> **Source of truth:** [`../practices/EG-Processes-OnePager.md`](../practices/EG-Processes-OnePager.md) | **Canonical framing:** [`../HAIAMM-v3.0-Framing.md`](../HAIAMM-v3.0-Framing.md) §8 / §12

---

# Education & Guidance (EG) - Processes Domain
## HAIAMM Assessment Questionnaire v3.0

**Practice:** Education & Guidance (EG)
**Domain:** Processes
**Purpose:** Assess organizational maturity in building AI-process literacy for workforce touching AI-embedded business workflows and deep practitioner skills for the reviewer population performing FRIA composition, HITL design assessment, workflow-archetype intake review, and Art. 22 lawful-basis analysis, with shadow-AI-in-processes awareness as the primary L1 cultural outcome.
**Scoring Model:** Evidence + Outcome Metrics (see Scoring Methodology below)

---

## Instructions

- Answer each question honestly based on **current, implemented practices** (not plans or aspirations)
- Each question has two components: **Evidence** (what you did) and **Outcome Metrics** (how well it worked)
- **Scoring uses 4 tiers:** Fully Mature (1.0), Implemented (0.67), Partial (0.33), Not Implemented (0.0)
- **Answer progressively** - Complete all Level 1 questions before Level 2
- **Level progression** - Achieve ALL questions at lower level before advancing
- **Baseline first** - Record current metric values before setting targets

---

## Scoring Methodology

| Score | Label | Criteria |
|-------|-------|----------|
| 1.0 | Fully Mature | Evidence complete AND ≥3 outcome metrics meet targets |
| 0.67 | Implemented | Evidence complete AND 2 outcome metrics meet targets |
| 0.33 | Partial | Evidence partially complete OR <2 outcome metrics meet targets |
| 0.0 | Not Implemented | No evidence of the activity in place |

---

## Maturity Level 1

**Objective:** Deliver foundational AI-process literacy to ≥90% of the workforce touching AI-embedded business workflows and role-based practitioner training to 100% of the reviewer population, with an active shadow-AI-in-processes awareness campaign.

---

### Question 1: Ship workforce AI-process literacy training

**Q1.1:** Do you have a current-year AI-process literacy course (≤25 minutes) completed by ≥90% of function heads, process owners, product managers, operations managers, and business analysts touching AI-embedded workflows, covering the seven workflow archetypes, EU AI Act Art. 26 deployer duties, Art. 14 human oversight, GDPR Art. 22 automated-decisioning safeguards, HITL design (substantive vs. rubber-stamp), Annex III FRIA triggers, and the intake gate process, with content updated within 30 days of any policy or archetype change?

**Evidence Required:**
- [ ] LMS module published covering the seven AI-embedded workflow archetypes (decision pipeline, customer-facing flow, human-AI collaboration chain, back-office augmentation, approval/review workflow, content-generation workflow, knowledge-management workflow) with org-specific examples
- [ ] EU AI Act Art. 26 deployer duties in plain language: organization is the deployer; duties include assigning human oversight, monitoring, informing affected persons, keeping logs for high-risk systems
- [ ] EU AI Act Art. 14 human oversight in plain language: substantive vs. rubber-stamp distinction with a concrete 45-second-review-SLA example
- [ ] GDPR Art. 22 automated decision-making in plain language: when AI materially drives a significant decision; right to human review, explanation, and contest; mechanism required before go-live
- [ ] HITL design module: what makes a human review substantive (time, access to reasoning, real override path, no disincentive); one example per archetype from the trainee's function
- [ ] Annex III FRIA trigger check: eight use categories; 30-second recognition check ("does my workflow affect employment, credit, education, biometric, critical infrastructure, law enforcement, immigration, or essential services?")
- [ ] LMS completion report showing current-year completion rate across in-scope workforce touching AI-embedded workflows
- [ ] Named training content owner with documented quarterly review cadence and evidence of update within 30 days of last policy change

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| % workforce touching AI-embedded workflows with current-year AI-process literacy completion | ___% | ___% | ≥90% | ☐ | |
| % intake reviewers with completed practitioner training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta across reviewers on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg FRIA/HITL assessment mismatches per sample | ___ | ___ | ≤2 per sample | ☐ | |

**Metric Collection Guidance:**
- **Workforce literacy completion:** LMS current-year completion report filtered to process owners, product managers, operations managers, and business analysts touching AI-embedded workflows. Cross-reference with HR headcount for denominator. Formula: `completed_count / in-scope_headcount × 100`
- **Reviewer training completion:** LMS report filtered to the intake-approval-permissions group (AppSec reviewers, Privacy/Legal counsel, Compliance officers, business-unit review representatives). 100% is a pass/fail gate.
- **Calibration drift, tier:** Quarterly exercise where reviewers independently score the same sample workflow intake. Record each reviewer's tier assignment; calculate mean absolute deviation. Source: calibration debrief facilitator record.
- **Calibration drift, FRIA/HITL mismatches:** Same exercise; count FRIA trigger determinations and HITL design adequacy assessments that differ from the facilitated consensus per reviewer per sample; average across reviewers.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No AI-process literacy training in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 2: Deliver role-based practitioner training for the reviewer population

**Q1.2:** Has the practitioner population (AppSec reviewers, Privacy/Legal counsel, Compliance officers, business-unit review representatives) completed a role-based training module (~2.5 hours) covering workflow-archetype threat walkthrough, FRIA composition, HITL design assessment, Art. 22 lawful-basis analysis, fairness/bias indicators at the compliance intersection, and sector-specific deep-dives (HR-AI, FinAI, ClinAI), with completion gated on intake-approval permissions and calibration drift inside target for two consecutive quarters?

**Evidence Required:**
- [ ] Workflow-archetype threat walkthrough module: for each archetype, AI output integrity risk, HAI TTP exposure points (EA/AGH/TM/RA), and regulatory-scope assessment (Annex III, Art. 22, sector rules)
- [ ] FRIA composition module: seven FRIA sections (workflow description, affected population, decision effects and reversibility, fundamental rights assessment, human oversight design, residual risks, sign-off), Art. 35 trigger determination, FRIA adequacy assessment judgment
- [ ] HITL design assessment module: Art. 14 substantive-review evaluation criteria; review-SLA calculation relative to queue size and item complexity; override-rate target ranges by archetype; anchoring-prevention assessment; escalation-path adequacy
- [ ] Art. 22 lawful-basis analysis module: three lawful bases (explicit consent, contractual necessity, Union/Member State law); safeguards per basis; right-to-explanation mechanism adequacy
- [ ] Fairness/bias indicators at compliance intersection: EEOC disparate-impact indicators, FCRA adverse-action exposure, EU AI Act Art. 9(7) data-quality obligations, flagging for Legal, not for security reviewer to resolve independently
- [ ] Sector deep-dives: HR-AI (EEOC, NYC Local Law 144, OFCCP), FinAI (FCRA, CFPB, FINRA, CO SB-21-169), ClinAI (HIPAA, ONC, FDA AI/SaMD)
- [ ] Completion gating enforced; calibration exercise records from two consecutive quarters showing drift inside target (≤1 tier step, ≤2 FRIA/HITL mismatches per sample)

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| % intake reviewers with completed practitioner training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg FRIA/HITL mismatches per sample | ___ | ___ | ≤2 per sample | ☐ | |
| Reviewer throughput, intakes closed per reviewer per week (post-training trend) | ___ | ___ | trending up | ☐ | |

**Metric Collection Guidance:**
- **Practitioner training completion:** LMS completion report filtered to intake-reviewer role group. Source: LMS + access-control system confirming permissions are gated on training.
- **Calibration drift, tier:** Independent scoring of shared sample workflow intakes; mean absolute tier deviation across reviewer cohort. Source: quarterly calibration debrief facilitator records.
- **Calibration drift, FRIA/HITL mismatches:** Count of FRIA trigger determination and HITL design adequacy discrepancies per sample versus facilitated consensus; averaged across reviewers.
- **Reviewer throughput:** Workflow intake queue analytics, intakes closed per reviewer per week before and after training rollout. Source: intake queue system.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No practitioner training in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 3: Run the shadow-AI-in-processes awareness campaign

**Q1.3:** Is a shadow-AI-in-processes awareness campaign running with at least monthly content, a visible amnesty path linked from the AI-in-Business-Process Policy and intake form, measurable attribution of intake submissions and amnesty disclosures to campaign channels, and deployer-duty micro-content for every customer-facing or decision-affecting AI-embedded archetype active in the inventory?

**Evidence Required:**
- [ ] Campaign launch documented: CISO + COO/CRO co-signed executive sponsor message naming shadow AI in processes, amnesty window announced, sanctioned-archetype catalog published; explicit framing that disclosing is safe, not disclosing creates regulatory exposure
- [ ] Monthly content cadence evidenced: at least one piece per month targeted to function-team channels (fast-track win, anonymized Art. 22 safeguard caught at intake, external enforcement reframe, new sector HITL-design resource)
- [ ] "Is this a decision pipeline?" series documented: call-outs of workflow patterns that may cross the Art. 22 threshold (AI-assisted loan decisions, AI-scored job applications, AI-routed benefit eligibility) with intake-submission instruction
- [ ] Amnesty path linked from the AI-in-Business-Process Policy, the intake form, and the function-team Slack/Teams channel pins
- [ ] Campaign channel URLs tagged for attribution; intake-queue referrer-source field populated
- [ ] Deployer-duty micro-content (Art. 26 human-oversight assignment, customer-facing disclosure mechanism, Art. 22 rights procedure) deployed for every customer-facing or decision-affecting AI-embedded archetype
- [ ] Feedback channel with ≤5 BD response SLA for "does this workflow need intake?" queries

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Shadow-AI-in-processes disclosures per quarter (amnesty path, intake queue tagged "amnesty") | ___ | ___ | rises Q1–Q2 then trends down | ☐ | |
| Intake submissions attributable to campaign channels | ___% | ___% | ≥25% of net-new intakes | ☐ | |
| % workforce touching AI-embedded workflows with current-year AI-process literacy completion | ___% | ___% | ≥90% | ☐ | |
| Campaign content cadence met | ___ | ___ | ≥1 piece/month | ☐ | |

**Metric Collection Guidance:**
- **Shadow AI in processes disclosures:** Count of intake submissions tagged "amnesty" per quarter. Expect increase in Q1–Q2 post-launch and decrease thereafter. Source: intake queue analytics.
- **Campaign attribution:** Percentage of net-new workflow intake submissions arriving via tagged campaign channel links or form-referrer fields. Source: intake queue referrer field; UTM tracking. Note: the Processes domain target is ≥25% (vs ≥30% in other domains, reflecting the more diffuse and harder-to-reach function-team audience).
- **Workforce literacy completion:** Same methodology as Q1.1. Shared metric.
- **Content cadence:** Count of published shadow-AI-in-processes content pieces per calendar month. Source: content calendar or publication log.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No campaign running)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

## Maturity Level 2

**Objective:** Deepen practitioner skill through scenario-based training from real intake cases, deliver sector-specific tracks (HR-AI, FinAI, ClinAI) calibrated to SM-Processes L2 risk tiers, and run seasonal shadow-AI-in-processes campaigns tied to business planning and regulatory release cycles.

---

### Question 4: Scenario-based reviewer training from real intakes

**Q2.1:** Is there a scenario library of ≥25 anonymized real intake cases powering practitioner training across the org's in-scope workflow archetypes, with paired calibration exercises showing Critical-tier drift ≤1 tier step and ≤1 FRIA/HITL mismatch per sample for two consecutive quarters, including a practitioner capstone requiring three live end-to-end intakes producing TA snapshot, SR REM, FRIA assessment, and HITL design assessment?

**Evidence Required:**
- [ ] Scenario library of ≥25 scenarios documented, each with as-submitted workflow description, original reviewer decisions (tier, FRIA assessment, HITL design adequacy, Art. 22 lawful-basis analysis, SR gaps), any disagreement, and resolved outcome
- [ ] Scenarios organized per archetype (decision-pipeline, customer-facing-flow, HITL-chain, back-office augmentation) and per compliance cluster (Annex III FRIA, Art. 22 automated-decisioning, HITL rubber-stamp, sector-specific)
- [ ] Paired calibration exercises in place: two reviewers score the same scenario independently; debrief facilitated on tier delta, FRIA adequacy, HITL design gap list, SR mismatches
- [ ] Critical-tier calibration drift records for two consecutive quarters showing ≤1 tier step and ≤1 FRIA/HITL mismatch per sample
- [ ] Practitioner capstone in place: practitioners run three live intakes with senior-reviewer shadow and produce passing TA snapshot, SR REM, FRIA assessment, and HITL design assessment
- [ ] Scenario library reviewed quarterly with retirement criteria for obsolete intake patterns documented

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Reviewer calibration drift on Critical-tier scenarios, avg tier delta | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios, avg FRIA/HITL mismatches | ___ | ___ | ≤1 per sample | ☐ | |
| % Critical/High-tier workflows with ≥1 team member trained on applicable sector track | ___% | ___% | 100% | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |

**Metric Collection Guidance:**
- **Critical-tier calibration drift:** Quarterly calibration exercise focused on Critical-tier scenarios (decision pipelines, customer-facing flows with Annex III exposure). Record tier assignments, FRIA adequacy determinations, and HITL design assessments independently; calculate mean absolute deviation. Source: calibration debrief facilitator records.
- **Sector-track coverage:** LMS completion records for sector tracks cross-referenced against SM-Processes L2 inventory Critical/High-tier workflows. Formula: `workflows_with_trained_practitioner / total_Critical_High_workflows × 100`
- **Content freshness:** LMS content-management change log; count modules updated within the last 90 days.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No scenario library in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 5: Sector-specific tracks for HR-AI, FinAI, and ClinAI

**Q2.2:** Have sector-specific training tracks (HR-AI, FinAI, ClinAI) been delivered to ≥1 trained practitioner per Critical/High-tier workflow in each applicable sector, each track covering the sector-specific regulatory obligations and HITL design standards, with sector-track content reviewed quarterly and updated within 30 days of sector-specific enforcement actions or regulatory guidance updates?

**Evidence Required:**
- [ ] HR-AI track developed: AI employment-decision pipelines; EEOC adverse-impact analysis in AI screening context; NYC Local Law 144 bias audit and annual reporting; OFCCP contractor AI obligations; HITL design for employment decisions ("substantive review" at 150 resumes/hour); FRIA composition for Annex III employment use cases; Art. 22 lawful-basis analysis for employment decisions
- [ ] FinAI track developed: credit and lending decision pipelines; FCRA adverse-action notice requirements for AI-driven credit decisions; CFPB AI credit guidance; FINRA model-risk documentation; CO SB-21-169 insurance AI; HITL design for high-volume financial decisions; FRIA for Annex III credit use cases
- [ ] ClinAI track developed: clinical decision-support AI workflows; HIPAA PHI in clinical AI (BAA, minimum-necessary PHI, audit-log requirements); ONC clinical decision-support guidance; FDA AI/SaMD applicable scope; HITL design standards for clinical decisions (clinical human-oversight vs. administrative HITL); AI-assisted clinical decision documentation
- [ ] Each sector track paired with the SA reference pattern for the relevant workflow archetype
- [ ] Mandatory enrollment: any team owning a Critical or High-tier workflow in the applicable sector must have ≥1 trained practitioner
- [ ] LMS completion records cross-referenced with SM-Processes inventory showing ≥1 trained practitioner per Critical/High-tier workflow
- [ ] Sector-track content review cadence documented; evidence of update within 30 days of last sector enforcement action or regulatory guidance update

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| % Critical/High-tier workflows with ≥1 team member trained on applicable sector track | ___% | ___% | 100% | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥90% | ☐ | |
| Shadow-AI-in-processes campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |

**Metric Collection Guidance:**
- **Sector-track coverage:** LMS module completion records filtered to sector-track modules joined against SM-Processes L2 workflow inventory by owning team. Formula: `workflows_with_trained_practitioner / total_Critical_High_workflows × 100`
- **Workforce literacy maintained:** Ongoing LMS current-year completion rate; same methodology as Q1.1. Note: Processes domain L1 target is ≥90%.
- **Campaign behavior-target achievement:** For each behavior-driven campaign (e.g., "increase decision-pipeline intake submissions before Q2 OKR sign-off by 40%"), record whether post-campaign measurement met target.
- **Content freshness:** LMS content management change log; modules with last-updated date within 90 days.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No sector-specific tracks in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 6: Seasonal, behavior-driven shadow-AI-in-processes campaigns

**Q2.3:** Are shadow-AI-in-processes campaigns running on a seasonal, behavior-driven cadence tied to business planning and regulatory release cycles (Q1 OKR planning, major product releases, post-sector-enforcement-action moments, regulatory effective dates), with pre-set measurable behavior targets, post-campaign measurement, ≥70% of campaigns hitting their target, and ≥80% of training content updated in the last 90 days?

**Evidence Required:**
- [ ] At least 2 behavior-driven campaigns run in the last 12 months, each with a documented pre-measured behavior target (e.g., "increase decision-pipeline intake submissions before Q2 OKR sign-off by 40%")
- [ ] Post-campaign measurement records for each campaign showing whether the behavior target was met
- [ ] Campaign scheduling aligned to process-domain risk windows: Q1 OKR planning, major product releases, post-sector-enforcement-action moments (CFPB credit AI, FTC AI hiring, EEOC AI employment), hiring surges, regulatory effective dates (NYC LL144, CO SB-21-169)
- [ ] Amnesty windows running alongside campaigns with attribution tracking
- [ ] Campaign redesign process: campaigns missing behavior targets by >20% are redesigned
- [ ] Content change log showing ≥80% of training modules updated in last 90 days (including FRIA methodology, HITL design rubric, and sector-specific compliance content)

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Shadow-AI-in-processes campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns hit target | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios | ___ | ___ | ≤1 tier step, ≤1 FRIA/HITL mismatch | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥90% | ☐ | |

**Metric Collection Guidance:**
- **Campaign behavior-target achievement:** Post-campaign measurement comparing pre-campaign baseline to post-campaign state for each behavior target. Source: intake queue analytics (decision-pipeline submission volume), HR system workflow-disclosure tracking, or equivalent.
- **Content freshness:** LMS content management change log; count modules including FRIA methodology, HITL design rubric, and sector-specific compliance content with last-updated date in the 90-day window.
- **Calibration drift:** Same methodology as Q2.1.
- **Workforce literacy:** Same methodology as Q1.1. Note: Processes domain target is ≥90%.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No behavior-driven campaigns in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

## Maturity Level 3

**Objective:** Operate continuous calibration at scale, externalize the AI-process curriculum and HITL design reviewer rubric as industry-shared artifacts, and contribute to emerging AI-deployment-officer and AI-process-officer certification pathways.

---

### Question 7: Externalize the curriculum, scenario library, FRIA methodology guide, and HITL design rubric

**Q3.1:** Has the practitioner curriculum, anonymized scenario library, FRIA methodology guide (for each Annex III use category), and HITL design reviewer rubric been published externally (CSA AI Safety Initiative, ISO/IEC 42005 community, OECD, or sector ISAC) with documented adoption, citations, standards-body reference, or direct acknowledgment, and do contributions loop back into internal content within 30 days?

**Evidence Required:**
- [ ] Workforce AI-process literacy module published externally under permissive license or consortium deliverable (learning objectives, assessment questions, reference-card template)
- [ ] Practitioner curriculum published externally (module outlines, sector-track coverage matrix, per-archetype reviewer job aids)
- [ ] Anonymized scenario library published (scenario format, per-archetype examples, calibration debrief format)
- [ ] FRIA methodology guide published for each Annex III use category (employment, credit, clinical, education, biometric): structure, scope, key fundamental-rights dimensions, sign-off requirements, review frequency
- [ ] HITL design reviewer rubric published: substantive vs. rubber-stamp taxonomy, review-SLA calculation, override-rate benchmarks by archetype, anchoring-prevention assessment criteria, escalation-path adequacy scoring
- [ ] External adoption evidence: citations, standards-body reference, downloads, direct adoption acknowledgment from ≥1 other organization
- [ ] Process documented for external contributions to flow back into internal content within 30 days

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| External adoption, citations, forks, downloads of curriculum/scenario library/FRIA methodology/HITL rubric artifacts | 0 | ___ | tracked, trending up | ☐ | |
| % Critical-tier reviewers holding external AI-deployment-officer or AI-process-governance credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| Monthly live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| ISO/IEC 42005 / OECD FRIA methodology contributions per year | 0 | ___ | ≥1 where real-world experience justifies | ☐ | |

**Metric Collection Guidance:**
- **External adoption:** Repository fork/download counts; citation tracker (Google Scholar, ISO/IEC community references, OECD practitioner network acknowledgment); direct outreach acknowledgment records. Tracked quarterly.
- **External credentials:** HR credential registry cross-referenced with Critical-tier workflow reviewer list. Credentials in scope: sector-specific ISAC credentials (FS-ISAC AI Risk, H-ISAC AI Safety), OECD AI Practitioners, ISO/IEC AI management implementer credentials, ISACA AI Audit/AI Risk, public-sector AI-deployment credentials. Formula: `credentialed_Critical_tier_reviewers / total_Critical_tier_reviewers × 100`
- **Live calibration cadence:** Calendar entries confirming monthly calibration rounds; facilitator sign-off records per round.
- **FRIA methodology contributions:** ISO/IEC 42005 community submissions or OECD AI practitioners network contributions documenting real-world FRIA implementation experience. Source: contribution log maintained by program lead.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No external publication in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 8: Continuous live calibration

**Q3.2:** Is a monthly live calibration cadence operating, each round using a current anonymized workflow intake from the live queue, independent reviewer scoring of tier/FRIA-adequacy/HITL-design-adequacy/top-3-SR-gaps, drift reported to the program sponsor, with calibration results feeding the scenario library within 30 days and ≥50% of Critical-tier reviewers holding an external credential where one exists?

**Evidence Required:**
- [ ] Monthly calibration calendar entries confirmed for last 12 months (or since L3 initiation)
- [ ] Per-round calibration records: anonymized workflow intake used, reviewer cohort, independent scoring results (tier, FRIA adequacy, HITL design adequacy, top-3 SR gaps), drift calculation, facilitator debrief notes
- [ ] Drift reported to program sponsor each month with trend over last quarter
- [ ] Process documented and evidenced for adding new scenarios to the library within 30 days of calibration rounds revealing drift
- [ ] Individual reviewer coaching records for reviewers with persistent drift on specific sector types or FRIA composition (development signal, not performance metric)
- [ ] Credential registry showing ≥50% of Critical-tier workflow reviewers credentialed where external credentials exist

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Monthly live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| % Critical-tier process reviewers holding external AI-deployment-officer or AI-process-governance credential | 0% | ___% | ≥50% (where credential exists) | ☐ | |
| Calibration results feeding scenario library within 30 days (% of drift-revealing rounds actioned) | ___% | ___% | 100% | ☐ | |
| ISO/IEC 42005 / OECD FRIA methodology contributions per year | 0 | ___ | ≥1 where real-world experience justifies | ☐ | |

**Metric Collection Guidance:**
- **Live calibration cadence:** Program operations calendar; facilitator sign-off records per round. Count calendar months with a completed calibration round in the last 12 months.
- **External credentials:** HR credential registry; count of Critical-tier workflow reviewers with recognized AI-process-governance credential divided by total Critical-tier reviewer count.
- **Scenario library pipeline:** Change log of scenario library; count calibration rounds where drift was identified; count of those rounds resulting in a new scenario added within 30 days.
- **FRIA methodology contributions:** ISO/IEC 42005 community or OECD submission records. Source: contribution log.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No continuous live calibration in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 9: AI-deployment-officer / AI-process-officer certification contribution

**Q3.3:** Does the program contribute ≥2 substantive artifacts per year to industry AI-process certification or curriculum working groups (sector-specific ISACs, OECD AI Practitioners, ISO/IEC AI management implementer, ISACA AI Audit/AI Risk), and ≥1 FRIA methodology or HITL design contribution to ISO/IEC 42005 or OECD per year where real-world experience from the org's own FRIA and HITL practice justifies a contribution?

**Evidence Required:**
- [ ] At least 2 substantive contributions per year to industry AI-process certification or curriculum working groups, documented with contribution artifact, working group name, and date
- [ ] At least 1 FRIA methodology or HITL design contribution to ISO/IEC 42005 or OECD per year where real-world experience justifies (how many FRIAs completed, what outcome patterns emerged, what gaps in ISO/IEC 42005 guidance the program encountered)
- [ ] Org's practitioner capstone aligned with certification-grade rubrics where external AI-deployment-officer credentials exist
- [ ] Reviewer external-credential pursuit supported: study resources, exam fee reimbursement, time allocation policy
- [ ] Process documented for external working-group outputs to update internal curriculum within 30 days

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Contributions to industry AI-process certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ | |
| ISO/IEC 42005 / OECD FRIA methodology or HITL design contributions per year | 0 | ___ | ≥1 where real-world experience justifies | ☐ | |
| % Critical-tier process reviewers holding external credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| External adoption of curriculum artifacts (citations, forks, downloads) | 0 | ___ | tracked, trending up | ☐ | |

**Metric Collection Guidance:**
- **Industry contributions:** Contribution log maintained by program lead; each entry includes contribution type, working group name, submission date, acceptance or publication status.
- **FRIA/HITL design contributions:** ISO/IEC 42005 community or OECD AI practitioners network submissions; contributions document real-world FRIA or HITL implementation observations. Source: FRIA/HITL contribution log.
- **External credentials:** Same methodology as Q3.2.
- **External adoption:** Repository analytics, citation tracker, ISO/OECD acknowledgment records. Trend tracked quarterly.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No industry certification contributions)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

## Summary Scorecard

| Level | Q1 | Q2 | Q3 | Avg | Level Achieved? |
|-------|----|----|-----|-----|-----------------|
| L1 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L2 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L3 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |

**Practice Maturity Statement:**

The organization's EG-Processes practice is at **Level ___** with an average score of **___**.

- Level 1 achieved when all L1 questions score ≥0.67 (Implemented)
- Level 2 achieved when all L1 questions score 1.0 (Fully Mature) AND all L2 questions score ≥0.67
- Level 3 achieved when all L1–L2 questions score 1.0 AND all L3 questions score ≥0.67

---

**Document Version:** HAIAMM v3.0
**Practice:** Education & Guidance (EG)
**Domain:** Processes
**Last Updated:** 2026-05-15
**Author:** Verifhai