10-minute visual read
How the EGIM works
From the governance gap to a confirmed maturity level: the structure behind the Ethical Governance Integration Model, and the tools that put it to work.
The governance gap
Most AI governance failures do not happen because organisations lack policies. They happen because policies exist without conviction, oversight has no authority, affected people have no voice, and review follows audit schedules rather than the behaviour of live systems. The EGIM uses the same artefacts as compliance-based governance, but as tools for outcomes rather than as evidence of conformity.
| Aspect | Compliance-based | Values-driven (EGIM) |
|---|---|---|
| Primary orientation | Satisfy the auditor or regulator | Protect the people AI affects |
| Review cadence | Episodic, set by audit cycles | Continuous, set by system behaviour |
| Stakeholder role | Mentioned in policy; consulted after deployment | Represented in decisions before deployment |
| Leadership signal | Approves the policy each year | Accepts delay or cost on ethical grounds |
| What success looks like | A clean audit report | People are protected, and can see that they are |
Five dimensions
Each dimension has ten scored criteria and maps to ISO/IEC 42001. Every topic that touches several dimensions has one owning dimension, so nothing is scored twice.
An AI Ethics Charter that sits above the AI policy: developed with the people it protects, adopted by the governing Board, with named prohibited uses, and built into objectives, incentives and project and procurement gates.
Tiers set by system risk and population vulnerability, with the legal classification as a floor, re-classification triggers, operational human oversight, tested controls and governance of procured AI.
An AI Ethics Board with stop-and-escalate authority and independent members, plus external engagement that scales with the tier and changes decisions.
An integrated algorithmic impact assessment, audit trails across development, operation and incidents, incident management, and redress that can change outcomes.
Monitoring, periodic, triggered and strategic review, an independent ethics concern channel, and an Annual AI Governance Report.
Primary ISO/IEC 42001 anchors, summarised. The guide gives the full clause and Annex A cross-reference.
Risk is set by the system and by who it affects
Every AI system is rated on system risk (S1–S4: consequence, autonomy, reversibility and scale) and population vulnerability (V1–V3: who is affected and their power relative to the organisation). The matrix gives the tier. A system that is high-risk under law is at least Tier 2, and prohibited uses sit outside the matrix altogether.
Organisations may calibrate the matrix upwards, never downwards. An EGIM tier never lowers a legal obligation.
| Tier | Minimum control set | Periodic review |
|---|---|---|
| Tier 0 — Baseline | Inventory entry, classification record, standard IT and data controls | Annually, and on any trigger |
| Tier 1 — Moderate | Plus documented classification rationale and accessible information for affected people | Annually, and on any trigger |
| Tier 2 — Significant | Plus pre-deployment impact assessment, Ethics Board review, monitoring with alert thresholds, operational human oversight, structured consultation and control testing | Every six months, and on any trigger |
| Tier 3 — Severe | Plus participatory design, continuous output sampling and independent assurance at least annually | Quarterly, and on any trigger |
Classifications are not permanent. At every tier, these events require the classification to be reviewed and logged:
Generative and agentic systems also need pre-release evaluation and red-teaming, tested guardrails, grounding for factual uses, least-privilege agent permissions and human approval before consequential actions.
Oversight with authority
The AI Ethics Board is not an advisory panel. For any Tier 2+ system it can approve, impose conditions, stop a deployment or suspend a live system. Its stop binds unless a named leader overrides it on the record — which gives the Board practical force while keeping legal accountability where regulators expect it.
Who sits on the Board
- A chair with no profit-and-loss responsibility
- Technical AI, ethics, legal and domain members
- At least one independent external member, with no material commercial relationship
- Conflicts declared and recusals minuted
External engagement by tier
- Tier 0–1: published information and a complaints route
- Tier 2: structured consultation before deployment
- Tier 3: participatory design and independent review of the impact assessment
Accountability that can be checked
Dimension 4 builds the infrastructure through which an organisation can be held responsible, and through which people harmed can get redress. Its core tool is an algorithmic impact assessment, required before any Tier 2+ deployment and run as one integrated assessment, with data protection and fundamental rights modules where they apply.
The seven-section AIA
- System description
- Affected population profile
- Impact analysis by affected group
- Mitigation measures and residual risk
- Values trade-offs
- Redress and remediation
- Monitoring and review plan
Incidents and redress
- Incidents are contained, classified, notified, investigated, corrected and learned from, as nonconformities under clause 10.2
- Redress is accessible, has published timelines and an independent appeal, and the reviewer can change the outcome
- Audit trails cover development, operation and incidents, with a tested retrieval
Choosing a fairness metric is a values decision: common metrics cannot all be met at once when outcome rates differ between groups. The guide sets out the main options and how to choose.
Continuous review
Governance concentrated in the weeks before an audit is a documentation system. The EGIM runs review at four levels, alongside an ethics concern channel owned independently of the AI governance function.
Maturity and keystones
Fifty criteria are each scored 0–10 in three bands: 0–3 is a critical gap, 4–6 partial, 7–10 effective. Each dimension scores out of 100 and maps to five levels. The assessment triangulates documents, structured interviews and behavioural evidence.
Six keystone criteria each ask for evidence that governance changed something. They gate Levels 4 and 5: every keystone must score 7 or more and no criterion 3 or below for Level 4, and the overall rating also needs keystone evidence from at least two separate events.
D1.5A leader accepted cost, delay or redesign for an ethical reasonD2.10Controls are tested, not assumedD3.4The Ethics Board changed a decisionD3.6Stakeholder input changed a decisionD4.10An impact assessment finding changed a systemD5.7A review finding changed governance or behaviour
Worked example: how caps work
A fictional public-services body from the guide’s Appendix B. Overall score 62 sits in the Level 4 band but is confirmed at Level 3: three keystones are below 7 and two criteria are critical gaps.
Standards and law
ISO/IEC 42001 provides the structure of an AI management system; the EGIM supplies the depth the standard leaves to each organisation. Every dimension maps to the standard’s clauses and all nine Annex A objectives, so EGIM work runs alongside certification preparation.
| ISO/IEC 42001 | Topic | EGIM |
|---|---|---|
| 4.1–4.3 | Context, interested parties, scope | D1, D2, D3 |
| 5.1–5.3 | Leadership, AI policy, roles | D1, D3 |
| 6.1.2–6.1.4, 6.3 | Risk assessment and treatment, impact assessment, changes | D2, D4 |
| 7.2–7.5 | Competence, awareness, communication, documented information | D1, D3–D5 |
| 8.1–8.4 | Operation, risk processes, impact assessment | D2, D4 |
| 9.1–9.3 | Monitoring, internal audit, management review | D5 |
| 10.1–10.2 | Continual improvement, nonconformity | D4, D5 |
Clause topics summarised; refer to the published standard. The guide also maps the EGIM to the EU AI Act as amended in 2026, the NIST AI RMF, ISO/IEC 42005 and 23894, and UK and GCC requirements. References to law are indicative, not legal advice.
An 18-month path
Four phases over 18 months, assuming ISO/IEC 42001 work has started. Systems already live receive an interim impact assessment within 90 days of classification. Organisations with only Tier 0–1 systems can complete a proportionate implementation in about six months.
Readiness
Months 1–2
- Gap assessment
- Inventory and provisional tiers
- Roadmap
Foundations
Months 3–8
- Charter adopted
- Full classification
- Ethics Board and concern channel
- Interim impact assessments
Accountability
Months 9–14
- Full impact assessments
- Audit trails, incidents, redress
- Monitoring and control testing
Maturity
Months 15–18
- Strategic review
- Annual AI Governance Report
- Independent maturity assessment
The aim is Level 3 across all dimensions by the end of Phase 2. Level 4 usually needs a full year of operation to evidence the keystones. At any size, four things are not negotiable: named prohibited uses, an impact assessment before any Tier 2+ deployment, a route to challenge a decision, and a safe channel for staff to raise concerns.
The companion tools
The guide sets out the model, templates and worked examples. Two companions put the maturity assessment into practice.
Comprehensive Implementation Guide
The model, roadmaps, pitfalls, evidence checklists, the full scoring rubric, templates and cross-references. Version 2.0.
Assessment Workbook
Scores all fifty criteria, applies the keystone gates and caps, and builds the maturity profile, critical gap list and action plan.
Interview Question Sets
Questions for seven interview groups with follow-up probes, mapped to every criterion, plus interview and divergence log templates.