By 15 December 2026 every agency needs a documented way of embedding responsible AI practice, sized to how much AI it uses. Five elements are the floor. First, a route by which new AI use cases are taken up that applies this policy's actions alongside the agency's own enterprise risk and governance arrangements. Second, a means of making the designers and builders of AI use cases aware of the national AI Ethics Principles. Third, a channel through which staff can flag AI safety concerns, AI incidents included. Fourth, channels suited to the agency's AI footprint through which members of the public can flag AI safety concerns. Fifth, defined handling of AI incidents, tied to the agency's ICT incident process, where remediation is overseen by a governance body or a senior executive and carried out consistently with the agency's other legal duties. Existing policies, procedures and frameworks may be amended or new ones written: a small agency with little AI may annotate what it has and name people to advise ad hoc, whereas a heavy adopter may need dedicated AI policies, procedures or frameworks. The accountable official chooses the form.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.