AI Readiness Assessment

Commitment

Effective management of AI is only possible with the full commitment of senior management to supporting an effective AI management system. In particular, it requires a lead executive to be accountable for AI and to ensure governance is properly applied across AI. Achieving a return on investment from AI is much more likely if AI is architected into the business processes.

Accountable Executive:

AI Role:

The organization understands and commits to ethical use of AI An AI Policy will be put in place and enforced Resourcing will be available to manage AI Management will engage subject matter experts to guide the implementation

Architecture

Achieving business success and a return from investment (and AI in particular) is much more likely if an enterprise architecture exists in a form which enables line of sight from technical investments to business value streams. AI should be integrated into the enterprise architecture and implemented into the business processes.

An enterprise architecture exists AI is or will be integrated into the enterprise architecture Enterprise architects provide architectural governance The AI potential in business value chains has been analysed

Capability

The ISO 42001 AI Management System standard requires organizations to document a wide range of information related to AI, starting with its design characteristics, the data used to create and operationally use it, and details of its use. Effective management of AI is only possible if the organization has the ability to manage AI related documentation effectively.

A document management system is in place IT systems are registered in an inventory AI usage is known and documented

Competence

AI is a new form of organizational capability which needs to be architected into the existing technology infrastructure in a substantially different manner to traditional changes in IT. It requires new skillsets to be available for effective use of organizational data in AI, and brings with it both new threats to and opportunities for the business. The effective adoption of AI needs to be supported by establishing an appropriate level of AI competence across data science, security, technology, risk, and audit. In addition, staff need to be adequately trained in order to get the most out of individual use of AI at the desktop.

The organisation has competent data scientists AI Security training will be made available The IT team has competence in AI technologies The risk team has competence in AI risk AI Audit training will be made available AI Architecture training will be made available

Scope and Value

It is important to define the scope of the AIMS as this has a significant bearing on the effort required to develop and put in place the management processes for AI. It also affects the cost and complexity of any assessments or audits that might subsequently be run across the AI deployment. The scope should take into account the requirements or needs or interested parties. Management needs to have a clear understanding of the business value chains and ensure that all AI projects have clear targets for achieving value either through efficiency gains in existing activity or by innovations which create new value for the organization.

Management understands the proposed scope of AI usage Management has set boundaries for the use of AI A process for establishing the business value of proposed AI projects exists

Obligations

AI, and particularly agentic AI, is a disruptive technology that has the potential to impact staff and customers. European Union AI legislation requires that fundamental human rights are taken into account and that AI is used in an ethical and safe manner not only for the organisation, but for individuals and for society at large. This introduces a number of obligations that do not typically arise when using traditional IT.

Management understands the EU obligations relating to fundamental rights The definition of prohibited and high risk AI systems is understood The obligation to explain AI decisions is understood The obligation to inform users when AI is used (transparency) is understood