For organisations running Microsoft 365 that have switched on Copilot or AI agents. A reference model, a ladder with a gate at every step, and plans your board and your IT team can work from.
AI does not create access. It reveals access that already exists. Most organisations switched on Copilot or an assistant before anyone checked what it could reach, who owns each assistant, or who could stop one. The gap between what is happening and what the board knows is the risk.
The things an organisation must be able to do to run AI safely, from "one list of every piece of AI in use" to "every AI system can be stopped by a named person through a route that has been tried". Each one says what proves it works and which recognised standard it maps to: ISO/IEC 42001 (the international AI management standard), NIST's AI Risk Management Framework, and others.
A ladder of AI ambition: from foundations, through letting AI read your organisation's knowledge, up to autonomous agents, with the gate that must be passed before each step. It tells you which rung you are on, which one you are reaching for, and what has to be true first.
Based on NIST's Cybersecurity Framework: done once and informally (Partial); done because someone understood the risk (Risk Informed); done the same way every time and written down (Repeatable); done and improved as things change (Adaptive). Every capability is read twice, on how firmly the organisation decides it and on how firmly it actually operates. The two are never averaged, and the gates on the ladder are set on what operates. That is why a control which is written and approved, but not switched on, does not pass.
The model is sector-neutral. An edition adds a sector's regulators, quoted in their own words, the red lines its board should set, and the risks specific to it. The first edition is for charities: read the charity edition. Other sectors run on the core model today.
What makes it different. Your board paper, your technical plan and your control map are all in sync and based on one and the same model.
It starts with the AI Exposure Scorecard (charity edition), which tests the foundations: ten questions on what every organisation needs in place before AI goes further, answered online or over a call. Your score tells you whether to go deeper. If you do, the assessment takes about eight weeks, in four stages.
We pull what is actually switched on in your Microsoft 365 estate: licences, assistants, connectors, sharing and labelling, audit and retention. Your IT team works through a short questionnaire with us. "We don't know" is a real answer.
Your position against every capability that applies to you, with the evidence. The gaps, in the order to close them, and what each one costs.
One session with your executive or board group. A board paper in plain English: where you are, what the risks are, what we recommend, and the red lines to set.
The technical plan and the control map go to your named owner, together with your organisation's own overlay: your position against each capability in the reference model, so your team can keep it current.
Extras are agreed as a change on request.
Start with a 30-minute conversation about where your organisation is, or with the three-minute AI Exposure Scorecard.
There are two short scorecards, testing different rungs of the same ladder. Both are short, both take a few minutes, and both are measured the way a full assessment measures them.
One written policy, one list of every AI system, one named owner, logs you can answer a complaint with. If you have switched on Copilot or an assistant, this is your rung.
Whether an agent's actions can be attributed, bounded and stopped. If you are about to let agents act on live systems, this is your rung, whether or not the foundations are finished.
Between these two sit the steps where AI reads more of your knowledge, and those depend so heavily on what is already true in your tenant that ten questions would mislead you. They are assessed, not scored.
Most organisations are standing on the second rung and being asked to jump to the seventh, skipping four. Knowing which rung you are on is what a ladder is for.
And if the EU AI Act reaches you, a twelve-question check on which of its obligations are actually yours. → Take the EU AI Act Quick-Check
Ossama Adel, enterprise AI architect and AI security and governance specialist, with twenty years of Microsoft enterprise architecture and information governance. Most recently, he designed and put into operation an enterprise AI governance and security framework at a large UK charity through 2026; that work is powered by the RAISE Method.
Write to ossama@raiseai.co or book a 30-minute intro call.