Education & Guidance (EG) - Processes Assessment

Assessment questionnaire for measuring maturity. Answer each question honestly based on current, implemented practices.

Source of truth: ../practices/EG-Processes-OnePager.md | Canonical framing: ../HAIAMM-v3.0-Framing.md §8 / §12

Education & Guidance (EG) - Processes Domain

HAIAMM Assessment Questionnaire v3.0

Practice: Education & Guidance (EG) Domain: Processes Purpose: Assess organizational maturity in building AI-process literacy for workforce touching AI-embedded business workflows and deep practitioner skills for the reviewer population performing FRIA composition, HITL design assessment, workflow-archetype intake review, and Art. 22 lawful-basis analysis, with shadow-AI-in-processes awareness as the primary L1 cultural outcome. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)

Instructions

Answer each question honestly based on current, implemented practices (not plans or aspirations)
Each question has two components: Evidence (what you did) and Outcome Metrics (how well it worked)
Scoring uses 4 tiers: Fully Mature (1.0), Implemented (0.67), Partial (0.33), Not Implemented (0.0)
Answer progressively - Complete all Level 1 questions before Level 2
Level progression - Achieve ALL questions at lower level before advancing
Baseline first - Record current metric values before setting targets

Scoring Methodology

Score	Label	Criteria
1.0	Fully Mature	Evidence complete AND ≥3 outcome metrics meet targets
0.67	Implemented	Evidence complete AND 2 outcome metrics meet targets
0.33	Partial	Evidence partially complete OR <2 outcome metrics meet targets
0.0	Not Implemented	No evidence of the activity in place

Maturity Level 1

Objective: Deliver foundational AI-process literacy to ≥90% of the workforce touching AI-embedded business workflows and role-based practitioner training to 100% of the reviewer population, with an active shadow-AI-in-processes awareness campaign.

Question 1: Ship workforce AI-process literacy training

Q1.1: Do you have a current-year AI-process literacy course (≤25 minutes) completed by ≥90% of function heads, process owners, product managers, operations managers, and business analysts touching AI-embedded workflows, covering the seven workflow archetypes, EU AI Act Art. 26 deployer duties, Art. 14 human oversight, GDPR Art. 22 automated-decisioning safeguards, HITL design (substantive vs. rubber-stamp), Annex III FRIA triggers, and the intake gate process, with content updated within 30 days of any policy or archetype change?

Evidence Required: - [ ] LMS module published covering the seven AI-embedded workflow archetypes (decision pipeline, customer-facing flow, human-AI collaboration chain, back-office augmentation, approval/review workflow, content-generation workflow, knowledge-management workflow) with org-specific examples - [ ] EU AI Act Art. 26 deployer duties in plain language: organization is the deployer; duties include assigning human oversight, monitoring, informing affected persons, keeping logs for high-risk systems - [ ] EU AI Act Art. 14 human oversight in plain language: substantive vs. rubber-stamp distinction with a concrete 45-second-review-SLA example - [ ] GDPR Art. 22 automated decision-making in plain language: when AI materially drives a significant decision; right to human review, explanation, and contest; mechanism required before go-live - [ ] HITL design module: what makes a human review substantive (time, access to reasoning, real override path, no disincentive); one example per archetype from the trainee's function - [ ] Annex III FRIA trigger check: eight use categories; 30-second recognition check ("does my workflow affect employment, credit, education, biometric, critical infrastructure, law enforcement, immigration, or essential services?") - [ ] LMS completion report showing current-year completion rate across in-scope workforce touching AI-embedded workflows - [ ] Named training content owner with documented quarterly review cadence and evidence of update within 30 days of last policy change

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
% workforce touching AI-embedded workflows with current-year AI-process literacy completion	___%	___%	≥90%	☐
% intake reviewers with completed practitioner training	___%	___%	100%	☐
Reviewer calibration drift, avg tier delta across reviewers on shared samples	___	___	≤1 tier step	☐
Reviewer calibration drift, avg FRIA/HITL assessment mismatches per sample	___	___	≤2 per sample	☐

Metric Collection Guidance: - Workforce literacy completion: LMS current-year completion report filtered to process owners, product managers, operations managers, and business analysts touching AI-embedded workflows. Cross-reference with HR headcount for denominator. Formula: completed_count / in-scope_headcount × 100 - Reviewer training completion: LMS report filtered to the intake-approval-permissions group (AppSec reviewers, Privacy/Legal counsel, Compliance officers, business-unit review representatives). 100% is a pass/fail gate. - Calibration drift, tier: Quarterly exercise where reviewers independently score the same sample workflow intake. Record each reviewer's tier assignment; calculate mean absolute deviation. Source: calibration debrief facilitator record. - Calibration drift, FRIA/HITL mismatches: Same exercise; count FRIA trigger determinations and HITL design adequacy assessments that differ from the facilitated consensus per reviewer per sample; average across reviewers.

Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No AI-process literacy training in place)

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Question 2: Deliver role-based practitioner training for the reviewer population

Q1.2: Has the practitioner population (AppSec reviewers, Privacy/Legal counsel, Compliance officers, business-unit review representatives) completed a role-based training module (~2.5 hours) covering workflow-archetype threat walkthrough, FRIA composition, HITL design assessment, Art. 22 lawful-basis analysis, fairness/bias indicators at the compliance intersection, and sector-specific deep-dives (HR-AI, FinAI, ClinAI), with completion gated on intake-approval permissions and calibration drift inside target for two consecutive quarters?

Evidence Required: - [ ] Workflow-archetype threat walkthrough module: for each archetype, AI output integrity risk, HAI TTP exposure points (EA/AGH/TM/RA), and regulatory-scope assessment (Annex III, Art. 22, sector rules) - [ ] FRIA composition module: seven FRIA sections (workflow description, affected population, decision effects and reversibility, fundamental rights assessment, human oversight design, residual risks, sign-off), Art. 35 trigger determination, FRIA adequacy assessment judgment - [ ] HITL design assessment module: Art. 14 substantive-review evaluation criteria; review-SLA calculation relative to queue size and item complexity; override-rate target ranges by archetype; anchoring-prevention assessment; escalation-path adequacy - [ ] Art. 22 lawful-basis analysis module: three lawful bases (explicit consent, contractual necessity, Union/Member State law); safeguards per basis; right-to-explanation mechanism adequacy - [ ] Fairness/bias indicators at compliance intersection: EEOC disparate-impact indicators, FCRA adverse-action exposure, EU AI Act Art. 9(7) data-quality obligations, flagging for Legal, not for security reviewer to resolve independently - [ ] Sector deep-dives: HR-AI (EEOC, NYC Local Law 144, OFCCP), FinAI (FCRA, CFPB, FINRA, CO SB-21-169), ClinAI (HIPAA, ONC, FDA AI/SaMD) - [ ] Completion gating enforced; calibration exercise records from two consecutive quarters showing drift inside target (≤1 tier step, ≤2 FRIA/HITL mismatches per sample)

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
% intake reviewers with completed practitioner training	___%	___%	100%	☐
Reviewer calibration drift, avg tier delta on shared samples	___	___	≤1 tier step	☐
Reviewer calibration drift, avg FRIA/HITL mismatches per sample	___	___	≤2 per sample	☐
Reviewer throughput, intakes closed per reviewer per week (post-training trend)	___	___	trending up	☐

Metric Collection Guidance: - Practitioner training completion: LMS completion report filtered to intake-reviewer role group. Source: LMS + access-control system confirming permissions are gated on training. - Calibration drift, tier: Independent scoring of shared sample workflow intakes; mean absolute tier deviation across reviewer cohort. Source: quarterly calibration debrief facilitator records. - Calibration drift, FRIA/HITL mismatches: Count of FRIA trigger determination and HITL design adequacy discrepancies per sample versus facilitated consensus; averaged across reviewers. - Reviewer throughput: Workflow intake queue analytics, intakes closed per reviewer per week before and after training rollout. Source: intake queue system.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Question 3: Run the shadow-AI-in-processes awareness campaign

Q1.3: Is a shadow-AI-in-processes awareness campaign running with at least monthly content, a visible amnesty path linked from the AI-in-Business-Process Policy and intake form, measurable attribution of intake submissions and amnesty disclosures to campaign channels, and deployer-duty micro-content for every customer-facing or decision-affecting AI-embedded archetype active in the inventory?

Evidence Required: - [ ] Campaign launch documented: CISO + COO/CRO co-signed executive sponsor message naming shadow AI in processes, amnesty window announced, sanctioned-archetype catalog published; explicit framing that disclosing is safe, not disclosing creates regulatory exposure - [ ] Monthly content cadence evidenced: at least one piece per month targeted to function-team channels (fast-track win, anonymized Art. 22 safeguard caught at intake, external enforcement reframe, new sector HITL-design resource) - [ ] "Is this a decision pipeline?" series documented: call-outs of workflow patterns that may cross the Art. 22 threshold (AI-assisted loan decisions, AI-scored job applications, AI-routed benefit eligibility) with intake-submission instruction - [ ] Amnesty path linked from the AI-in-Business-Process Policy, the intake form, and the function-team Slack/Teams channel pins - [ ] Campaign channel URLs tagged for attribution; intake-queue referrer-source field populated - [ ] Deployer-duty micro-content (Art. 26 human-oversight assignment, customer-facing disclosure mechanism, Art. 22 rights procedure) deployed for every customer-facing or decision-affecting AI-embedded archetype - [ ] Feedback channel with ≤5 BD response SLA for "does this workflow need intake?" queries

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
Shadow-AI-in-processes disclosures per quarter (amnesty path, intake queue tagged "amnesty")	___	___	rises Q1–Q2 then trends down	☐
Intake submissions attributable to campaign channels	___%	___%	≥25% of net-new intakes	☐
% workforce touching AI-embedded workflows with current-year AI-process literacy completion	___%	___%	≥90%	☐
Campaign content cadence met	___	___	≥1 piece/month	☐

Metric Collection Guidance: - Shadow AI in processes disclosures: Count of intake submissions tagged "amnesty" per quarter. Expect increase in Q1–Q2 post-launch and decrease thereafter. Source: intake queue analytics. - Campaign attribution: Percentage of net-new workflow intake submissions arriving via tagged campaign channel links or form-referrer fields. Source: intake queue referrer field; UTM tracking. Note: the Processes domain target is ≥25% (vs ≥30% in other domains, reflecting the more diffuse and harder-to-reach function-team audience). - Workforce literacy completion: Same methodology as Q1.1. Shared metric. - Content cadence: Count of published shadow-AI-in-processes content pieces per calendar month. Source: content calendar or publication log.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Maturity Level 2

Objective: Deepen practitioner skill through scenario-based training from real intake cases, deliver sector-specific tracks (HR-AI, FinAI, ClinAI) calibrated to SM-Processes L2 risk tiers, and run seasonal shadow-AI-in-processes campaigns tied to business planning and regulatory release cycles.

Question 4: Scenario-based reviewer training from real intakes

Q2.1: Is there a scenario library of ≥25 anonymized real intake cases powering practitioner training across the org's in-scope workflow archetypes, with paired calibration exercises showing Critical-tier drift ≤1 tier step and ≤1 FRIA/HITL mismatch per sample for two consecutive quarters, including a practitioner capstone requiring three live end-to-end intakes producing TA snapshot, SR REM, FRIA assessment, and HITL design assessment?

Evidence Required: - [ ] Scenario library of ≥25 scenarios documented, each with as-submitted workflow description, original reviewer decisions (tier, FRIA assessment, HITL design adequacy, Art. 22 lawful-basis analysis, SR gaps), any disagreement, and resolved outcome - [ ] Scenarios organized per archetype (decision-pipeline, customer-facing-flow, HITL-chain, back-office augmentation) and per compliance cluster (Annex III FRIA, Art. 22 automated-decisioning, HITL rubber-stamp, sector-specific) - [ ] Paired calibration exercises in place: two reviewers score the same scenario independently; debrief facilitated on tier delta, FRIA adequacy, HITL design gap list, SR mismatches - [ ] Critical-tier calibration drift records for two consecutive quarters showing ≤1 tier step and ≤1 FRIA/HITL mismatch per sample - [ ] Practitioner capstone in place: practitioners run three live intakes with senior-reviewer shadow and produce passing TA snapshot, SR REM, FRIA assessment, and HITL design assessment - [ ] Scenario library reviewed quarterly with retirement criteria for obsolete intake patterns documented

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
Reviewer calibration drift on Critical-tier scenarios, avg tier delta	___	___	≤1 tier step	☐
Reviewer calibration drift on Critical-tier scenarios, avg FRIA/HITL mismatches	___	___	≤1 per sample	☐
% Critical/High-tier workflows with ≥1 team member trained on applicable sector track	___%	___%	100%	☐
% training content refreshed in last 90 days	___%	___%	≥80%	☐

Metric Collection Guidance: - Critical-tier calibration drift: Quarterly calibration exercise focused on Critical-tier scenarios (decision pipelines, customer-facing flows with Annex III exposure). Record tier assignments, FRIA adequacy determinations, and HITL design assessments independently; calculate mean absolute deviation. Source: calibration debrief facilitator records. - Sector-track coverage: LMS completion records for sector tracks cross-referenced against SM-Processes L2 inventory Critical/High-tier workflows. Formula: workflows_with_trained_practitioner / total_Critical_High_workflows × 100 - Content freshness: LMS content-management change log; count modules updated within the last 90 days.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Question 5: Sector-specific tracks for HR-AI, FinAI, and ClinAI

Q2.2: Have sector-specific training tracks (HR-AI, FinAI, ClinAI) been delivered to ≥1 trained practitioner per Critical/High-tier workflow in each applicable sector, each track covering the sector-specific regulatory obligations and HITL design standards, with sector-track content reviewed quarterly and updated within 30 days of sector-specific enforcement actions or regulatory guidance updates?

Evidence Required: - [ ] HR-AI track developed: AI employment-decision pipelines; EEOC adverse-impact analysis in AI screening context; NYC Local Law 144 bias audit and annual reporting; OFCCP contractor AI obligations; HITL design for employment decisions ("substantive review" at 150 resumes/hour); FRIA composition for Annex III employment use cases; Art. 22 lawful-basis analysis for employment decisions - [ ] FinAI track developed: credit and lending decision pipelines; FCRA adverse-action notice requirements for AI-driven credit decisions; CFPB AI credit guidance; FINRA model-risk documentation; CO SB-21-169 insurance AI; HITL design for high-volume financial decisions; FRIA for Annex III credit use cases - [ ] ClinAI track developed: clinical decision-support AI workflows; HIPAA PHI in clinical AI (BAA, minimum-necessary PHI, audit-log requirements); ONC clinical decision-support guidance; FDA AI/SaMD applicable scope; HITL design standards for clinical decisions (clinical human-oversight vs. administrative HITL); AI-assisted clinical decision documentation - [ ] Each sector track paired with the SA reference pattern for the relevant workflow archetype - [ ] Mandatory enrollment: any team owning a Critical or High-tier workflow in the applicable sector must have ≥1 trained practitioner - [ ] LMS completion records cross-referenced with SM-Processes inventory showing ≥1 trained practitioner per Critical/High-tier workflow - [ ] Sector-track content review cadence documented; evidence of update within 30 days of last sector enforcement action or regulatory guidance update

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
% Critical/High-tier workflows with ≥1 team member trained on applicable sector track	___%	___%	100%	☐
% workforce literacy completion maintained	___%	___%	≥90%	☐
Shadow-AI-in-processes campaign behavior-target achievement rate	___%	___%	≥70% of campaigns	☐
% training content refreshed in last 90 days	___%	___%	≥80%	☐

Metric Collection Guidance: - Sector-track coverage: LMS module completion records filtered to sector-track modules joined against SM-Processes L2 workflow inventory by owning team. Formula: workflows_with_trained_practitioner / total_Critical_High_workflows × 100 - Workforce literacy maintained: Ongoing LMS current-year completion rate; same methodology as Q1.1. Note: Processes domain L1 target is ≥90%. - Campaign behavior-target achievement: For each behavior-driven campaign (e.g., "increase decision-pipeline intake submissions before Q2 OKR sign-off by 40%"), record whether post-campaign measurement met target. - Content freshness: LMS content management change log; modules with last-updated date within 90 days.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Question 6: Seasonal, behavior-driven shadow-AI-in-processes campaigns

Q2.3: Are shadow-AI-in-processes campaigns running on a seasonal, behavior-driven cadence tied to business planning and regulatory release cycles (Q1 OKR planning, major product releases, post-sector-enforcement-action moments, regulatory effective dates), with pre-set measurable behavior targets, post-campaign measurement, ≥70% of campaigns hitting their target, and ≥80% of training content updated in the last 90 days?

Evidence Required: - [ ] At least 2 behavior-driven campaigns run in the last 12 months, each with a documented pre-measured behavior target (e.g., "increase decision-pipeline intake submissions before Q2 OKR sign-off by 40%") - [ ] Post-campaign measurement records for each campaign showing whether the behavior target was met - [ ] Campaign scheduling aligned to process-domain risk windows: Q1 OKR planning, major product releases, post-sector-enforcement-action moments (CFPB credit AI, FTC AI hiring, EEOC AI employment), hiring surges, regulatory effective dates (NYC LL144, CO SB-21-169) - [ ] Amnesty windows running alongside campaigns with attribution tracking - [ ] Campaign redesign process: campaigns missing behavior targets by >20% are redesigned - [ ] Content change log showing ≥80% of training modules updated in last 90 days (including FRIA methodology, HITL design rubric, and sector-specific compliance content)

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
Shadow-AI-in-processes campaign behavior-target achievement rate	___%	___%	≥70% of campaigns hit target	☐
% training content refreshed in last 90 days	___%	___%	≥80%	☐
Reviewer calibration drift on Critical-tier scenarios	___	___	≤1 tier step, ≤1 FRIA/HITL mismatch	☐
% workforce literacy completion maintained	___%	___%	≥90%	☐

Metric Collection Guidance: - Campaign behavior-target achievement: Post-campaign measurement comparing pre-campaign baseline to post-campaign state for each behavior target. Source: intake queue analytics (decision-pipeline submission volume), HR system workflow-disclosure tracking, or equivalent. - Content freshness: LMS content management change log; count modules including FRIA methodology, HITL design rubric, and sector-specific compliance content with last-updated date in the 90-day window. - Calibration drift: Same methodology as Q2.1. - Workforce literacy: Same methodology as Q1.1. Note: Processes domain target is ≥90%.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Maturity Level 3

Objective: Operate continuous calibration at scale, externalize the AI-process curriculum and HITL design reviewer rubric as industry-shared artifacts, and contribute to emerging AI-deployment-officer and AI-process-officer certification pathways.

Question 7: Externalize the curriculum, scenario library, FRIA methodology guide, and HITL design rubric

Q3.1: Has the practitioner curriculum, anonymized scenario library, FRIA methodology guide (for each Annex III use category), and HITL design reviewer rubric been published externally (CSA AI Safety Initiative, ISO/IEC 42005 community, OECD, or sector ISAC) with documented adoption, citations, standards-body reference, or direct acknowledgment, and do contributions loop back into internal content within 30 days?

Evidence Required: - [ ] Workforce AI-process literacy module published externally under permissive license or consortium deliverable (learning objectives, assessment questions, reference-card template) - [ ] Practitioner curriculum published externally (module outlines, sector-track coverage matrix, per-archetype reviewer job aids) - [ ] Anonymized scenario library published (scenario format, per-archetype examples, calibration debrief format) - [ ] FRIA methodology guide published for each Annex III use category (employment, credit, clinical, education, biometric): structure, scope, key fundamental-rights dimensions, sign-off requirements, review frequency - [ ] HITL design reviewer rubric published: substantive vs. rubber-stamp taxonomy, review-SLA calculation, override-rate benchmarks by archetype, anchoring-prevention assessment criteria, escalation-path adequacy scoring - [ ] External adoption evidence: citations, standards-body reference, downloads, direct adoption acknowledgment from ≥1 other organization - [ ] Process documented for external contributions to flow back into internal content within 30 days

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
External adoption, citations, forks, downloads of curriculum/scenario library/FRIA methodology/HITL rubric artifacts	0	___	tracked, trending up	☐
% Critical-tier reviewers holding external AI-deployment-officer or AI-process-governance credential	0%	___%	≥50% by year 2 of L3 (where credential exists)	☐
Monthly live calibration cadence met	___	___	monthly, on calendar	☐
ISO/IEC 42005 / OECD FRIA methodology contributions per year	0	___	≥1 where real-world experience justifies	☐

Metric Collection Guidance: - External adoption: Repository fork/download counts; citation tracker (Google Scholar, ISO/IEC community references, OECD practitioner network acknowledgment); direct outreach acknowledgment records. Tracked quarterly. - External credentials: HR credential registry cross-referenced with Critical-tier workflow reviewer list. Credentials in scope: sector-specific ISAC credentials (FS-ISAC AI Risk, H-ISAC AI Safety), OECD AI Practitioners, ISO/IEC AI management implementer credentials, ISACA AI Audit/AI Risk, public-sector AI-deployment credentials. Formula: credentialed_Critical_tier_reviewers / total_Critical_tier_reviewers × 100 - Live calibration cadence: Calendar entries confirming monthly calibration rounds; facilitator sign-off records per round. - FRIA methodology contributions: ISO/IEC 42005 community submissions or OECD AI practitioners network contributions documenting real-world FRIA implementation experience. Source: contribution log maintained by program lead.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Question 8: Continuous live calibration

Q3.2: Is a monthly live calibration cadence operating, each round using a current anonymized workflow intake from the live queue, independent reviewer scoring of tier/FRIA-adequacy/HITL-design-adequacy/top-3-SR-gaps, drift reported to the program sponsor, with calibration results feeding the scenario library within 30 days and ≥50% of Critical-tier reviewers holding an external credential where one exists?

Evidence Required: - [ ] Monthly calibration calendar entries confirmed for last 12 months (or since L3 initiation) - [ ] Per-round calibration records: anonymized workflow intake used, reviewer cohort, independent scoring results (tier, FRIA adequacy, HITL design adequacy, top-3 SR gaps), drift calculation, facilitator debrief notes - [ ] Drift reported to program sponsor each month with trend over last quarter - [ ] Process documented and evidenced for adding new scenarios to the library within 30 days of calibration rounds revealing drift - [ ] Individual reviewer coaching records for reviewers with persistent drift on specific sector types or FRIA composition (development signal, not performance metric) - [ ] Credential registry showing ≥50% of Critical-tier workflow reviewers credentialed where external credentials exist

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
Monthly live calibration cadence met	___	___	monthly, on calendar	☐
% Critical-tier process reviewers holding external AI-deployment-officer or AI-process-governance credential	0%	___%	≥50% (where credential exists)	☐
Calibration results feeding scenario library within 30 days (% of drift-revealing rounds actioned)	___%	___%	100%	☐
ISO/IEC 42005 / OECD FRIA methodology contributions per year	0	___	≥1 where real-world experience justifies	☐

Metric Collection Guidance: - Live calibration cadence: Program operations calendar; facilitator sign-off records per round. Count calendar months with a completed calibration round in the last 12 months. - External credentials: HR credential registry; count of Critical-tier workflow reviewers with recognized AI-process-governance credential divided by total Critical-tier reviewer count. - Scenario library pipeline: Change log of scenario library; count calibration rounds where drift was identified; count of those rounds resulting in a new scenario added within 30 days. - FRIA methodology contributions: ISO/IEC 42005 community or OECD submission records. Source: contribution log.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Question 9: AI-deployment-officer / AI-process-officer certification contribution

Q3.3: Does the program contribute ≥2 substantive artifacts per year to industry AI-process certification or curriculum working groups (sector-specific ISACs, OECD AI Practitioners, ISO/IEC AI management implementer, ISACA AI Audit/AI Risk), and ≥1 FRIA methodology or HITL design contribution to ISO/IEC 42005 or OECD per year where real-world experience from the org's own FRIA and HITL practice justifies a contribution?

Evidence Required: - [ ] At least 2 substantive contributions per year to industry AI-process certification or curriculum working groups, documented with contribution artifact, working group name, and date - [ ] At least 1 FRIA methodology or HITL design contribution to ISO/IEC 42005 or OECD per year where real-world experience justifies (how many FRIAs completed, what outcome patterns emerged, what gaps in ISO/IEC 42005 guidance the program encountered) - [ ] Org's practitioner capstone aligned with certification-grade rubrics where external AI-deployment-officer credentials exist - [ ] Reviewer external-credential pursuit supported: study resources, exam fee reimbursement, time allocation policy - [ ] Process documented for external working-group outputs to update internal curriculum within 30 days

Outcome Metrics:

Metric	Baseline	Current	Target	Met?
Contributions to industry AI-process certification/curriculum working groups per year	0	___	≥2 substantive	☐
ISO/IEC 42005 / OECD FRIA methodology or HITL design contributions per year	0	___	≥1 where real-world experience justifies	☐
% Critical-tier process reviewers holding external credential	0%	___%	≥50% by year 2 of L3 (where credential exists)	☐
External adoption of curriculum artifacts (citations, forks, downloads)	0	___	tracked, trending up	☐

Metric Collection Guidance: - Industry contributions: Contribution log maintained by program lead; each entry includes contribution type, working group name, submission date, acceptance or publication status. - FRIA/HITL design contributions: ISO/IEC 42005 community or OECD AI practitioners network submissions; contributions document real-world FRIA or HITL implementation observations. Source: FRIA/HITL contribution log. - External credentials: Same methodology as Q3.2. - External adoption: Repository analytics, citation tracker, ISO/OECD acknowledgment records. Trend tracked quarterly.

Evidence Location: _______ Metric Validation Date: ______ Notes: ________

Summary Scorecard

Level	Q1	Q2	Q3	Avg	Level Achieved?
L1	___	___	___	___	☐ Yes ☐ No
L2	___	___	___	___	☐ Yes ☐ No
L3	___	___	___	___	☐ Yes ☐ No

Practice Maturity Statement:

The organization's EG-Processes practice is at Level ___ with an average score of ___.

Level 1 achieved when all L1 questions score ≥0.67 (Implemented)
Level 2 achieved when all L1 questions score 1.0 (Fully Mature) AND all L2 questions score ≥0.67
Level 3 achieved when all L1–L2 questions score 1.0 AND all L3 questions score ≥0.67

Document Version: HAIAMM v3.0 Practice: Education & Guidance (EG) Domain: Processes Last Updated: 2026-05-15 Author: Verifhai

Instructions:

Answer based on current practices, not plans
“Yes” requires documented evidence
Complete all Level 1 questions before Level 2
Partial implementation = “No”

↓ Download as Markdown