Production AI Institute · Public recordRecord
The Standard›PAI-8 Organisational Governance
PAI-8 · Governance standard · 2026

The organisational control model for AI governance

PSF defines safe AI deployment at the system level. PAI-8 defines the governance, audit, incident, and vendor controls an organisation must operate around those systems. Eight controls, four maturity levels, public evidence.

Read the 8 controls →Run self-assessmentRead the PSF
8governance controls
4maturity levels
C1-C8audit evidence model
PAI-8 and PSF are parallel standards, not replacements. PSF (D1-D8) governs technical deployment safety. PAI-8 (C1-C8) governs organisational governance maturity. Mature programmes need both layers.
Read the PSF →
If PAI-8 made the gap obvious

Pick the next proof step.

A governance standard only converts when the reader can turn it into evidence, a team motion, or a client-ready service.

Disclose

Publish an AI System Disclosure.

State what your systems do with data and decisions. This governance step costs nothing and builds trust first.

Publish disclosure →
Map

Map vendors against the controls.

Use the vendor control mapper to see which PAI-8 and PSF controls your stack covers and which remain yours.

Map a vendor →
Interpret

Read PAI-8 alongside the public record.

Governance signals in the record (incidents, disclosures, and policy changes) are mapped to the controls they implicate.

Open record explorer →

The 8 PAI-8 Controls

Each control addresses a distinct category of organisational AI risk. Assessment scores each control L0–L3 against the maturity model.

C1
AI Governance

Formal accountability for AI risk at board and executive level, with documented policies, decision gates, and a register of all AI use cases.

✓Board-level AI risk accountability documented
✓AI ethics/safety policy published and operationally embedded
✓AI use case registry maintained
✓Governance decision gates applied to all new AI deployments
C2
Risk Assessment

Formal AI risk assessment before any new system deployment, with risk tiering, third-party AI inclusion, and regular reassessment as systems change.

✓Risk assessment required before deployment
✓Low/medium/high/critical risk tiers documented
✓Third-party AI included in procurement risk process
✓Reassessment triggered by material system changes
C3
Data Stewardship

Provenance, consent, and lifecycle management for all data used to train or operate AI systems, including vector databases and fine-tuning datasets.

✓Training data provenance documented
✓Consent or lawful basis established for AI data use
✓PII handling procedures for AI pipelines
✓Data retention and deletion policies cover AI artefacts
C4
Model Validation

Pre-deployment evaluation against production-representative benchmarks, including bias testing and independent review for high-risk use cases.

✓Pre-deployment evaluation report required before go-live
✓Bias and fairness evaluation for high-risk use cases
✓Independent review for critical AI deployments
✓Post-deployment performance monitoring in place
C5
Human Oversight

Defined autonomy limits, operational override mechanisms, escalation paths, and documented human intervention capability for all AI systems.

✓Autonomy scope defined for each AI system
✓Override mechanism documented and staff trained on use
✓Escalation path for anomalous AI behaviour
✓Override events logged and reviewed
C6
Incident Response

AI-specific incident classification taxonomy, severity tiers for AI harms, response runbooks, and post-incident review processes.

✓AI incident taxonomy separate from generic IT incidents
✓Response SLAs calibrated to AI harm severity
✓Post-incident review required for significant AI incidents
✓Regulatory notification assessment for AI incidents
C7
Audit Trail

Decision-level logging for AI outputs, log retention aligned to challenge windows, and explainability artefacts for high-risk decisions.

✓Decision-level logging schema captures inputs, model, output, timestamp
✓Log retention policy covers legal challenge window
✓Explainability artefacts for high-risk decisions
✓Immutable audit trail: logs cannot be altered post-hoc
C8
Vendor & Supply Chain

Inventory of all third-party AI dependencies, vendor risk assessment, contractual AI continuity protections, and tested fallback capability.

✓Inventory of all third-party AI components maintained
✓Vendor risk assessment for all AI service providers
✓AI safety and continuity requirements in vendor contracts
✓Continuity plan for critical AI dependencies tested annually

Maturity Levels

Each of the 8 controls is scored L0–L3. A PAI-8 assessment produces a per-control maturity score and an overall governance posture rating.

L0
Unprepared
No formal AI safety controls. AI is deployed without governance, assessment, or documentation. Material risk of regulatory, reputational, or operational harm.
L1
Basic
Controls are documented but inconsistently operational. Policies exist on paper but are not embedded in decisions. Evidence is sparse or absent.
L2
Managed
Controls are operational with documented process, regular cadence, and evidenced application to real decisions. Suitable for most regulated environments.
L3
Optimised
Controls are continuously improved with metrics, benchmarking against sector peers, and board-level governance review. Industry-leading posture.
Not sure where your organisation sits?
Commission a PAI-8 Assessment →

PAI-8 and PSF: Parallel standards

The two frameworks address different layers of AI safety. Neither replaces the other; a complete AI safety posture requires both.

PSF: Production Safety Framework
Technical deployment layer
  • ›What the system does: inputs, outputs, data, monitoring
  • ›D1-D8 technical domains with 40 criteria
  • ›Framework tools and stacks are assessed against
  • ›Open, citable, and free to apply; no permission required
Read the PSF →
PAI-8: Organisational Governance Standard
Organisational governance layer
  • ›What the organisation does: policies, oversight, audit
  • ›C1-C8 governance controls with L0-L3 maturity scoring
  • ›Framework organisations are audited against
  • ›Maturity scoring: L0-L3 across C1-C8
How to cite PAI-8 →
Domain mapping: PSF ↔ PAI-8
PSF D1 Input Governance↔PAI-8 C2 Risk Assessment
PSF D3 Data Protection↔PAI-8 C3 Data Stewardship
PSF D4 Observability↔PAI-8 C7 Audit Trail
PSF D5 Deployment Safety↔PAI-8 C4 Model Validation
PSF D6 Human Oversight↔PAI-8 C5 Human Oversight
PSF D7 Security↔PAI-8 C6 Incident Response
PSF D8 Vendor Resilience↔PAI-8 C8 Vendor & Supply Chain
PSF D2 Output Validation↔PAI-8 C4 Model Validation

Work with PAI-8

PAI-8 is open and free to apply. Use it internally, cite it in governance documentation, and map it to the evidence in the public record.

Read the PSF →For institutional review, contact PAIVersion history