Governing AI-Enabled Public Services at Scale

10 Foundational Principles

Drawn from the Strategic AI Governance position and aligned with the AI Risk Management Toolkit, these are the non-negotiable principles every AI-enabled public service must satisfy regardless of risk tier.

Risk Tiering and Categories

Risk tiering is the cornerstone of proportionate assurance. It converts a binary “is this AI risky?” into a four-band decision that drives the depth of evaluation, the seniority of sign-off, and the cadence of re-certification.

Risk Tiers (R1–R4)

The Nine Risk Categories

Aligned with the AI Risk Management Toolkit (D02 v1). Every assessed AI use case is screened against these nine categories to identify the dominant risk profile and the assurance disciplines required.

Tier × Category cross-walk

Use this view to choose proportionate controls for each of the nine categories at each tier.

Service Lifecycle & Phase Gates

A pilot is not a beta. A beta is not live. Each phase asks a different assurance question and demands different evidence. This view encodes the Level 3 lifecycle, the AI Assurance Questionnaire stages and the Service Standard expectations into one progression.

E2VT & Service Standard alignment

Trust cannot be asserted. It has to be evidenced. The E2VT loop — Evaluate, Evidence, Validate, Trust — is the operational discipline applied at every phase gate. It maps onto the 14 Service Standard points so that AI-specific evidence travels through the same assessment route as any other digital service.

14 Service Standard points — AI-enabled evidence

Governance Structure & RACI

Governance must be operational, not ceremonial. Each artefact has a single accountable person, a working responsible team, and clearly defined consulted and informed parties. The model layers a strategic AI Governance Board over departmental assurance boards and product-level day-to-day controls.

Three-tier governance

Operating RACI

Towards observable maturity

The target operating model is supported by four operational dashboards/registries — each is a capability that should exist at department or cross-government level:

AI-enabled Failure-Mode Matrix

The bigger assessment risk is rarely whether the model works. It is whether the team can show why AI is appropriate, how harms are detected, how humans remain in meaningful control, and how the service operates reliably in live conditions. Stress-test these failure modes before assessment.

Answer-quality scoring (for reference)

Operating Templates

Eight reusable templates that turn the operating model into daily artefacts. Edit in-browser, then use the buttons to print or copy. Together they form the minimum evidence pack any AI-enabled service should hold.

Centrally Endorsed Guidance for Responsible Deployment

Departmental approaches to AI assurance are inconsistent today — some teams over-engineer controls, others under-control. This section sets a single, written and centrally endorsed position covering responsible deployment, model-update governance, accuracy expectations and acceptable risk thresholds. It is designed to unblock safe experimentation by making the rules explicit, so teams stop guessing and risk-aversion stops acting as a default veto.

G1 · Responsible deployment standard

Every AI-enabled service deployed in the UK public sector must satisfy the following seven mandatory commitments, regardless of risk tier or department. Anything below this floor is not a deployment, it is an experiment and must remain inside a controlled environment.

G2 · Model update governance

Model behaviour changes — either intentionally (retrain, prompt edit, version bump) or externally (supplier model swap, fine-tuning). All four trigger the same governance path. The depth of the path is set by R-tier.

Hard rule for all tiers: no silent updates. Every model change leaves a record in the Model Registry, the decision log and (R2+) the ATRS entry. Where the change is provider-initiated, the service operates under a presumption to pause until revalidation completes.

G3 · Accuracy expectations

Accuracy is not a single number — and "high accuracy" is not a control. The central position is that each service must declare four metrics with explicit thresholds, set before launch and proportionate to tier. Below the lower threshold the service must pause; in the amber band it must remediate; above the green threshold it may operate.

Thresholds are reference defaults. Departments may set stricter values for the same tier; they may not relax them without AI Governance Board approval. pp = percentage points.

G4 · Acceptable risk thresholds

Mapped to the Orange Book-aligned appetite scale (Averse → Eager) used in the AI Risk Management Toolkit, against the nine risk categories.

G5 · Pre-approved deployment routes

To remove the most common cause of departmental risk-aversion — uncertainty about what is allowed — the following pre-approved patterns may be deployed at R1/R2 using the reference controls only, without bespoke board review:

• Pattern A — Internal staff productivity assistant (drafting, summarisation, search) on non-personal corporate data. Requires D1, D5, D7.
• Pattern B — Internal knowledge retrieval (RAG) over departmental knowledge base, with citation. Requires D1, D2, D5, D7.
• Pattern C — User-facing informational assistant with explicit "AI-generated" labelling and human-reviewed corpus. Requires D1–D7.
• Pattern D — Caseworker triage / prioritisation (advisory, not decisional). Requires D1–D7 and sub-group parity evidence (G3).

Anything outside the pre-approved patterns, or at R3/R4, requires departmental Assurance Board sign-off plus AI Governance Board notification.

G6 · Consistency across government

To prevent departmental drift, the following are common across all departments and may not be re-defined locally:

G7 · How this navigates risk aversion

The most common failure pattern observed in departmental practice is not deploying badly — it is not deploying at all, because no one is sure what "good enough" looks like. This guidance addresses each pattern:

G8 · Where this guidance lives in the operating model

• Strategic layer — G1, G4 and G6 sit with the AI Governance Board (L1).
• Tactical layer — G2, G3 and G5 are owned by the departmental Assurance Board (L2) and implemented through shared evaluation standards and the Model Registry.
• Operational layer — D1–D7 are enforced at phase gates by the Service / Product Owner (L3) using the templates in the Templates tab.
• Assurance layer — G7 pause triggers feed directly into the Failure-Mode Matrix and the AAQ v4.3 evidence questions.

Framework Synergy & Critical Alignment

The five source frameworks each address a slice of the AI assurance problem. The reference operating model integrates them so a single piece of evidence satisfies multiple frameworks simultaneously — reducing duplication and exposing genuine gaps.

Cross-framework synergy matrix

Where the same operating-model area is informed by multiple frameworks, alignment is genuine. Gaps below are where the reference operating model adds bridging guidance.

● primary contributor · ○ reinforcing contributor · – not in scope

Critical observations

• Synergy: Risk tiering (Strategic Gov) and failure-mode controls (Risk Toolkit) align cleanly — tier sets depth, toolkit sets shape. Use Templates T2 and T4 together.
• Synergy: Level 3 lifecycle phasing and AAQ v4.3 lifecycle stages are isomorphic — AAQ questions plug directly into the phase-gate accordions on the Lifecycle tab.
• Gap bridged: Research Assessment scrutinises hallucinated research outputs but is silent on live operation. The OPM routes its findings into Standard points 1 and 5, then into live drift monitoring.
• Gap bridged: Strategic Gov describes target dashboards (registry, hallucination, incident) but not who runs them. The Governance RACI assigns L2 Assurance Board ownership.
• Risk to mitigate: All five frameworks treat “evidence” differently. The Evidence Tracker (T3) consolidates to a single pack per service to prevent scatter — the most cited Level 3 failure.