AI is not a procurement event.

Operational tasks

Define the problem. Specify success criteria in advance, including which ROAI quadrants matter most. Identify which Pillars are touched. Map against the Risk Taxonomy 2026 to surface which classes the use case will introduce. Document the named accountable owner if pursued.

Governance cadence

Concept decisions are made by the governance committee at its regular cadence, not ad hoc. The committee reviews each candidate against a structured intake (problem statement, success criteria, ROAI hypothesis, Risk Taxonomy exposure, proposed owner).

Risk classes most exposed

Hallucination · Shadow AI proliferation · Accountability dilution

Defensibility elements most active

Governance posture · Methodology transparency

Operational tasks

Score candidate vendors against the Vendor Index six dimensions. Negotiate contracting (data isolation, residency, exit-assistance, notice SLAs on upgrades). Configure against data handling standards. Design the pilot with cohort-controlled methodology. Build training. Update the Risk Register with new entries mapped to the Taxonomy.

Governance cadence

Vendor selection requires committee approval. Material configuration choices (residency, training opt-out, retention) require committee approval. Contract execution requires standard procurement governance plus AI-specific committee sign-off. Pilot results reviewed before Stage 3 promotion.

Risk classes most exposed

Vendor lock-in · Data leakage · Regulatory non-compliance

Defensibility elements most active

Methodology transparency · Governance posture · Evidence framework

Operational tasks

Cutover from baseline to AI-assisted workflow. Update operating procedures and training materials. Roll out training to the user population. Operationalise the audit trail (decision traceability producing logs). Monitor for early-stage issues, exceptions, and output quality below pilot baseline.

Governance cadence

Committee receives weekly status during the first month, shifting to monthly once stable. Any material exception in the first month goes to committee directly rather than the operational layer.

Risk classes most exposed

Professional conduct exposure · Shadow AI proliferation · Hallucination

Defensibility elements most active

Decision traceability · Continuous learning · Governance posture

Operational tasks

Quarterly refresh of Evidence Register entries. Quarterly review of Risk Register entries. Quarterly review of ROAI performance against the original hypothesis. Annual vendor relationship review. Incident logging with root-cause analysis. Model upgrade impact assessment whenever the vendor ships a new version.

Governance cadence

Quarterly committee review of each capability. Annual deep-dive against the original Concept memo. Out-of-cycle review triggered by incident, regulatory development, or material vendor change.

Risk classes most exposed

Model drift · Data leakage · Accountability dilution

Defensibility elements most active

Continuous learning · Evidence framework · Decision traceability · Methodology transparency

Operational tasks

Notify the user population. Migrate workflows to successor or pre-AI baseline. Export data in portable format. Archive the Evidence Register (Defensibility evidence retains relevance after retirement). Capture lessons learned. Decommission technical integration. Close the vendor relationship per contract exit terms.

Governance cadence

Sunset decision requires committee approval with a written assessment of why retirement and what successor (if any) takes its place. Post-sunset, committee receives a final ROAI report comparing realised return against the original Concept hypothesis.

Risk classes most exposed

Vendor lock-in · Client confidentiality breach · Accountability dilution

Defensibility elements most active

Lifecycle · Evidence framework · Continuous learning