Model · M-001 · Responsible AI by design
The Responsible AI Domain Map
The twelve domains an organisation must actively manage for its use of AI to be responsible, in four bands that are the four questions a board asks. What must hold true.
- Structure
- 12 domains in 4 bands
- Programme
- Responsible AI by design
- Companion
- M-002 Lifecycle
- Reviewed
- 2026-11-05
The Domain Map is the "what" of Responsible AI by design. Its twelve domains sit in four bands, and each band is a question a board actually asks: by what authority, and how far (Mandate); what is it built from (Foundation); what does it do to customers (Conduct); and how do we know, and keep knowing (Assurance).
The map is meant to be complete. Its test is simple: a real AI failure that does not land in one of the twelve domains would show the map to be wrong. Third-party dependence is a domain in its own right because so much AI in UK financial services is bought rather than built.
It is used three ways: as a scope check on a new use case, as a maturity assessment (each domain scored against its three test questions, 0 to 4), and as a gap analysis against an existing control set. Read the profile, not the average: a firm that scores well everywhere except fairness is not mostly fine, it has an unmanaged discrimination exposure.
Mandate: By what authority, and how far?
- Domain 01 Strategy & Risk Appetite
Where AI may and may not be used, and how much risk the firm will carry.
UK anchor Board risk appetite · SYSC 4
What good looks like
- Is there a board-approved statement of where AI may and may not be used?
- Are AI risk tolerances defined with thresholds that trigger escalation rather than discussion?
- Are decisions the firm will never fully automate explicitly named?
In the library Risks · Controls · Controls in this family
- Domain 02 Governance & Accountability
Named senior owners, decision rights, committees and escalation.
UK anchor SM&CR · SMF24 / SMF4
What good looks like
- Is a named senior manager accountable for AI, recorded in a Statement of Responsibility?
- Is there a forum with authority to decline an AI use case, and has it ever done so?
- Are approval decisions minuted with the residual risk accepted stated explicitly?
In the library Risks · Controls · Controls in this family
- Domain 03 Regulatory & Legal Compliance
The obligations that bind each use case, tracked and evidenced.
UK anchor Consumer Duty · UK GDPR · EU AI Act
What good looks like
- Is there a maintained mapping of obligations to AI use cases?
- Is the EU AI Act nexus assessed per use case, including output used in the Union?
- Is regulatory horizon scanning for AI operating and reported upward?
In the library Risks · Controls · Controls in this family
Foundation: What is it built from?
- Domain 04 Data & Data Governance
Provenance, quality, lawful basis, representativeness, minimisation.
UK anchor UK GDPR Art 5 · AI Act Art 10
What good looks like
- Is training data provenance documented, including rights to use it?
- Is the lawful basis recorded separately for training and for inference?
- Has the feature set been screened for special category data and robust proxies?
In the library Risks · Controls · Controls in this family
- Domain 05 Model & System Lifecycle
How AI is specified, built, validated, approved, changed and retired.
UK anchor PRA SS1/23 · ISO 42001 A.6
What good looks like
- Does a complete AI inventory exist, including embedded and vendor AI?
- Does every use case pass named gates with an artefact, not an assertion?
- Are models retired by decision rather than by neglect?
In the library Risks · Controls · Controls in this family
- Domain 06 Third Party & Supply Chain
Vendor models, cloud, data suppliers, and concentration in them.
UK anchor SYSC 8 · Critical Third Parties
What good looks like
- Can the firm require notice before a vendor changes a model in use?
- Has concentration across model, cloud and data providers been quantified?
- Is the Article 25 provider/deployer role determined for each vendor system?
In the library Risks · Controls · Controls in this family
Conduct: What does it do to customers?
- Domain 07 Fairness & Customer Outcomes
No unjustified detriment, tested by outcome, not by intent.
UK anchor PRIN 2A · Equality Act 2010
What good looks like
- Is disparate impact tested on outcomes across protected groups for top-tier models?
- Is a fairness definition chosen, recorded and approved per use case family?
- Is proportionality reasoning documented for any disparity retained?
In the library Risks · Controls · Controls in this family
- Domain 08 Transparency & Explainability
Decisions a customer, a colleague and a regulator can each understand.
UK anchor UK GDPR Art 22C · AI Act Art 86
What good looks like
- Are explanations distinguished for customer, colleague and validator?
- Have customer-facing explanations been tested for comprehension with real users?
- Can the firm reconstruct what a customer was told, and by which model version?
In the library Risks · Controls · Controls in this family
- Domain 09 Human Oversight & Contestability
Meaningful intervention, override, and a route to challenge and redress.
UK anchor UK GDPR Art 22C · AI Act Art 14
What good looks like
- Are reviewers trained, competent and authorised to change the outcome?
- Are the four Article 22C safeguards operational, with volumes monitored?
- Is automation bias explicitly designed against, not merely trained against?
In the library Risks · Controls · Controls in this family
Assurance: How do we know, and keep knowing?
- Domain 10 Security & Resilience
Adversarial robustness, and continuity when the model or provider fails.
UK anchor SYSC 15A · OWASP · MITRE ATLAS
What good looks like
- Does the threat model cover adversarial ML, prompt injection and excessive agency?
- Are AI and model-provider dependencies mapped into important business services?
- Has failure of a model or provider been scenario-tested, not just infrastructure failure?
In the library Risks · Controls · Controls in this family
- Domain 11 Monitoring, Assurance & Incidents
Live performance and outcome monitoring, independent challenge, response.
UK anchor SS1/23 P4 · 3 lines of defence
What good looks like
- Is drift and outcome performance monitored in production, by segment?
- Is there independent second-line challenge with capacity to service the top tier?
- Can the firm answer how far back an AI incident goes and who was affected?
In the library Risks · Controls · Controls in this family
- Domain 12 Skills, Capability & Culture
People competent to build it, challenge it and say no to it.
UK anchor SM&CR fitness · AI Act Art 4
What good looks like
- Do second-line and audit have the capability to challenge AI meaningfully?
- Is there evidence of a use case being stopped or changed on challenge?
- Do the people operating AI understand its limitations well enough to override it?
In the library Risks · Controls · Controls in this family
Generalises to. The twelve domains are sector-neutral; the anchors shown are the UK retail-banking instance. Another regulated sector keeps the domains and substitutes its own accountability regime, conduct rules and model-risk expectations as the anchors.
Part of Responsible AI by design. Companion entry: M-002 The Responsible AI Lifecycle.
Source: Responsible AI by design, portfolio version 1.0 (27 August 2026): the Domain Map and the control assessment in the Practitioner Toolkit.
How to cite
Axiom Verity (2026). The Responsible AI Domain Map. Reference Library, M-001. https://axiom-verity.com/library/models/responsible-ai-domain-map. Reviewed 2026-11-05.
Found an error or a better source? Report a correction.