Method
90-day implementation plan and year-one roadmap
A phased implementation sequence from initial governance and controls through a year-one programme.
Responsible AI resource directory
Controls & methods
Find the control, method, or reference you need. Each entry opens the relevant section of its source report, with implementation detail and evidence intact.
130 resources · showing 20
Open a section in its source reportMethod
Ten controls to build first
The compendium’s prioritised starting controls, with links to the full implementation requirements.
Method
Responsibility assignment across control families
A RACI covering the nine control families and the institution’s lines of responsibility.
Method
Control maturity model
The M1–M4 model for assessing the maturity of an agentic control programme.
Method
Enterprise evaluation programme
The report’s proposed evaluation programme and the evidence needed to support deployment decisions.
Method
Evaluation evidence and validity
Requirements for describing the tested system, elicitation conditions, measurements, and validity of an evaluation.
Method
Threat modelling for agentic systems
Three financial-institution agent archetypes and their threat-model assumptions.
Method
Human oversight modes
In-the-loop, on-the-loop, and post-hoc oversight, with their operational distinctions.
Method
First 24 hours of incident response
A response checklist covering containment, investigation, escalation, and re-entry. Its timings are labelled practice guidance in the source.
Method
Incident severity classification
Severity levels and associated response actions for agentic incidents; source qualifications remain explicit.
Method
Board-pack checklist
Evidence and reporting items for a governing-body review of the agentic AI programme.
Method
Frontier safety frameworks in vendor diligence
How the compendium treats provider safety frameworks as evidence for third-party review.
Method
Disparate-impact testing for agentic decision flows
Fairness testing in multi-step decision flows, scoped to the compendium’s financial-services setting.
Method
Complaints and customer remediation
Complaint handling, remediation, and considerations for vulnerable customers.
Reference
Agentic risk taxonomy
The compendium’s AR-1–AR-16 risk categories and their relationship to control design.
Reference
Framework comparison tables
Comparisons of evaluations, controls, risk-management frameworks, and regulation. Check the source’s scope and status qualifications.
Reference
NIST AI RMF and Generative AI Profile
The compendium’s treatment of the NIST AI Risk Management Framework and AI 600-1 profile.
Reference
ISO/IEC 42001 and related AI standards
The report’s coverage of ISO/IEC 42001, 23894, 42005, and 42006. Refer to current standards for authoritative requirements.
Control
GOV-01Governance & accountabilityBoard-Approved AI & Autonomy Governance Charter
Establish board-level accountability for AI use, including an explicit, written risk appetite for agent autonomy.
Evidence and ownership
- Expected evidence
- Charter and committee minutes; risk appetite statement with autonomy schedule; board reporting packs traceable to inventory records.
- Ownership
- 1st line: operates within the appetite. 2nd line: drafts the appetite schedule, monitors adherence. 3rd line: audits whether reporting to the board reflects the system of record.
Implementation requirements, maturity levels, mappings, sources, and qualifications are retained in the full control.
Control
GOV-02Governance & accountabilityEnterprise AI Management System (AIMS)
Operate a single, certifiable management system governing the responsible development, provision, and use of AI systems, including agents.
Evidence and ownership
- Expected evidence
- AIMS scope statement naming agentic systems; management-review minutes; internal-audit reports; certification records where pursued.
- Ownership
- 1st line: executes AIMS operational controls. 2nd line: owns AIMS design, policy, and performance evaluation. 3rd line: internal audit of the AIMS itself.
Implementation requirements, maturity levels, mappings, sources, and qualifications are retained in the full control.