Technical Lead

Aim: To provide a strategy and lead implementation for. Responsible AI enterprise tooling, with the aim to implement the Responsible AI requirements, as identified in the Responsible AI global standard, and the more detailed technical standards.

Purpose: To lead and coordinate the strategy, architecture, selection, implementation and adoption of Responsible AI tooling, translating EU AI Act and internal Responsible AI requirements into scalable, interoperable and auditable technology capabilities. This includes an end-to-end traceability model linking regulatory and policy obligations to requirements, controls, system implementation, testing and supporting evidence.

The technical lead would focus on the following activities:

· Define technical implementation standards and requirements

· Define and deliver a single enterprise roadmap for Responsible AI tooling across

· Define the recommended technology stack and target architecture

· Identify integration requirements and data flows

· Operationalise EU AI Act obligations through integrated workflows, controls, technical evidence and management information

· Provide technical leadership during solution design and implementation

Background & context: Maintains a Responsible AI programme, which details the requirement for tooling under the EU AI Act.

The tooling scope covers AI inventory and lifecycle workflows, risk and impact management, technical documentation, data governance, explainability, testing and validation, runtime observability, monitoring, evidence capture and regulatory reporting as illustrative examples.

Currently, owns a set of tools and platforms which meet some of the Responsible AI requirements, but significant gaps remain. For example, the existing tools are fragmented and lack meaningful integration, and only partially meet the requirements under the EU Act, e.g., AI inventory or technical documentation. An overall strategy should define the technology stack and make recommendations relating to solutions built in-house vs capabilities provided by external vendors, based on a cost-benefit analysis.

Requirements must be aligned with regulatory obligations, RAI global standard, and the evolving detailed controls specified in the technical standards. Different lists of requirements have been shared on an ad-hoc basis, and the objective is to consolidate a set of authoritative requirements that technical teams can implement, and track progress against.

The consultants will work closely with the implementation teams under the AIDA tower to drive tooling strategy, identify requirements, and manage implementation. The overall tooling strategy, requirements, operating model and implementation roadmap and other significant milestones must be submitted and reviewed by relevant RAI SMEs and/or leadership to ensure consistency with the RAI programme, policies and standards.

Scope: leading strategy, requirements and oversight of implementation. Out of scope is the development of artifacts, prototypes and executing the build of the solutions. The contractor will assess options and make recommendations regarding external tooling, with formal decisions retained.

Timeframe and delivery phases: The project will be structured across two financial-year phases. Detailed timings, milestones, dependencies, decision gates and acceptance criteria will be agreed during mobilisation. Phase 1 will run to 31 March 2027 and establish the strategic and design foundations for delivery. Phase 2 will begin in April 2027 and will cover pilot delivery, implementation oversight and transition into business-as-usual operations.

· Phase 1 – Discovery, Strategy and Design (to 31 March 2027; current Financial Year):

· Discovery: Assess the current tooling landscape, workflows, controls, integrations and data flows; identify stakeholder needs, regulatory and policy requirements, gaps, risks and dependencies; and confirm the baseline scope, priorities and success criteria.

· Strategy: Define the enterprise Responsible AI tooling strategy, including the target capabilities, guiding principles, sourcing approach, operating-model

direction, investment priorities and phased roadmap. This will include the Build / Buy / Configure assessment and recommendations on the preferred approach for priority capabilities.

· Design: Establish the authoritative functional, technical, control, data, integration, security, evidence and reporting requirements; define the target architecture, integration and data-flow strategy, control design and accountability framework; and translate these approved foundations into a prioritised, detailed implementation backlog. The backlog will set out work packages, dependencies, acceptance criteria, release sequencing, pilot scope and operational-readiness criteria, ready to move into Phase 2.

· Phase 2 – Pilot, Implementation and Transition (from April 2027; next Financial Year):

· Pilot: Coordinate delivery of the agreed pilot scope against the approved backlog; support testing and user acceptance; validate controls, traceability, evidence capture and integration assumptions; gather user and stakeholder feedback; and confirm whether the solution meets the agreed acceptance and operational-readiness criteria before broader implementation.

· Implementation: Oversee implementation against the prioritised backlog and release sequence; coordinate delivery teams and dependencies; manage risks, issues and change control; resolve design questions; monitor progress against milestones and acceptance criteria; and provide assurance that the implemented capabilities align with the approved requirements, architecture, controls and accountability framework. Execution of the technical build will remain with the designated implementation teams.

· Transition: Complete operational-readiness activities and formal handover into business-as-usual operations, including knowledge transfer, training, operating procedures, service-management and support arrangements, ownership transfer, outstanding-risk and remediation plans, adoption monitoring and formal acceptance by the accountable owners.

Deliverables:

· Current-state assessment and gap analysis: Map existing Responsible AI tools, platforms, workflows and integrations against the Responsible AI Global Standard, technical standards, Risk and Control Matrix (RCM) and relevant EU AI Act obligations, identifying duplication, gaps, dependencies and priority remediation areas.

· Enterprise Responsible AI tooling strategy: Produce a single enterprise strategy defining the vision, strategic objectives, guiding principles, target capabilities, global-versus-local operating model, sourcing approach, governance, investment priorities, adoption model and measures of success for Responsible AI tooling across. The strategy will consolidate the findings and recommendations from the current-state assessment, requirements, target architecture and options appraisal.

· Authoritative tooling requirements: Produce a consolidated and prioritised set of functional, technical, control, data, integration, security, evidence and reporting

requirements, with traceability to the applicable policy, regulatory and control obligations.

· Target architecture and technology-stack strategy: Define a technology-agnostic target architecture, canonical data and metadata model, integration principles and reference patterns covering AI inventory, lifecycle workflows, risk and impact assessments, technical documentation, data governance, explainability, testing, observability, monitoring, evidence capture and regulatory reporting.

· Integration and data-flow strategy: Define the enterprise integration strategy for Responsible AI tooling, including priority systems and platforms, end-to-end data flows, system-of-record ownership, canonical data and metadata exchanges, APIs and event-driven integration patterns, identity and access requirements, data quality controls, interoperability standards, implementation dependencies and a phased integration roadmap.

· Build / Buy / Configure assessment and recommendations: Assess internal build, configuration of existing platforms, cloud-native services and externally provided capabilities against agreed criteria. The assessment will evaluate capability fit, interoperability, cost-benefit ratio, scalability, customisation and configuration needs, vendor lock-in and portability, regulatory and control traceability, maintenance requirements, integration challenges and implementation effort, and the operational support model and resources required. It will document trade-offs, dependencies and risks and recommend the preferred approach for each priority capability without making vendor-selection or budget decisions.

· Prioritised roadmap and delivery backlog: Develop a phased implementation roadmap, product backlog, release sequence, dependencies, acceptance criteria and measurable milestones, distinguishing common global capabilities from permitted platform- or market-specific variation.

· Accountability framework and operational process model: Co-develop, with Responsible AI SMEs and relevant operational stakeholders, an accountability framework and end-to-end operating model for the delivered tooling and controls. This will define accountable owners and responsible operators for control execution, monitoring, evidence maintenance, approvals, exceptions and remediation; establish hand-offs and escalation routes across Responsible AI, technology, risk, compliance and business teams; and document operational processes for incident identification, triage, investigation, reporting and closure, regulatory or assurance information requests, evidence retrieval, access management, service continuity and periodic control review. The technical lead will define the tooling enablement, system roles, data, workflow and integration requirements, while Responsible AI SMEs and process owners will jointly define and approve the governance, policy interpretation, decision rights and operating procedures.

· Implementation oversight and governance pack: Establish decision forums, design principles, decision and exception logs, risk and dependency tracking, progress reporting, and assurance artefacts to support implementation teams under the AIDA tower.

· Pilot, adoption and transition plan: Define pilot scope, user-acceptance and control-testing approach, operational-readiness criteria, training and adoption activities, service-management arrangements, and transition to accountable owners.

Expected outcomes:

· A single, agreed enterprise direction for Responsible AI tooling, supported by an approved target architecture, prioritised roadmap and clear implementation decisions.

· A complete and traceable requirements baseline that enables technical teams to implement and evidence the Responsible AI Global Standard, technical standards, RCM controls and relevant EU AI Act obligations consistently.

· Reduced fragmentation and duplication through defined integration patterns and an authoritative record for each AI system and agent, including ownership, classification, lifecycle status and required evidence.

· Consistent minimum controls across priority platforms, cloud providers and markets, with proportionate local variation and documented exceptions.

· Implementation teams have an actionable backlog, acceptance criteria, decision routes and governance artefacts that support coordinated delivery and transparent escalation of risks and dependencies.

· Improved audit and regulatory readiness through reliable evidence capture, technical documentation, control records, dashboards and management information.

· A sustainable operating model with defined ownership, adoption measures, support arrangements and a managed transition from project delivery into business-as-usual operations.