Review bands

The five scores sum to a total between 5 and 25. The total measures the magnitude of risk and impact. A high score calls for more scrutiny and stronger safeguards, not automatic rejection. The cut-offs used here (5–10, 11–15, 16–20, 21–25) are representative; your institution may set different thresholds. The band then sets how formal the review process should be (see proportionality).

Every initiative lands somewhere on one 5–25 scale. The band sets how much scrutiny it needs: the higher the total, the stronger the safeguards.

Reading a total

Example: the early warning system scores 17, High. Strong strategic fit (4) and operational potential (4), with moderate ethics, financial, and stakeholder scores (3 each). It should proceed only with strong safeguards and ongoing monitoring. See the full example.

Bands are a starting point for discussion, not a verdict. Two initiatives with the same total can carry very different risk profiles, so read the individual dimension scores and comments alongside the band.

Early warning system: 17Value-led: high strategic fit and operational gain, moderate risk across ethics, cost, and trust.
Initiative B (illustrative): 17Risk-led: modest value, but critical ethics and stakeholder exposure. Same band, very different conversation.
Same total, different shape. Plot the five scores to see where an initiative's risk and value actually sit.

Proportionality: match the process to the stakes

The formality of review should match the risk and scope of the initiative. A low-risk pilot shouldn't wait months for a committee; a high-stakes system shouldn't get a quick sign-off. Too much process for small ideas drives people around governance. Too little for big ones exposes the institution.

Formality, documentation, and time to decision all scale with the band. The rubric is the same for every initiative; the process around it is not.
ElementLowModerateHighCritical
Review formatSelf-assessment with unit leadOne cross-functional meetingFull team plus specialist reviewsExtended review; affected groups consulted
DocumentationScored rubric and short descriptionRubric, comments, draft KPIs & OKRsAll of that plus efficacy plan, exit criteria, risk mitigationsAll of that plus alternatives analysis and impact assessment
Specialist inputOnly if flaggedAs needed (e.g., privacy)Privacy, security, legal, accessibilityAll relevant specialists, in writing
DecidesUnit leadAI governance leadAI governance councilExecutive sponsors
Target time to decisionDaysAbout 2 weeksAbout 4–6 weeksAs long as needed
Monitoring & re-reviewEnd of pilotMid- and end-of-pilotOngoing; at least annuallyOngoing; time-limited approval

Scope counts, not only risk

The same tool can need more formality as it grows. A chatbot for one course is not the same as one for every student. Expanding scope to more people, more data, or more units is a re-review trigger.

Severity overrides the total

Proportionality uses the total, but one severe dimension is enough to raise formality. A 5 on ethics or stakeholder impact escalates one level, whatever the total.

Band cut-offs, timeframes, and documentation levels are illustrative. Set them to fit your institution's capacity, and publish them so proposers know what to expect. Your governance structure also shapes them: a centralized model tends toward more formality for every band, a distributed one toward less.

Quick referenceProportionality (PDF)