# KPI / KRI Dashboard

**Purpose.** The measures that show whether governance is actually working — coverage, quality, timeliness, and leading indicators of trouble — rather than how much documentation exists.

**When to use it.** Report every cycle. Review the metric set annually and drop anything that has never changed a decision.

**How to use it.** Choose eight to twelve measures maximum and hold them stable, because trend is the point. Distinguish KPIs (is it working?) from KRIs (is something about to go wrong?) — most dashboards have far too few of the latter.

---

### Coverage KPIs

Are we governing everything we should be?

| Metric | Definition | Target | Source |
|---|---|---|---|
| AI systems registered | Registered ÷ known to exist | 100% | AI System Inventory |
| Systems classified | With recorded tier and rationale | 100% | Inventory |
| High-risk assessed | With current AI Risk Assessment | 100% | Assessments |
| Documentation complete | High-risk with current Model Card / Model Risk Documentation | 100% | Model cards |
| Data assets registered | Material assets registered | [90%] | Data Asset Register |
| Vendors assessed | Critical AI vendors with current assessment | 100% | Vendor register |

### Effectiveness KPIs

Is it working, rather than merely present?

| Metric | Definition | Target | Why |
|---|---|---|---|
| Assessment cycle time | Intake to decision, median days | {{default:assessment-cycle-time-target}} | Slow governance gets bypassed |
| Gate pass rate first time | % passing without rework | {{default:gate-pass-rate-target}} | Low means unclear standards |
| Data quality score | Weighted across key domains | [> 95%] | Data Quality Standard |
| AI literacy completion | Relevant staff trained | [> 90%] | Art. 4 obligation |
| Control tests passed | Tested controls operating effectively | [> 95%] | Control Library & Assurance Map |

### Risk indicators (KRIs)

Leading signals that something is going wrong.

| Indicator | Threshold | Why it matters |
|---|---|---|
| Unregistered systems found | Any | Governance is being bypassed |
| Overdue high-risk reviews | > 0 | Assessments going stale |
| Open high/critical risks past target | > 0 | Treatment is not landing |
| Exceptions open beyond expiry | > 0 | Silent policy erosion |
| **Human override rate** | {{default:override-rate-band}} | Too low = rubber-stamping; too high = model not fit |
| Model drift alerts | Any unresolved | Performance degrading |
| Incidents detected externally | Any | Monitoring is not working |
| Mean time to detect | Increasing | Detection is degrading |

> **Override rate is the single best oversight metric**
> It is one of the few numbers that reveals whether human oversight is real.
> A rate near zero almost always means reviewers are approving by default,
> not that the model is perfect.

### Presentation

| Element | Guidance |
|---|---|
| RAG status | Define thresholds once and keep them fixed |
| Trend arrows | Direction matters more than level |
| Sparklines | Show the last 4–6 periods |
| Commentary | One line per amber or red, naming the action and owner |

### Dashboard summary

| Metric | Now | Last | Trend | Target | RAG | Commentary |
|---|---|---|---|---|---|---|
| AI systems registered | | | | 100% | | |
| High-risk assessed | | | | 100% | | |
| Documentation complete | | | | 100% | | |
| AI literacy | | | | 90% | | |
| Open high risks | | | | 0 | | |
| Override rate | | | | 2–20% | | |

### Metrics to avoid

| Avoid | Why | Use instead |
|---|---|---|
| Policies published | Measures activity, not effect | Attestation and exception rates |
| Training hours delivered | Time is not competence | Assessment pass rates |
| Number of meetings | Effort, not outcome | Decisions made and actions closed |
| Total AI systems | Growth is not risk | Systems by tier, unassessed count |

---

## Adaptation notes

- **Small organisations:** Six metrics is plenty: registered, assessed, documented, trained, open high risks, and override rate.
- **Early-stage programmes:** Coverage metrics first — you cannot measure effectiveness of controls you have not yet applied everywhere. Expect coverage to look bad initially; that is the honest baseline.
- **Mature programmes:** Shift emphasis to KRIs and control-testing results. Coverage at 100% for four quarters running has stopped telling you anything.

---

*From the [Open Data & AI Governance Kit](https://lsdeva.github.io/governance-kit/). Licensed [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — free to use, adapt, and share with attribution.*

***Not legal advice.** Adapt to your jurisdiction, sector, and risk appetite, and have qualified counsel review anything material.*