Assess → Prevent → Prove → Detect. The cross-cutting controls that keep AI use safe, scaled to risk.
The six disciplines describe what an organisation must be good at. The four pillars describe how it stays in control while doing it. Every discipline page states which pillar controls apply at each risk tier.
Controls are proportionate. Each piece of work gets a tier from four criteria: blast radius, reversibility, data sensitivity and regulatory exposure. The highest criterion sets the tier. Tiers are assigned when work is planned, so the rules are known before anything is generated.
| Tier | Typical work | Delegation gate | Minimum controls |
|---|---|---|---|
| Low | Docs drafts, test scaffolding, internal tooling; reversible, no sensitive data | Auto-approve | Automated checks pass; provenance recorded |
| Medium | Production code and configuration with normal blast radius and standard rollback | Human review | One qualified reviewer; pipeline gates; provenance |
| High | Security, access control, customer data, financial logic, wide-blast-radius infrastructure | Human review, enhanced | Two reviewers incl. a specialist; evidence bundle; enhanced monitoring after release |
| Critical | Irreversible or regulatory-significant actions: key management, production data deletion, decisions about people, safety functions | Human only | AI may inform, never decide or act; documented rationale; second-line oversight |
The tiers follow the EU AI Act's risk-based approach but do not map one-to-one. The Act classifies AI systems by their use (prohibited, high, limited, minimal risk); ScaledAIOps tiers classify work. A low-risk coding assistant can still be used on critical-tier work, and the tier of the work governs.
The AI Adoption Maturity Model scores each of the six disciplines on five levels, from Ad hoc to Optimised. It turns "how are we doing with AI?" into a profile with a next step per discipline.
Preventive controls decide what AI may access, do and decide. They are enforced by tools and pipelines wherever possible, not only written in policy.
Provenance of AI-generated work: what generated it, from which context, and who approved it. It is kept in the systems of record the organisation already has, not in a separate store.
A working audit trail answers four questions in minutes: which changes were AI-assisted; who approved them; what context the AI had; and what AI did during an incident.
Detective controls watch AI-assisted work over time and escalate when it drifts.
Thresholds are agreed in advance. Crossing one tightens delegation for the affected work until the cause is understood.
| Pillar | ISO/IEC 42001 | EU AI Act |
|---|---|---|
| Assess | Performance evaluation (clause 9) | No direct obligation; shows readiness for Art. 4 (AI literacy) and Art. 26 |
| Prevent | Planning and operation (clauses 6 and 8) | Deployer duties for high-risk systems (Art. 26) |
| Prove | Documented information (clause 7.5) | Keeping the logs of high-risk systems (Art. 26) |
| Detect | Monitoring and improvement (clauses 9.1 and 10) | Monitoring the operation of high-risk systems (Art. 26) |
Mappings are orientation, not legal advice, and stay tool-agnostic. Most AI tools used in delivery are not high-risk systems under the Act, but AI used to evaluate or monitor workers is (Annex III, point 4); that is one reason ScaledAIOps measures teams and flow, never individuals.