Technology readiness

AI-related risk source: Using AI technologies that are immature or unproven in the intended context brings uncertainty about their behaviour, limits and side effects. The artefact behind the answer is assessment of the maturity of the AI technologies used for the intended purpose. Use technology readiness as a prompt in the identification step, not as a finding.

What it asks

AI-related risk source: Using AI technologies that are immature or unproven in the intended context brings uncertainty about their behaviour, limits and side effects.

Where generative AI changes the answer

Technology readiness matters when a pilot is treated as a production control before anyone has measured how often it is wrong.

Reading it in practice

Technology readiness matters when a pilot is treated as a production control before anyone has measured how often it is wrong. The evidence is the measured error rate on the organisation's own inputs, the scope in which the rate was measured and the decision that followed. A vendor benchmark is not evidence of readiness in this use.

Who it binds

The assessment team that runs identification, and the business owner who knows the use. For B.8 the named role is the owner of assessment of the maturity of the AI technologies used for the intended purpose.

Evidence an auditor normally samples

• Assessment of the maturity of the AI technologies used for the intended purpose

The test you can run

Take assessment of the maturity of the AI technologies used for the intended purpose and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Novel technique deployed in production without evidence of readiness

Before the draft publishes

For B.8, add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present. The first artefact to produce is assessment of the maturity of the AI technologies used for the intended purpose.

Where this sits against the draft

B.8 carries the annex b: ai-related risk sources part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on B.8 (technology readiness) with this record and note the change in the register.