The problem it solves

Objective Keep control in place as technology changes and new uses appear.

AI changes. The control model has to change too.

What was organised once goes stale: new tools arrive and the rules move.

Questions it answers

  • How do we monitor and scale sustainably?
  • How do we scale useful cases without creating unnecessary exposure?
  • How often is it reviewed?

Signs your organisation is at this stage

  • New tools arrive and the rules move.
  • The risk register has no review date.

What AGORA does

  • Defines with the organisation the review cadence and the evidence for each control.
  • When the scope includes it, organises follow-up with AGORA's platform: control status, associated evidence and pending reviews.

Deliverables

  • Review cadence.
  • Change log.
  • Control follow-up.
  • Inventory updates.
  • Verifiable reports.
  • Criteria to scale or stop uses.

The scope of this stage is defined with the organisation: it is not a fixed package.

Who needs to take part

  • The owners of each control.
  • Leadership, which receives the reports.

Indicative duration

Recurring: when the system changes, when the rules change or on the agreed cadence.

Exit criterion

  • It has no fixed end: it holds as long as there are AI uses in operation.
  • Every new or changed use goes through the criteria to scale or stop it.

Next step

Not a compulsory process

You do not have to go through the six stages in order, or engage work at every stage. An organisation with systems already in production can come in at Govern or Operationalise; one that is just exploring usually starts by understanding and assessing.