Guard Rail™ — Governance and Risk Framework — Hartwell M&E Group

Guard Rail™ — Governance & Risk Framework

← Audit PackDeliverable 05 of 07BAI-HME-AUD-005

Section 01

Framework Purpose

This framework defines the governance controls, data handling rules and approval processes that should be in place before, during and after AI workflow deployment at Hartwell M&E Group.

Governance principles

Human authority	AI workflows produce structured drafts. Competent human reviewers approve, modify or reject every output before it is used, issued or relied upon. AI does not make decisions.
Data minimisation	Only the minimum data required for each workflow is processed. No data is stored beyond the processing cycle unless explicitly required for audit trail purposes and agreed in writing.
Traceability	Every AI-assisted output carries a source reference, version identifier and reviewer record. Any output can be traced from final version back to its input data and processing steps.
Proportionality	Controls are scaled to risk. Higher-risk outputs (safety documentation, client-facing submissions, commercial claims) require stronger approval gates than lower-risk outputs (internal summaries, draft agendas).
Continuous review	The framework is reviewed quarterly during Phase 1 and annually thereafter. Controls are adjusted based on operational experience, incident review and regulatory changes.

This is not a compliance checklist. It is a practical operating framework designed for the way Hartwell works. The aim is to make AI adoption defensible, auditable and commercially useful — not to create bureaucracy.

Section 02

Data Classification Model

A three-tier classification system determining which data types can be processed through AI workflows, under what conditions, and with what controls.

Red — Restricted

Data that must not be processed through AI workflows without explicit senior approval and additional safeguards.

Do not process by default

Includes: personal employee data (payroll, HR records, medical information), client financial data (contract values where NDA-restricted, fee proposals, margin calculations shared under NDA), commercially sensitive client information covered by explicit confidentiality clauses, security-sensitive site information (access codes, alarm systems, critical infrastructure details), individual subcontractor pricing and rates, personal data relating to building occupants or patients.

Required controls: Written approval from Commercial Director or MD before processing. Data anonymisation or pseudonymisation where feasible. Processing log reviewed by data owner within 48 hours. Data deleted within 24 hours of processing completion.

Amber — Controlled

Data that can be processed through AI workflows with standard controls, human review and audit trail requirements.

Standard controls apply

Includes: tender documents (specifications, schedules, drawings, PQQs), RAMS and method statements, variation narratives and commercial correspondence, contract reports and QBR data, CAFM ticket data and SLA reporting, financial data exported from Sage 200 for reporting purposes (contract-level, not individual), standard company information used for PQQ and compliance responses, site survey information and job-specific technical data.

Required controls: Human review of all outputs before use. Source traceability on every extracted item. Output labelling (draft/reviewed/approved). Processing log maintained. Data retained only for the duration of the workflow cycle.

Green — Open

Data that can be processed through AI workflows with minimal additional controls beyond standard operating procedures.

Minimal controls

Includes: publicly available information (regulatory guidance, British Standards references, CIBSE/BSRIA guidance), internal templates and standard text libraries, company capability statements and accreditation details, generic assumptions libraries, standardised report formats and structure templates, published product specifications and technical data sheets.

Required controls: Standard output review. No additional approval gates or processing logs required beyond normal workflow records.

Classification responsibility. Each workflow lead is responsible for classifying input data before processing begins. Where data falls across two categories, the higher classification applies to the entire dataset. Built AI will provide a classification decision checklist as part of Phase 1 onboarding.

Section 03

Approval Gates

The approval process for AI-assisted outputs, scaled by output type and risk level. Every output passes through at least one human review gate before use.

AI produces
structured draft

Automated

Competent reviewer
checks & modifies

Mandatory

Senior approver
signs off

Risk-dependent

Output issued
or submitted

Final

Output type	Risk level	Gate 2: Reviewer	Gate 3: Approver	Before issue
RAMS & safety documentation	High	HSQE Manager or competent H&S person	Operations Director	Both gates mandatory. Signed record.
Client-facing commercial submissions	High	QS or Commercial Manager	Commercial Director	Both gates mandatory. Submission log.
Tender responses & bid documents	Medium-High	Estimating Lead	Commercial Director (bids >£500k)	Gate 3 for high-value bids only.
Monthly contract reports	Medium	Contract Manager	Not required	Gate 2 only. Standard review.
Variation narratives & notice drafts	Medium	QS or Contract Manager	Commercial Director (values >£50k)	Gate 3 for high-value claims.
Internal summaries & action logs	Low	Workflow user (self-review)	Not required	Gate 2 only. Self-review acceptable.
QBR packs & board reports	Medium	Finance Director or Commercial Director	MD	Both gates for board-level outputs.

Non-negotiable rule. No AI-assisted output is issued to a client, submitted as part of a tender, included in safety documentation, or used as the basis for a commercial claim without at least one competent human review. The human reviewer is accountable for the content — not the AI.

Section 04

Audit Trail Requirements

What records must be maintained for every AI-assisted output, and how those records should be stored and accessed.

Record	What it contains	Retention	Owner
Processing log	Date, time, workflow type, input documents (filenames, page counts, classification), processing steps completed, any errors or exceptions flagged.	12 months minimum	Built AI
Output version record	Draft version (as produced by AI), reviewed version (after human modifications), final version (as approved). Track changes or diff record showing modifications.	Contract + 6 years	Hartwell
Review and approval record	Reviewer name, date, time, modifications made (summary), approval status (approved / approved with changes / rejected), approver name and date where Gate 3 applies.	Contract + 6 years	Hartwell
Data handling record	Classification of input data (Red/Amber/Green), any anonymisation applied, confirmation of data deletion post-processing (where required), any exceptions or escalations.	12 months minimum	Shared
Incident log	Any errors, inaccuracies, near-misses or concerns identified during review. Root cause, corrective action, whether the issue was systemic or isolated.	Duration of engagement	Shared

Practical implementation. Built AI will provide a lightweight audit trail template that integrates with each workflow. Reviewers complete a simple approval form (name, date, status, notes) at the point of review, taking less than 2 minutes per output.

Section 05

Safe Operating Boundaries

Clear boundaries defining what AI workflows can and cannot be used for, and the escalation process for edge cases.

AI workflows can be used for

Extracting and structuring scope items from tender documents

Drafting assumptions, exclusions and clarification queries

Generating structured variation narratives and notice drafts

Producing monthly margin snapshots and WIP summaries

Assembling evidence packs and indexing supporting documents

Drafting RAMS content from task and hazard data (with H&S review)

Pre-populating compliance responses from standard libraries

Generating report narratives, action logs and meeting summaries

AI workflows must not be used for

Making final pricing or commercial decisions

Signing or certifying safety documentation

Providing engineering design calculations or certifications

Making employment, HR or disciplinary decisions

Issuing contractual notices without human review and approval

Replacing competent person roles (CDM, RAMS approval, fire risk)

Processing personal data without explicit classification and controls

Communicating with clients on behalf of Hartwell without approval

Escalation process

Trigger	Action	Escalation to
Unclear data classification	Processing should not begin until classification is confirmed by the data owner.	Commercial Director
Output accuracy concern	Concern is logged in the incident log. Output is corrected before approval.	Workflow Lead + Built AI
Client enquiry about AI	Response follows the procurement disclosure posture (Section 06). No disclosure without prior agreement on wording.	Commercial Director
Regulatory or contractual change	Framework is reviewed and updated before continuing with affected workflows.	MD + Built AI
Near-miss or incident	Incident is formally logged and a root cause review is conducted within 5 working days.	MD + Built AI

Section 06

Procurement Disclosure Posture

Hartwell's recommended position on disclosing AI usage to clients, procurement teams and contracting authorities.

Recommended disclosure position

Proactive, factual and confident. Hartwell should be prepared to disclose that AI tools are used to support document production, analysis and workflow efficiency — and should frame this as a quality and governance strength rather than a risk.

Core statement	“Hartwell M&E Group uses AI-assisted tools to support document structuring, scope extraction, reporting and quality assurance. All AI-assisted outputs are reviewed and approved by competent personnel before issue. AI does not make decisions, sign certifications or replace competent person roles.”
When asked in PQQ	Disclose the use of AI tools as part of the quality management response. Reference the governance framework, human review gates, data classification model and audit trail. Position as a strength.
When asked informally	Consistent with the core statement. Emphasise human review, data controls and output quality. Offer to provide the governance framework summary if helpful.
When not asked	No obligation to volunteer disclosure unless contractually required. However, proactive disclosure in quality management sections of tenders can differentiate Hartwell positively.

Competitive advantage. Most M&E contractors using AI informally have no governance framework, no data classification and no disclosure position. Hartwell's ability to demonstrate controlled, governed AI usage creates a genuine procurement advantage over competitors who cannot answer these questions.

Section 07

Implementation & Review

How the framework is adopted, maintained and updated over time.

Activity	Detail	Frequency	Owner
Framework onboarding	All workflow users complete a 30-minute onboarding session covering data classification, approval gates, output labelling and escalation procedures.	At Phase 1 start	Built AI + Hartwell
Quarterly governance review	Review incident log, escalation records and any framework exceptions. Assess whether controls are proportionate and effective.	Quarterly (Phase 1)	Commercial Director + Built AI
Annual framework review	Full review of data classification model, approval gates, disclosure posture and safe operating boundaries.	Annually (Phase 2+)	MD + Built AI
Incident root cause review	Formal review within 5 working days of any near-miss or incident. Document root cause and corrective action.	As triggered	Workflow Lead + Built AI
New workflow assessment	Before any new workflow type is deployed, a governance assessment confirms data classification, approval gates and output types.	Per new workflow	Built AI

Deliverable linkage. This framework is Deliverable 05 of 07. The controls defined here apply to all workflows recommended in the Prioritised AI Opportunity Roadmap (Deliverable 03) and demonstrated in the Controlled Prototype (Deliverable 04). The phased implementation route in Deliverable 06 includes governance onboarding as a Week 1 activity. The Phase 1 proposal in Deliverable 07 includes governance setup costs and ongoing review cadence. All seven deliverables should be read together.

Guard RailGOVERNANCE & RISK FRAMEWORK

Framework Purpose

Governance principles

Data Classification Model

Red — Restricted

Amber — Controlled

Green — Open

Approval Gates

Audit Trail Requirements

Safe Operating Boundaries

AI workflows can be used for

AI workflows must not be used for

Escalation process

Procurement Disclosure Posture

Recommended disclosure position

Implementation & Review