Quality Assurance, Human-in-the-Lead Automation, Legacy Integration, Policy and Compliance, Technology Infrastructure, Test and Evaluation, Transparency and Explainability
3Business Workflow Innovation
Required from Aligned
Redesigning business processes around AI so they deliver measurably better value and return on investment.
Goals
- Find and rank processes where AI can boost efficiency.
- Vet top-priority workflows for risk and suitability before applying AI.
- Confirm AI-enabled workflows are ready to run at scale.
Typical actions
- Document in-scope processes and find steps that add no value.
- Test whether plain process fixes could hit targets before using AI.
- Rank candidate workflows by expected gains and ROI.
- Review data volume, quality, and risk before committing AI to a workflow.
- Name operational owners and build fallbacks for when AI fails.
- Spell out human and agent handoffs in agentic workflows.
Evidence: Business impact analysis · Service-level agreement · Recovery time objective · ROI analysis · Adoption rate · Business process documentation · Use case diagrams
Linked with:
AI Architecting, Data Lifecycle Management, Data Quality Assurance, Experimentation, Legacy Integration, Measurement and Analysis, Responsible AI, Risk Management, Supply Chain Management, Test and Evaluation, Transparency and Explainability
3Human-in-the-Lead Automation
Required from Aligned
Designing AI systems so people stay accountable and in control, especially for decisions affecting wellbeing, safety, or rights.
Goals
- Design systems that support people through clear, understandable interactions.
- Put human oversight in place for high-stakes decisions.
Typical actions
- Design interfaces that keep people in charge of key decisions.
- State plainly which outcomes humans own and which AI influences.
- Feed user input on trust, usability, and accuracy back into systems.
- Audit automated actions regularly for problems undermining human control.
- Flag irreversible or high-risk decisions that need closer human review.
- Add checkpoints and controls where people must approve AI-driven steps.
Evidence: Test plans · SME assessments · Usability test findings · UX study plans and insights · Critical decision point analysis · AI risk-based workflow tests
Linked with:
AI Architecting, Experimentation, Organizational Culture Evolution, Responsible AI, Risk Management, Transparency and Explainability
3Measurement and Analysis
Required from Aligned
Quantifying how well AI-enabled workflows and initiatives perform against their objectives.
Goals
- Define what to measure and what success means for AI workflows.
- Deliver analyzed measurement results on AI workflows to decision-makers.
Typical actions
- Derive metrics directly from workflow goals and unit objectives.
- Plan how and when AI workflows will be measured.
- Collect measurement data and keep it in a reliable store.
- Interpret results and choose suitable channels to report them.
- Build dashboards tailored to projects, divisions, and management tiers.
- Set a recurring cadence and method for future measurement.
Evidence: Baseline and benchmark performance · Live KPI dashboard · AI model performance metrics · OKRs · Predictive success/failure analysis · Rate of adoption · Board and shareholder reports · Success and change stories · Test design and reporting template · Test plan and expectations · Communication strategy · ROI analysis · Service continuity process · Service-level agreements
Linked with:
Business Workflow Innovation
Risk and Governance Organizational change
Policies, risk management and responsible-use standards for AI.
2Risk Management
Required from Implemented
Spotting, understanding, and deciding how to handle AI-related risks in line with the organization's tolerance.
Goals
- Identify, assess, and communicate risks arising from AI adoption.
- Set up a defined process for managing AI risks.
- Have controls for AI risks tested independently for effectiveness.
Typical actions
- Catalog risk categories AI affects, such as privacy and compliance.
- Revisit and publish risk appetite for each affected category.
- Fold AI risks into existing enterprise risk and GRC tooling.
- Specify controls for AI-specific concerns like bias and explainability.
- Decide per risk whether to mitigate, accept, transfer, or monitor.
- Test controls independently and fix gaps the tests reveal.
Evidence: Risk score · Hazard and harms identification methods · Risk assessment approaches (e.g., STPA) · Third-party AI partner audits · EGRC strategy · Risk appetite documentation · Partner risk appetite documentation · AI risk categories
Linked with:
AI Model and Agent Security, AI Partnership Development, Business Workflow Innovation, Future Ready Planning, Human-in-the-Lead Automation, Monitoring, Supply Chain Management
2Policy and Compliance
Required from Implemented
Keeping internal policies, adopted standards, and legal obligations in step with how the organization uses AI.
Goals
- Bring organizational policies into line with AI adoption.
- Manage conformance with standards, regulations, and contract terms.
Typical actions
- Inventory HR, tech, and vendor policies that AI adoption touches.
- Revise or add policies where the AI strategy demands it.
- Include AI risks in scheduled policy review cycles.
- Track emerging AI regulations and industry standards that apply.
- Adjust processes and controls to satisfy new AI obligations.
- Monitor ongoing AI compliance and act on lapses.
Evidence: Legal playbook · Data and model licenses · Applicable AI laws · AI partner agreements · Organizational policies · Sector-specific AI policies · Policy change log
Linked with:
Experimentation, Monitoring
2Responsible AI
Required from Implemented
Setting and upholding standards for ethical AI development and use that reflect the mission, stakeholders, and risk appetite.
Goals
- Determine who will be affected by the organization's use of AI.
- Define the organization's stance and principles on responsible AI.
- Put the responsible AI approach into everyday practice.
Typical actions
- List affected groups and any special needs, including vulnerable populations.
- Weigh energy and sustainability costs of planned AI use.
- Pick focus principles such as fairness, privacy, and transparency.
- Explain the responsible AI stance to internal and external audiences.
- Embed responsible AI controls across building and running AI systems.
- Revisit the approach as technology and use cases change.
Evidence: Responsible AI use guidelines · Hazard and harms identification methods · Responsible AI risk policy · Responsible AI training · Responsible AI design guidelines
Linked with:
AI Architecting, AI Model and Agent Security, Business Workflow Innovation, Data Quality Assurance, Human-in-the-Lead Automation, Legacy Integration, Monitoring, Test and Evaluation, Transparency and Explainability
Data AI lifecycle engineering
Trustworthy, well-governed data for AI systems.
2Data Lifecycle Management
Required from Implemented
Sourcing the right data for each AI use case and keeping track of where it came from, who owns it, and how it is protected until disposal.
Goals
- Obtain data suited to the use case and keep a full origin trail.
- Name accountable stewards for each data source across its whole life.
- Keep data private and secure from collection through deletion.
Typical actions
- Catalog candidate data sources and the AI solutions that consume them.
- Version every dataset and log each transformation, retention and deletion step.
- Publish data cards, dictionaries and metadata that stay current.
- Appoint an owner and domain expert for each authoritative data source.
- Classify sensitive and personal data, then grant access on least privilege.
- Prepare a playbook for data leaking through models, agents or workflows.
Evidence: Data curation guidance · Data cards · Data schema · Dataset description · Data ontology · Data lake criteria · Copyright guidance · Dataset classification guidance · Data usage guidance · Classification-marked documents · Data responsibilities · Data retention policy · Metadata
Linked with:
AI Architecting, AI Model Management, Business Workflow Innovation, Data Quality Assurance, Experimentation, Legacy Integration, Monitoring, Test and Evaluation, Transparency and Explainability
2Data Quality Assurance
Required from Implemented
Making sure the data behind ML models, generative tools and agents stays well organized, trustworthy and usable for its purpose over time.
Goals
- Agree on what good-quality data means for each AI effort.
- Get structured and unstructured data ready for its intended use.
Typical actions
- Work with stakeholders to set explicit data quality expectations.
- Screen datasets for bias and harmful outcomes; record notable findings.
- Assess possible misuse of data or data combinations and decide responses.
- Feed operational systems the context they need, such as RAG sources.
- Standardize formats, labels and metadata for text, image and audio data.
- Partition ML data into train, test and validation sets preserving variety.
Evidence: Data labeling guidance · EDA outcomes · ETL pipelines · Bias identification and removal approaches · Metadata
Linked with:
Business Workflow Innovation, Data Lifecycle Management, Experimentation, Monitoring, Responsible AI
Engineering AI lifecycle engineering
Turning AI use cases into production-grade, tested, explainable systems.
2AI Architecting
Required from Implemented
Designing and connecting AI components and AI-enabled systems so they serve business needs with the right quality attributes.
Goals
- Build maintainable AI system architectures that satisfy stakeholder needs.
- Account for security and operational risk in the architecture.
- Design AI systems with their scaling needs in mind.
Typical actions
- Gather architecture requirements covering near-term and future AI needs.
- Publish a reference architecture for the AI technology stack and partners.
- Integrate new AI systems through standard, well-defined interfaces.
- Map data flows and bake AI security controls into designs.
- Give AI agents distinct identities with role-based, segregated permissions.
- Plan how compute, storage and network capacity will scale with demand.
Evidence: Architecturally significant requirements · Prototypes · SLAs · Reference architecture documentation · Technology stack documentation · Architecture conformance guidelines · System and data dependencies · Shared data sources · Version control · Logs · Options and trade-off analysis · Evolution plan · Roadmap · Modernization plan
Linked with:
AI Model Management, Business Workflow Innovation, Data Lifecycle Management, Deployment at Scale, Experimentation, Human-in-the-Lead Automation, Monitoring, Responsible AI, Supply Chain Management, Technology Infrastructure
2Test and Evaluation
Required from Implemented
Verifying and validating AI solutions to show they meet technical requirements and actually serve business goals.
Goals
- Test AI-specific behavior on top of ordinary software testing.
- Track and record whether AI meets expected quality levels.
Typical actions
- List the AI-specific features that need dedicated test coverage.
- Add targeted tests for drift, hallucination and similar AI failures.
- Run usability, acceptance and regression tests against legacy integrations.
- Set baselines for judging non-deterministic AI outputs.
- Automate AI testing, including checks on generative outputs.
- Share results and repeatability with owners; retest after fixes.
Evidence: Test cases · Test plan · Testing approaches · Code reviews · Production deployment readiness · Quality tests · Automated tests · Baselines · Failure modes · Error logs
Linked with:
Business Workflow Innovation, Data Lifecycle Management, Experimentation, Monitoring, Responsible AI, Supply Chain Management, Technology Infrastructure
3Legacy Integration
Required from Aligned
Combining AI with existing systems, tools, data and infrastructure so older platforms gain new capabilities.
Goals
- Integrate AI into legacy systems using sound, interoperable architecture.
- Keep legacy systems maintained so AI integration stays smooth.
Typical actions
- Collect system-level and quality needs before connecting AI to legacy.
- Judge how readily AI and agentic components fit existing systems.
- Pinpoint integration points and infrastructure gaps for new AI components.
- Capture production data so it can feed analysis, testing and training.
- Refresh reference architectures, libraries and APIs to include AI.
- Decommission outdated systems to cut end-of-life and support risk.
Evidence: AI model requirements · Data lake criteria · System environment specifications · Functional and hardware requirements · Sandbox specifications · Service continuity process · Modernization plan · Legacy architecture documentation
Linked with:
Business Workflow Innovation, Data Lifecycle Management, Experimentation, Monitoring, Responsible AI, Supply Chain Management, Technology Infrastructure
3Transparency and Explainability
Required from Aligned
Ensuring AI systems, including agents, can explain their behavior in ways users understand and that leave a traceable record.
Goals
- Define what transparency and explainability each AI solution needs.
- Build those transparency requirements directly into solution design.
- Make sure explanations genuinely help the people using the system.
Typical actions
- Gather traceability needs from engineering, compliance and business teams.
- Ask end users what explanations would make the system trustworthy.
- Design components to surface and log the reasoning behind AI decisions.
- Flag confusing outputs and decide where explanations should appear.
- Test explanations with real users and refine based on feedback.
Evidence: Explainability design patterns · Explainability requirements documentation · End user needs · Privacy and responsible AI guidelines · Relevant API documentation · Data documentation
Linked with:
AI Model Management, Business Workflow Innovation, Data Lifecycle Management, Deployment at Scale, Experimentation, Human-in-the-Lead Automation, Monitoring, Responsible AI, Supply Chain Management, Technology Infrastructure
Operations AI lifecycle engineering
Running, securing and monitoring AI models and agents in production.
2AI Model Management
Required from Implemented
Running AI models through their full life, from release and versioning to retraining and eventual retirement.
Goals
- Know and control which model version serves each endpoint.
- Record and announce changes in model availability to stakeholders.
- Require models to pass evaluation gates before production use.
Typical actions
- Version models, code and datasets together with full lineage.
- Keep earlier model versions retrievable and hot-swappable when serving.
- Set monitored thresholds that automatically kick off retraining.
- Store generative model settings, prompts and seeds for reproducibility.
- Make a standard test suite a required step in every model release.
- Review the risks of each model deployment or change beforehand.
Evidence: AI model repository · Model cards · Model descriptions · Model responsibilities · Model usage guidance · Model licenses and ownership · Privacy and use policies · AI model requirements
Linked with:
AI Architecting, Data Lifecycle Management, Monitoring, Supply Chain Management, Transparency and Explainability
2AI Model and Agent Security
Required from Implemented
Protecting models, agents and their data from compromise while keeping what agents are allowed to do under control.
Goals
- Guard code, models and data against tampering or compromise.
- Watch and restrict the actions that models and agents take.
Typical actions
- Add signing and provenance checks to AI build pipelines.
- Require MFA and privileged access controls for models and pipelines.
- Apply standard cybersecurity hardening to the AI technology stack.
- Spell out exactly what each model or agent is permitted to do.
- Manage agents and service accounts as identities with scoped access.
- Log and analyze agent actions as part of solution monitoring.
Evidence: Identity access management guidelines · AI model and agent repositories · Agent interaction logs
Linked with:
Responsible AI, Risk Management, Supply Chain Management
3Monitoring
Required from Aligned
Watching how deployed AI behaves and gathering performance and usage data to drive fixes and improvements.
Goals
- Gather usable signals about live AI solutions and act on them.
- Catch AI failures quickly and handle them appropriately.
- Capture operational evidence for legal, audit and financial needs.
Typical actions
- Define what to track: performance, drift, degradation and usage.
- Continuously observe agentic systems and collect user feedback.
- Write an AI incident plan with clear roles and escalation paths.
- Configure automatic alerts when scheduled data pipelines fail.
- Detect misuse and keep records proving regulatory compliance.
- Log costs and revenue alongside outputs to measure ROI.
Evidence: Service level agreements · Monitoring logs · Alerts descriptions · Monitoring tools and implementations
Linked with:
AI Architecting, AI Model Management, Data Lifecycle Management, Data Quality Assurance, Deployment at Scale, Legacy Integration, Policy and Compliance, Responsible AI, Risk Management, Supply Chain Management, Test and Evaluation, Transparency and Explainability
Technology Ecosystem AI lifecycle engineering
Infrastructure, suppliers and the ability to deploy AI at scale.
2Technology Infrastructure
Required from Implemented
Supplying and renewing the compute, storage and platform foundation that AI initiatives depend on long term.
Goals
- Spell out the infrastructure that AI initiatives require.
- Deliver that infrastructure to the teams that need it.
- Plan technology refreshes ahead of time rather than reactively.
Typical actions
- Document compute needs such as accelerators, fast storage and bandwidth.
- Weigh infrastructure options against availability, security and cost.
- Give teams ready environments to build and test AI solutions.
- Report infrastructure usage, cost and token consumption regularly.
- Set refresh timelines and patch libraries, APIs and vulnerabilities.
Evidence: Deployment architecture views · AI strategy-to-technology mapping · Capacity plans
Linked with:
AI Architecting, Deployment at Scale, Experimentation, Legacy Integration, Test and Evaluation, Transparency and Explainability
3Supply Chain Management
Required from Aligned
Identifying and governing the vendors, third parties and external data that AI systems rely on.
Goals
- Keep a current inventory of AI-related vendors and dependencies.
- Check suppliers against organizational requirements and risk tolerance.
- Govern data that comes from outside the organization.
Typical actions
- Register every vendor supplying AI data, models or tools.
- Rank suppliers by criticality and record their foundation-model use.
- Set vendor requirements for security, data sharing and responsible AI.
- Review supplier performance against contracts on a risk basis.
- Prepare fallback and exit plans for critical vendor failures.
- Bring external and third-party-collected data under internal data governance.
Evidence: Demand and capacity planning documents · Standard operating procedures · SBOMs · Compliance checklists · AI model lineage · Dependency registries · Supplier API specifications · Transaction logs · Traceability and provenance records
Linked with:
AI Architecting, AI Model and Agent Security, AI Model Management, AI Partnership Development, Business Workflow Innovation, Legacy Integration, Monitoring, Risk Management, Test and Evaluation, Transparency and Explainability
4Deployment at Scale
Required from Scaled
Rolling AI solutions out across the organization to support strategy and AI-native work while keeping ROI high and change risk low.
Goals
- Plan and document how AI solutions expand organization-wide.
- Set reliability and performance targets for AI and meet them.
Typical actions
- Pick high-value AI solutions and plan their enterprise-wide rollout.
- Assess cost, performance and change risks introduced by scaling.
- Consolidate or retire duplicate solutions before expanding deployments.
- Define SLAs and SLOs and size capacity to solution criticality.
- Alert stakeholders proactively about outages and service disruptions.
- Keep continuity plans current for resilient scaled operations.
Evidence: Scalability requirements · Technology and resource planning · Scaled AI planning processes · Duplicative solution lists
Linked with:
AI Architecting, Monitoring, Technology Infrastructure, Transparency and Explainability