What Systems Should Be Assessed
Not every AI-enabled system requires an ARAF assessment. ARAF assesses autonomous systems: systems capable of producing consequential decisions or actions without per-decision human authorship.
The threshold question is institutional consequence: does the system produce outcomes that affect customers, counterparties, regulators, or the organisation itself in ways that require governance accountability if challenged?
Identification Test
Section titled “Identification Test”For each system in the organisation’s technology portfolio, ask four questions:
- Does this system make decisions without requiring human authorisation for each individual decision?
- What is the maximum financial or operational commitment this system can make autonomously?
- If this system produced an adverse outcome, would a board, insurer, regulator, or court ask who was responsible, what they knew, and what they did?
- Could the organisation reconstruct, from contemporaneous records, how this system produced any given decision?
A system that triggers questions 1 through 3 but cannot satisfy question 4 is a system that requires governance architecture. An ARAF assessment evaluates whether that architecture exists and whether it is adequate.
Typical Scope Outcomes
Section titled “Typical Scope Outcomes”Systems that typically require assessment
Section titled “Systems that typically require assessment”- Automated credit decision engines
- AI agents executing operational tasks at scale
- Algorithmic trading or pricing systems
- Automated procurement or vendor management systems
- AI-assisted underwriting or claims processing systems
- Autonomous customer service systems making binding commitments
- Content generation systems whose outputs carry legal or regulatory consequences
- Systems now making decisions previously made by licensed or liable professionals
Systems that typically do not require assessment
Section titled “Systems that typically do not require assessment”- Internal productivity tools where a human approves each output before external effect
- Analytics dashboards that inform human decisions but do not execute them
- Infrastructure automation that does not produce externally consequential decisions
Portfolio Scoping
Section titled “Portfolio Scoping”Organisations with multiple autonomous systems should run a portfolio identification exercise before scoping individual assessments.
An adequate portfolio answer identifies each material autonomous system by name and operational function, specifies the decisions it makes autonomously, states its autonomy level, and confirms whether it has been classified against a defined framework.
Start with the system that creates the highest governance exposure, usually the highest combination of autonomy level and decision volume. Assessing that system first produces the greatest immediate governance return and establishes reusable internal processes for subsequent assessments.