We understand the specific risks GenAI introduces, such as prompt injection attacks, data leakage, and the potential for confidently incorrect outputs.

We recognise that AI systems can behave unpredictably and require different risk management approaches than traditional software.

We have assessed which EU AI Act requirements apply to our planned AI use cases.

We understand the documentation, oversight, and accountability obligations that come with deploying AI systems.

We understand the need for human-in-the-loop review and escalation mechanisms for AI-generated decisions or content.

We have considered how to monitor AI system behavior and detect problematic outputs in production.

We have identified what information AI systems would need and the confidentiality constraints that apply.

We understand how to prevent AI systems from exposing confidential or sensitive information.

We have defined what is explicitly in and out of scope for our AI initiatives.

We have established governance boundaries: who makes decisions, where oversight occurs, and what approval processes apply.

We have identified specific business problems or opportunities that AI would address, with clear success criteria.

We can articulate what successful AI deployment would look like in measurable terms.

We understand that AI systems require sustained cross-team commitment for oversight, review, and governance.

We have clarity on who has authority to make technical and strategic decisions about AI initiatives.

We have progressed from exploring AI possibilities broadly to having clear strategic direction.

Teams who would be affected by AI deployment have been involved early in planning and scoping discussions.