Research programme · Live · Financial services exhibit
Responsible AI by design.
Two conceptual models: twelve domains that must hold true, and an eight-stage lifecycle by which each use case is proven. The requirements matrix, instruments and open curriculum hang from them. Built on a UK retail bank; the domains and stages are sector-neutral.
Updated 2026-11-04 · Andrew Moore
Model one: the Domain Map.
Twelve domains in four bands, each a question a board would ask. The anchors are the UK retail-banking instance of each domain.
Mandate
By what authority, and how far?
- 01 Strategy & Risk Appetite SYSC 4
- 02 Governance & Accountability SM&CR · SMF24 / SMF4
- 03 Regulatory & Legal Compliance Consumer Duty · UK GDPR · EU AI Act
Foundation
What is it built from?
- 04 Data & Data Governance UK GDPR Art 5 · AI Act Art 10
- 05 Model & System Lifecycle PRA SS1/23 · ISO 42001 A.6
- 06 Third Party & Supply Chain SYSC 8 · Critical Third Parties
Conduct
What does it do to customers?
- 07 Fairness & Customer Outcomes PRIN 2A · Equality Act 2010
- 08 Transparency & Explainability UK GDPR Art 22C · AI Act Art 86
- 09 Human Oversight & Contestability UK GDPR Art 22C · AI Act Art 14
Assurance
How do we know, and keep knowing?
- 10 Security & Resilience SYSC 15A · OWASP · MITRE ATLAS
- 11 Monitoring, Assurance & Incidents SS1/23 P4 · 3 lines of defence
- 12 Skills, Capability & Culture SM&CR fitness · AI Act Art 4
Each domain becomes a facet on the risks, controls, framework clauses, tools and terms in the Library, so the map is also a way to browse it.
Model two: the Lifecycle.
Eight stages, each passed on a named artefact. A use case is governed when every gate it has reached has its artefact on record.
- Stage 1:Ideate & screen Screening record
- Stage 2:Assess & tier Risk tier + DPIA
- Stage 3:Design & build Design review
- Stage 4:Validate & assure Validation report
- Stage 5:Approve Approval minute
- Stage 6:Deploy Go-live readiness
- Stage 7:Operate & monitor Outcome MI
- Stage 8:Change or retire Change decision
The loop. A material change at stage 8 re-enters at stage 2. Continuously learning and agentic systems are re-tiered on a cadence. Stage 5 is the SM&CR moment of record.
What the programme is publishing.
In preparation. Each item joins the Library or Learning, and is linked from here, once it is published.
Dataset · Library
Regulatory Requirements Matrix
Obligations mapped to domain, lifecycle stage, evidence expected and source clause, joined to the framework tables.
Tools · Library
Working instruments
AI risk assessment, governance RACI, incident playbook, inventory and tiering, control assessment, vendor due diligence and board MI.
Learning · Board briefing
Fifteen minutes on Responsible AI
The board deck, timed talking points, anticipated questions and the decisions to ask for.
Learning · Open curriculum
Six-part practitioner programme
Foundations, scope, operating model, practice, authority and a capstone, with teaching decks and facilitator notes.
Reference · Model policy
Policy and five standards
Drafted to be adapted, not adopted: every square bracket is a decision.
Brief · Quarterly
Current-awareness brief
The layer designed to go out of date, refreshed each quarter and published through News.