Compliance & AI Governance

Scope

This governance framework applies to:

• General risk assessments
• Security reporting and executive summaries
• Incident reporting
• AI-generated narrative content within reports

All processes described below are live and operational.

How Risk & Incidents Are Recorded

Structured Reporting

• Risk assessments and incident records use structured forms with defined fields and categories
• Incident records capture factual details such as time, location, incident type, actions taken, and outcomes
• Reports are completed by authorised personnel only

Scoring & Classification (Risk Assessments)

• Risk assessment questions are scored on a fixed 0–4 scale
• Category weighting reflects relative risk impact
• Overall risk levels are calculated automatically and cannot be manually overridden

Incident records do not generate risk scores unless explicitly linked to a risk assessment.

Evidence, Accountability & Auditability

Every record includes:

• The reporting individual
• Date and time of submission
• Structured responses and supporting notes
• Photographic or documentary evidence where provided

Submitted records retain original content

Amendments, where permitted, are logged

This provides a complete audit trail for both risk and incident records.

Use of AI in Reporting

AI is used to summarise and contextualise validated report data.

AI does not:

• Create incident facts
• Determine liability or fault
• Assign or adjust risk scores

AI Inputs & Controls

AI processing is restricted to:

• Submitted risk assessment data or incident records
• Reporter notes and evidence references
• Linked action items
• Approved contextual data where applicable

Controls applied:

• AI cannot invent events, risks, or outcomes
• Narrative output must align with structured data
• Where structured fields conflict with free-text notes, structured data takes precedence

AI Outputs

AI-generated content may include:

• Executive summaries
• Risk or incident overviews
• Identified vulnerabilities or contributing factors
• Follow-up recommendations
• Impact commentary

All outputs are derived directly from submitted data.

Human Oversight & Review

• All risk assessments and incident records are created by human users
• Optional internal review may be enforced before external distribution
• Record status changes are logged and auditable

AI supports clarity and consistency but does not replace human judgement.

Actions & Follow-Up

• Findings may generate follow-up actions
• Actions are linked to the originating assessment or incident record
• Progress and resolution are tracked to support accountability

Privacy & Data Protection

• Personal names, addresses, and identifiers are removed before AI processing
• AI outputs do not contain personal data
• Access is role-based and permission-controlled

Governance Position

Risk assessments and incident reporting combine:

• Human-entered data and decisions
• System-defined structure and calculations
• AI-generated explanatory narrative

AI functions solely as a reporting and summarisation layer.

Responsibility and accountability remain human-controlled at all times.

Summary

This governance framework ensures risk and incident reporting are consistent, auditable, privacy-aware, and operationally actionable, while maintaining clear human oversight and controlled AI usage.