RACI across the AI lifecycle

A RACI is worth building only if it is drawn against lifecycle stages rather than against functions, and only if each cell names an artefact. A grid of coloured letters with no deliverable attached is decoration, and every governance function has produced one.

The stages that matter

Six, and the boundaries between them are where things get dropped.

Intake. A system is proposed, or discovered. Artefact: the register entry. Accountable: AI governance lead. Responsible: whoever proposed or discovered it. Consulted: business owner. The hard part is that intake must also catch what nobody proposed, which is covered in the next module.

Classification. Tier under each applicable regime, and the provider or deployer determination. Artefact: the risk classification record, with the criterion relied on, the reasoning including why adjacent tiers were rejected, residual uncertainty and where legal advice was taken. Accountable: risk or compliance. Consulted: legal. Countersigned by the business owner, because the business owner is the one who will later rely on it.

Assessment. Impact, bias, robustness, security, data protection. Artefacts: the impact assessment, the fairness test record with thresholds set in advance, the accuracy and robustness test record, the security control record. Accountable: business owner, facilitated by privacy or compliance. Responsible: technical owner for the testing.

Approval and go-live. Artefact: a dated decision recording the residual risk accepted, by whom, and any conditions attached. Accountable: the body or individual holding the go-live right. Informed: everyone downstream, including the oversight role, which cannot operate on a system it learns about at launch.

Operation. Artefacts: the monitoring output, the oversight intervention log, the incident log including events judged not reportable with the reasoning. Accountable: technical owner for monitoring, compliance for reporting decisions.

Change and retirement. Artefacts: a reclassification where a change is substantial, and a decommissioning record. Accountable: business owner with technical owner and compliance.

The three handovers that fail

Classification to assessment. The classification says the system is high-risk; nothing automatically triggers the assessment work, because classification lives in compliance and assessment lives in the business. Fix: the classification record is not closed until the assessment is scheduled with an owner and a date.

Approval to operation. Conditions attached to an approval routinely vanish. "Approved subject to bias testing before extension beyond the pilot" is a sentence in a minute that nobody carries forward. Fix: conditions become dated register fields with owners, and the register reports overdue conditions.

Change to reclassification. Nothing in a normal release process asks whether a change is a substantial modification, or whether a new use has moved the tier. Fix: a release gate question owned by the technical owner, with the classification record as the artefact updated.

Consulted is not a courtesy

The most frequent abuse of a RACI is marking legal or data protection as Consulted and then proceeding without them. Two tests make it real. First, the artefact has a field recording the consultation and its date, so the absence is visible. Second, the approval cannot be recorded without it. If consultation has no gate, the letter C means informed-after-the-fact.

Worked example: one row of a claims-triage RACI

An insurer deploys claims triage. Take the classification row.

Responsible: the compliance analyst who drafts the classification. Accountable: the head of compliance, who signs. Consulted: legal, on whether triage that influences settlement amounts touches the Annex III insurance entry, which is drawn around risk assessment and pricing in life and health insurance; and the technical owner, on what the system actually does as opposed to what the business case says. Informed: the business owner, the AI governance lead and internal audit.

The artefact is the classification record. Its reasoning has to say, in terms, why the Annex III insurance entry was or was not relied on, what would change the answer, and what legal advice was taken. The residual uncertainty field is not a weakness in the document; it is what makes it defensible, because the challenge that eventually comes will be about exactly the point the drafter found difficult.

Now the second half of the row, which most grids omit: what happens next. The classification record closes only when the assessment stage has an owner and a date, and it carries a review trigger if the triage model is later extended to health claims. Written that way, one row of a RACI is a small process rather than a colour.

As of 24 September 2026.