Framework
The AI Readiness Tier Framework
A risk-classification model for AI governance in regulated businesses.
Published by Crucible Studio
Most AI initiatives in regulated businesses fail for one reason: the risk of a use case and the level of control applied to it are out of sync. Either AI ships faster than governance can support, or governance is so heavy it blocks all adoption. This framework fixes that mismatch with a single, portable way to classify any AI use case by risk, then apply the right amount of governance, no more and no less.
It is industry-agnostic by design. Classification is built on the mechanics of risk, not on any single regulator's rulebook. Your frameworks (model-risk, privacy, sector-specific) map onto the tiers, not the other way around.
The model: two axes, three tiers
Classify every use case on two axes, then assign a tier.
- ConsequenceHow severe is it if the AI is wrong, incomplete, or biased? Financial loss, legal or regulatory liability, safety, reputational harm.
- ControllabilityHow reversible is the output, and how much can a human see, verify, and veto before it takes effect?
| Tier | Profile | Consequence | Controllability |
|---|---|---|---|
| 1 | Low risk | Low, or internal | High, reversible, human sees output |
| 2 | Moderate risk | Moderate, or customer-facing | Partial, some autonomy, needs review |
| 3 | High risk | High, or a regulated decision | Low, consequential, limited reversibility |
- Tier 1: internal productivityDrafting, summarisation, code assist, search, ideation. Acceptable-use policy, logging, basic model and vendor review.
- Tier 2: customer-facing or analyticalComms, marketing, support automation, model-in-the-loop analytics. Use-case risk assessment, validation against a standard, human-in-the-loop for key outputs, audit logging, model inventory.
- Tier 3: regulated or high-consequence decisionsCredit, underwriting, claims, clinical, compliance/diligence, any automated decision with legal effect. Full model-risk treatment, independent validation, data governance and provenance, monitoring and drift detection, board reporting line, regulator-ready documentation.
Governance ladder, by tier
Governance is a ladder you only climb as high as your use cases demand.
| Governance control | Tier 1 | Tier 2 | Tier 3 |
|---|---|---|---|
| Model and vendor inventory | Yes | Yes | Yes |
| Acceptable-use and access policy | Yes | Yes | Yes |
| Risk assessment per use case (classified, approved) | Yes | Yes | |
| Validation and testing against a standard | Yes | Yes | |
| Human-in-the-loop and override checkpoints | Yes | Yes | |
| Audit logging and traceability | Yes | Yes | |
| Independent validation (by non-build party) | Yes | ||
| Monitoring and drift detection | Yes | ||
| Incident response for AI failure | Yes | ||
| Governance, change control, board reporting line | Yes |
Most businesses over-invest in the top rows for low-risk uses and under-invest in the first six for the rest. The tier model puts the spend where the risk is.
Map the frameworks onto the tiers
The tiers are stable; regulations set the specifics, and the tier is always the floor.
| Tier | Finance (example) | Healthcare (example) | Government (example) |
|---|---|---|---|
| 1 | Internal use policy | — | — |
| 2 | NIST AI RMF, GDPR transparency, PCI data handling | HIPAA data handling, transparency | NIST AI RMF |
| 3 | SR 11-7 / OCC model-risk, SOX controls | FDA (clinical), HIPAA + validation | FedRAMP, DoD CUI handling, independent review |
Specific frameworks vary by business. The tiers stay constant, which is why the model is portable.
How to use it
- Inventory every current and proposed AI use case.
- Classify each on the two axes, then assign a tier.
- Map your regulatory surface to the tiers and confirm the tier is the floor.
- Gap-analyse each tier against the ladder: what is in place, what is missing.
- Sequence the build, Tier 1 first, then 2, then 3, so value ships while governance is established and high-risk work never runs ahead of its controls.
The principle: never let a Tier 3 use case run on Tier 1 controls, and never let Tier 3 governance slow down Tier 1 work. Classify first, then govern precisely.