A way of seeing AI risk that boards can act on
AI-FPM adapts the proven discipline of Attack Path Mapping from cybersecurity to AI-enabled decision systems. It looks at how failures travel, not just whether each component works.
Seven Phases, One Chain
The method follows a decision from raw data to executive outcome. Each phase is summarised here. The detail of how it works is taught in the platform and in certification.
What you doLay out an AI-enabled decision as a chain of stages, from raw data to the decision and its outcome.
What you getA shared picture of where the decision comes from and what relies on it.
What you doAt each stage, ask how it could fail without anyone noticing.
What you getA list of failure modes in plain language, each tied to the stage it belongs to.
What you doFollow each failure forward and see how it compounds along the path.
What you getA quantified view of which failures matter most to the business.
What you doPlace monitors, controls and circuit breakers where a failure chain can be stopped early.
What you getControls sited where they cut the most risk, with the detection behind them rated.
What you doTurn the findings into prioritised actions with dependencies, durations and a timeline.
What you getA remediation plan that everyone can see, in order.
What you doChallenge your detection and response assumptions in a structured Premortem session.
What you getConfirmed failures brought straight back onto the map.
What you doDocument how service is restored after a failure, before one happens.
What you getPlaybooks linked to the failure modes they respond to.
The Language of the Method
Stage
A step in the journey from data to decision.
Failure mode
A plausible way a stage could fail without anyone noticing.
Failure path
The chain along which a small failure travels and grows.
Control
A safeguard placed where it interrupts a failure path.
Circuit breaker
A deliberate stop that contains a failure before it reaches customers.
Playbook
An agreed response for restoring service if a failure gets through.
How It Differs
AI-FPM works alongside what you already have. It fills the gap between component monitoring and board-level assurance.
- AI-FPM
- How failures travel across the whole decision chain
- Model monitoring
- Individual models and pipelines
- GRC tools
- Policies, controls and obligations
- Consultancy only
- Depends on the engagement
- AI-FPM
- No
- Model monitoring
- Yes
- GRC tools
- Often
- Consultancy only
- No
- AI-FPM
- Days
- Model monitoring
- Weeks to deploy
- GRC tools
- Weeks to months
- Consultancy only
- Weeks
- AI-FPM
- A map, risk picture and action plan
- Model monitoring
- Technical alerts
- GRC tools
- Registers and reports
- Consultancy only
- A report
- AI-FPM
- Your team, or with an expert
- Model monitoring
- Data and ML engineers
- GRC tools
- Risk and compliance teams
- Consultancy only
- The consultant
Aligned to the Frameworks
The phases line up with the major frameworks and UK mandates, so the work supports the evidence you already need to produce.
Questions
No. It is a proprietary methodology created by Peter Gross of ADVANTAGE AI, aligned to published standards.
No. It shows where monitoring and controls matter most, and what monitoring cannot see.
Days, because there is nothing to integrate.
In the platform, or in a facilitated workshop.
See the method at work
A walkthrough shows the method on a system like yours.