All courses / AI Governance / Module 1 / Chapter 2
Learning objectives
After the lesson the participant can:
- Classify an AI use case into one of the six usage modes using the chapter's ordered questions.
- Compare the modes by what the model sees, what it can do, identity, human role and control artefact.
- Explain mode drift and why governance attaches to the use case and not to the tool or the brand.
- Assign the minimum control baseline of a mode and mark its controls as met, partly met or missing.
Key concepts
- Usage mode
- One of six ways a large language model is used, defined by architecture and not by product: by depth of integration and by the autonomy granted to the model's output. The usage mode is part of the declared intent of every AI use case.
- Shadow AI
- Staff signing in to a consumer tier with a private account, which moves organisational data outside every contract the organisation holds. It starts in Mode 1 because the barrier to use is a browser tab.
- Excessive agency
- OWASP's term for an agent that holds more permission than its task needs. Combined with untrusted input it is the core risk of Mode 3 Agentic work tools.
- Mode drift
- The movement of a use case from one mode to another, for example a prompt that becomes a shared skill, a product and then an automation. The failure is that the controls stay where the use case started.
- Minimum control baseline
- A floor of controls per mode, where the higher modes inherit those of the lower ones. The risk class of Chapter 8 adds controls on top, and an organisation with a low risk appetite raises the floor.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Put in order
The classification questions in order
Put the questions of the chapter's practical guide in the order in which they are asked when a use case is classified by usage mode.
Interactive exercise 2 · Sort
Which usage mode is it?
Sort each use into the usage mode the chapter assigns to it.
Teaching plan
| 10 min | Opening: participants list every way AI is used in their organisation; the teacher shows that one word covers uses whose risk and controls differ by orders of magnitude. |
| 25 min | Teacher presentation of the six modes, one at a time: definition, typical failure, control artefact and cost model, ending with the comparison in Table 2.1. |
| 10 min | Group discussion of mode drift and of one vendor spanning several modes, using the consultation-summary example that travels from Mode 1 to Mode 5. |
| 35 min | Exercise in groups of three: build a usage-mode register for five use cases, classify each with the ordered questions and assign the baseline of Table 2.2. |
| 10 min | Debrief: groups compare the entry they found hardest to classify and apply the rule that, when in doubt, the higher mode is chosen. |
Discussion
- Which Mode 0 features have suppliers switched on in your organisation in the last year, and who would have known that the data processing changed?
- The chapter recommends writing approvals as service X, tier Y, mode Z, for data classes up to C. What would have to change in your current approval process to do that?
- Nordvik Region permits no Mode 5 and limits Mode 3 to its platform team, while Hansa Mutual uses every mode. What does each choice cost, and what does it protect?
Written exercise
Exercise · 35 minutes
Build a usage-mode register
Take five AI uses from your own organisation, or use Nordvik Region's: meeting recaps switched on by a supplier, drafting in the approved enterprise chat tool, a coding agent for the platform team, an internal staff assistant and the procured benefits-triage system. Group them into use cases, not tools. Classify each with the chapter's questions in order: was the use chosen, does the model act on business systems without approval of each action, did the organisation build or integrate it, does it execute tools, does it retrieve organisational content on its own. Record vendor, tier, data classes, identity, owner and AI Act role, then assign the baseline for the mode and mark each control met, partly met or missing.
Deliverable: A register of five use cases with mode, identity, owner, AI Act role and baseline status, and the three gaps to act on first in order of exposure.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
According to the chapter's classification steps, which mode should be chosen when it is unclear which of two modes a use case belongs to?
Show the answer
D. The higher mode
The practical guide ends its ordered questions with the rule that, when in doubt, the higher mode is chosen, because every step up adds permissions, identities and oversight duties that the controls must cover.What does the chapter identify as the defining property of Mode 5 Autonomous production agents?
Show the answer
A. Identity, because what the agent acts as determines the blast radius
The chapter states that the defining property is identity. An agent running as a named employee inherits that person's permissions and leaves an audit trail naming the wrong actor, so each agent needs a dedicated least-privilege workload identity.Why is a brand name a poor unit of governance, according to the chapter?
Show the answer
B. Because brands cut across the modes and data terms differ by feature within one brand
One brand can cover several modes, and even within a brand the data terms differ by feature. The chapter therefore organises the inventory by use case and mode and writes approvals per service, tier, mode and data class.