Policy & Compliance (PC) - Infrastructure Domain

HAIAMM Assessment Questionnaire v3.5

Generated from cells/PC-Infrastructure-L*.cell.json. Do not edit by hand. Canonical model: HAIAMM-v3.5-Framing.md · Handbook: HAIAMM-v3.5-Handbook.md.

---

Practice: Policy & Compliance (PC) Domain: Infrastructure Business Function: Governance Purpose: Publish the priority compliance map and the minimum policy stack governing the infrastructure AI/HAI systems run on, so every obligation reaches a named policy and a named owner. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)

---

Instructions

• Answer from current, implemented practice, not plans or aspirations.
• Each question has two components: Evidence (what you did) and Outcome Metrics (how well it worked).
• Levels are derived, never self-assigned. Record evidence and metric values; the level falls out of the scoring below.
• Silence is not a pass. A metric you cannot produce is left blank and counts as not met. Do not estimate.
• Answer progressively. Complete all Level 1 questions before Level 2.

Evidence grade

Record how each answer is known, not only what is claimed (v3.5 framing §6). A level claim is graded at its weakest field.

Grade	Meaning
E0	Asserted by a practitioner, unevidenced
E1	Asserted, with a link to a named artifact
E2	Emitted by a system as telemetry
E3	Machine-attested and independently checkable

---

Scoring Methodology

Tier	Score	Criteria
Fully Mature	1.0	Evidence complete + ≥3 outcome metrics meet targets
Implemented	0.67	Evidence complete + 2 outcome metrics meet targets
Partial	0.33	Evidence partially complete + <2 outcome metrics meet targets
Not Implemented	0.0	No substantive evidence of practice

Practice maturity level achieved = the highest level where all 3 questions score ≥ 0.67.

---

Maturity Level 1, Foundational

Objective: Publish the priority compliance map and the minimum policy stack governing the infrastructure AI/HAI systems run on, so every obligation reaches a named policy and a named owner.

Prerequisite cells: SM-Infrastructure-L1

Question L1.1: Publish the priority compliance map

Q1.1: Is there a published one-page priority compliance map tracing every in-scope obligation governing the infrastructure AI/HAI systems run on to a specific policy clause, an accountable owner, an evidence artifact and the practice that produces it?

Evidence Required:

• [ ] Produce a one-page priority compliance map covering the obligations that actually apply to the infrastructure AI/HAI systems run on: EU AI Act Art. 15 accuracy robustness and cybersecurity
• [ ] GDPR Art. 32 security, plus any sector-specific rules in scope
• [ ] Each row names the obligation, the specific clause of the internal policy that implements it, the accountable owner, the evidence artifact that demonstrates conformance, and the practice that produces that evidence
• [ ] The map is one page by design
• [ ] A compliance register of two hundred rows is a document nobody reads and nobody maintains, whereas a one-page map that traces the obligations a regulator is actually likely to ask about is a document that survives contact with an audit
• [ ] Review it quarterly and whenever a new obligation enters scope, and treat an obligation with no named evidence artifact as an open finding rather than as a row to be filled in later

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.2: Publish the AI Infrastructure Standard and the supporting policy stack

Q1.2: Is the AI Infrastructure Standard published with requirements written so conformance is observable, routed through the enterprise policy review cycle, carrying a review interval of at most 12 months, and acknowledged by at least 95% of the in-scope population?

Evidence Required:

• [ ] Publish an AI Infrastructure Standard covering permitted hosting regions and residency, accelerator provisioning authority, model registration and promotion requirements, inference endpoint exposure rules, and the hardening baseline each archetype must meet
• [ ] Write each requirement so that conformance is observable: a rule stating that AI must be used responsibly cannot be assessed, whereas a rule naming the seven infrastructure archetypes, being inference endpoint, model registry, accelerator fleet, orchestrator and control plane, vector-store infrastructure, AI-specific CI/CD and feature store and stating what is permitted for each can be
• [ ] Route the policy through the same approval and review cycle as the enterprise security policy stack rather than creating a parallel governance path, and set an explicit review interval of at most 12 months
• [ ] Publish a short summary aimed at the population that must follow it, because a policy that requires reading twenty pages to answer a five-second question will be guessed at instead
• [ ] Establish an exception process with a named approver, a required rationale, a mandatory expiry date and a register, since undocumented exceptions are how policy stacks quietly become fiction

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.3: Attest the population and baseline conformance

Q1.3: Does an exception process operate with named approvers, mandatory rationale and expiry dates and a register carrying no expired entries, and are policy requirements reconciled against infrastructure-as-code definitions and cloud configuration state with divergences raised as findings?

Evidence Required:

• [ ] Run an attestation campaign across the in-scope population, delivered through the existing human resources or learning system so that completion is recorded where compliance evidence already lives
• [ ] Track coverage as a percentage of the in-scope population rather than as a count of completions, because the denominator is what an auditor asks for
• [ ] Baseline three conformance measures in the first quarter: the share of obligations on the map carrying a named evidence artifact, the share of the population with a current acknowledgement, and the count of active exceptions with their age distribution
• [ ] Reconcile the map against infrastructure-as-code definitions and cloud configuration state to confirm that what the policy requires is what the environment actually does, and record every divergence as a finding with an owner rather than as a note
• [ ] Report all three to the executive sponsor quarterly

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 1 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Priority compliance map obligations carrying a named policy clause, owner and evidence artifact	___	___	100% of mapped obligations within 6 months	☐
In-scope population with a current acknowledgement of the AI Infrastructure Standard	___	___	≥95% of the in-scope population	☐
Active policy exceptions carrying a rationale, named approver and expiry date	___	___	100%, with zero exceptions past expiry	☐
Policy requirements reconciled against the operating environment	___	___	≥90% of requirements verified against infrastructure-as-code definitions and cloud configuration state, with divergences raised as findings	☐
Obligations on the map with no evidence-producing practice identified	___	___	0	☐

Where each number is read from:

• Priority compliance map obligations carrying a named policy clause, owner and evidence artifact — Priority compliance map reviewed against the policy stack
• In-scope population with a current acknowledgement of the AI Infrastructure Standard — HR / LMS attestation records
• Active policy exceptions carrying a rationale, named approver and expiry date — Exception register
• Policy requirements reconciled against the operating environment — Reconciliation report joined to the issue tracker
• Obligations on the map with no evidence-producing practice identified — Priority compliance map coverage review

Level 1 30-second check (E0)

• ☐ Yes ☐ No — Is there a written policy covering the infrastructure AI/HAI systems run on?
• ☐ Yes ☐ No — Could you show which internal policy implements a specific regulatory obligation?
• ☐ Yes ☐ No — Do your policy exceptions have expiry dates?

---

Maturity Level 2, Comprehensive

Objective: Calibrate policy depth and evidence requirements to the risk tier of each infrastructure asset, and assemble tier-specific evidence packs that can be produced on demand.

Prerequisite cells: PC-Infrastructure-L1, SM-Infrastructure-L2

Question L2.1: Calibrate policy requirements per tier

Q2.1: Are policy requirements calibrated by the SM L2 risk tier, stating for each tier what controls are mandatory, what review cadence applies, what approval authority an exception requires and what evidence must exist? Evidence this in the Infrastructure domain against the AI Infrastructure Standard and the residency position for one production endpoint.

Evidence Required:

• [ ] Extend the L1 policy stack with tier-differentiated requirements keyed to the SM L2 rubric
• [ ] For each requirement, state what Critical, High, Medium and Low each owe: which controls are mandatory versus recommended, what review cadence applies, what approval authority an exception requires, and what evidence must exist
• [ ] A Critical-tier the infrastructure AI/HAI systems run on might owe a documented conformance assessment, an annual independent review and a named accountable executive, where a Low-tier one owes an intake record and an annual self-attestation
• [ ] Publishing the difference is what prevents the two failure modes that follow from uniform policy: either every asset carries Critical-tier burden, which makes the policy unenforceable and drives teams around it, or every asset carries Low-tier burden, which leaves the Critical ones under-governed
• [ ] Route tier-calibrated requirements through the same approval cycle as the base policy
• [ ] In this domain tier calibration turns mainly on exposure and residency: an internet-reachable inference endpoint in a third country carries obligations that an internal batch-scoring host does not, and the difference is a property of the deployment rather than the model

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.2: Build bidirectional control mappings and tier-specific evidence packs

Q2.2: Do bidirectional control mappings exist so that a failing or deferred control immediately names the obligations it leaves unevidenced, and do tier-specific evidence packs get refreshed on cadence rather than assembled on request? For Infrastructure, the assessor should be shown the AI Infrastructure Standard and the residency position for one production endpoint.

Evidence Required:

• [ ] Map each obligation on the priority compliance map to the specific controls that satisfy it, and map each control back to the obligations that depend on it
• [ ] The reverse direction is the one usually missing and the one that matters operationally: when a control fails or is deferred, the programme needs to state immediately which obligations are now unevidenced, rather than discovering it during the next audit
• [ ] Assemble an evidence pack per tier specifying exactly which artifacts constitute conformance, drawn from infrastructure-as-code definitions and cloud configuration state and from the outputs of TA, SR, DR, IR, ST and ML. Automate collection where the artifact already exists in a system of record, and set a service level for producing a complete pack on request, targeting 10 business days at Critical tier
• [ ] An evidence pack assembled only when asked for is a pack that will be incomplete the one time it matters
• [ ] The evidence pack for infrastructure draws on infrastructure-as-code definitions, cloud configuration state and change records, all of which are machine-readable and therefore the cheapest evidence in the model to automate

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.3: Operate regulatory change management and tiered exceptions

Q2.3: Does a named owner assess every regulatory change for applicability within 30 days of publication and open tier-prioritised remediation work items, and are exceptions tier-calibrated in approval authority, duration and review cadence? In Infrastructure, ask to see the AI Infrastructure Standard and the residency position for one production endpoint.

Evidence Required:

• [ ] Establish a defined path from a regulatory change to the assets it affects
• [ ] Assign a named owner to monitor the in-scope obligation sources, assess each change for applicability within 30 days of publication, identify the affected assets by tier, and open remediation work items with owners and dates
• [ ] Without this, regulatory change arrives through whoever happens to read an update, which is neither reliable nor auditable
• [ ] Calibrate the exception process by tier: a Critical-tier exception requires executive approval, a shorter maximum duration and quarterly review, where a Low-tier exception can be approved by the practice lead with an annual review
• [ ] Report exception volume and age by tier to the sponsor, and treat a rising Critical-tier exception count as a signal that the policy is mis-calibrated rather than that teams are non-compliant
• [ ] Regulatory change in this domain most often arrives as accuracy, robustness and cybersecurity guidance under Art. 15, which lands on the serving and hardening configuration rather than on the application

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 2 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Policy requirements carrying a published tier calibration	___	___	100% of requirements where tier differentiation is meaningful	☐
Critical- and High-tier assets with a current, complete evidence pack	___	___	≥95% of Critical, ≥85% of High	☐
Time to produce a complete evidence pack on request at Critical tier	___	___	≤10 business days	☐
Obligations with a bidirectional control mapping	___	___	100% of mapped obligations	☐
Regulatory changes assessed for applicability within 30 days of publication	___	___	100%	☐
Critical-tier exceptions carrying executive approval and a review within the quarter	___	___	100%	☐

Where each number is read from:

• Policy requirements carrying a published tier calibration — Policy stack tier-calibration review
• Critical- and High-tier assets with a current, complete evidence pack — Evidence pack register joined to the asset inventory
• Time to produce a complete evidence pack on request at Critical tier — Evidence request log with timestamps
• Obligations with a bidirectional control mapping — Control mapping register
• Regulatory changes assessed for applicability within 30 days of publication — Regulatory change log with assessment dates
• Critical-tier exceptions carrying executive approval and a review within the quarter — Exception register joined to asset tier

Level 2 30-second check (E0)

• ☐ Yes ☐ No — Do your highest-risk AI assets carry stricter policy requirements than the rest?
• ☐ Yes ☐ No — Could you produce a complete evidence pack for a regulator within two weeks?
• ☐ Yes ☐ No — Does someone own watching for regulatory changes that affect your AI?

---

Maturity Level 3, Industry-Leading

Objective: Generate compliance evidence continuously from the operating environment, prove conformance by assertion rather than assembly, and engage in the regulatory process for the infrastructure AI/HAI systems run on.

Prerequisite cells: PC-Infrastructure-L2, ML-Infrastructure-L2

Question L3.1: Generate conformance evidence continuously

Q3.1: Do at least 85% of policy requirements carry a continuously evaluated conformance assertion returning conformant, non-conformant or not-evaluable, with the non-evaluable set listed explicitly and reviewed quarterly for reduction rather than collapsed into conformant? Evidence this in the Infrastructure domain against the AI Infrastructure Standard and the residency position for one production endpoint.

Evidence Required:

• [ ] Instrument the environment so that each policy requirement has a continuously evaluated conformance assertion rather than a periodically collected artifact
• [ ] Draw the signals from infrastructure-as-code definitions and cloud configuration state and from the telemetry the other practices already emit, and express each requirement as a check that returns conformant, non-conformant or not-evaluable
• [ ] The third state matters and is usually omitted: a requirement that cannot be evaluated is a gap in the evidence chain, not a pass, and collapsing it into conformant is how continuous compliance dashboards become reassuring and wrong
• [ ] Publish a service level covering detection of a conformance drift within 5 business days
• [ ] Reserve manual attestation for requirements that are genuinely not machine-evaluable, list them explicitly, and review that list quarterly with the aim of shrinking it, since the list is the honest measure of how far the automation actually reaches

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.2: Prove conformance on demand and shrink audit preparation

Q3.2: Is a complete evidence pack produced within one business day at any tier, verified by unannounced exercises at least twice a year, and is audit preparation effort tracked in hours and falling year over year? For Infrastructure, the assessor should be shown the AI Infrastructure Standard and the residency position for one production endpoint.

Evidence Required:

• [ ] Convert the evidence pack from an assembled document into a generated view over the continuous assertions, so that producing it is a query rather than a project
• [ ] Target production within one business day at every tier, and run unannounced internal exercises at least twice a year to verify the claim, because an evidence pipeline that has never been exercised under time pressure is an assumption
• [ ] Track audit preparation effort explicitly in hours and drive it toward zero: the measure of this level is not that audits pass, which they did before, but that they cost almost nothing to prepare for
• [ ] Where an external audit or regulatory enquiry does raise a finding, trace it back to the assertion that should have caught it and either fix the assertion or record why the requirement is not machine-evaluable

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.3: Engage in the regulatory and standards process

Q3.3: Does the organisation make at least four accepted regulatory or standards contributions per year drawn from its own implementation experience, each reviewed by legal counsel before submission? In Infrastructure, ask to see the AI Infrastructure Standard and the residency position for one production endpoint.

Evidence Required:

• [ ] Participate in the process that produces the obligations rather than only consuming its output
• [ ] Submit implementation experience to consultations on EU AI Act implementing acts and successor guidance, contribute to the standards bodies developing conformance methods including ISO/IEC 42001 and the relevant national standards organisations, and share anonymised implementation patterns through sector bodies and practitioner communities
• [ ] Implementation experience is the input regulators most consistently lack and most consistently ask for, which makes it the contribution with the highest leverage and the lowest cost to produce, since the programme generates it as a by-product of operating
• [ ] Target at least four substantive submissions per year, count only those accepted or published, and have legal review every submission before it leaves the organisation

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 3 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Policy requirements with a continuously evaluated conformance assertion	___	___	≥85%, with the non-evaluable remainder listed explicitly	☐
Time to detect a conformance drift	___	___	≤5 business days at the 90th percentile	☐
Time to produce a complete evidence pack at any tier	___	___	≤1 business day, verified by unannounced exercise twice a year	☐
Audit and enquiry preparation effort	___	___	falling year over year toward under 20 hours per audit	☐
Accepted regulatory and standards contributions per year	___	___	≥4 accepted or published, with legal review completed	☐

Where each number is read from:

• Policy requirements with a continuously evaluated conformance assertion — Conformance assertion registry
• Time to detect a conformance drift — Conformance assertion evaluation log
• Time to produce a complete evidence pack at any tier — Evidence generation timestamps
• Audit and enquiry preparation effort — Time recorded against audit preparation work items
• Accepted regulatory and standards contributions per year — Contribution log with acceptance references

Level 3 30-second check (E0)

• ☐ Yes ☐ No — Do you know whether you are compliant today, or only as of the last audit?
• ☐ Yes ☐ No — Could you produce your evidence pack by tomorrow morning?
• ☐ Yes ☐ No — Have you contributed implementation experience to a regulator or standards body?

---

Summary Scorecard

Level	Q1	Q2	Q3	Level score	Weakest evidence grade	Achieved?
L1	___	___	___	___	___	☐
L2	___	___	___	___	___	☐
L3	___	___	___	___	___	☐

Policy & Compliance (PC) maturity in the Infrastructure domain: ____________

---

Document Version: HAIAMM v3.5 (generated)