The three lines of defence: from warships to AI

The logistics assurance policy structures naval logistics assurance into four tiers: routine sub-departmental checks, departmental review by a Logistics Officer applying professional judgement, independent inspection by Fleet Logistics Inspection teams, and strategic oversight at Navy Command level. Each tier exists to catch what the tier below it cannot see from where it stands.

The mechanism that makes this work at handover is Supersession: a mandatory deep-dive audit before a new officer takes charge of an account, so risk is baselined explicitly rather than inherited blind. No one takes command of an unknown risk position.

Line them up and the architecture matches almost exactly. Where the logistics assurance policy has a Logistics Officer applying professional judgement to risk context, ISO/IEC 42001 has an AI Risk Officer providing human oversight under Clause 5. Where the Navy runs Supersession at every handover, the standard runs mandatory model supersession whenever a model owner changes, a model moves from staging to production, or its training data changes materially.

Military assurance is stronger on enforcing accountability through binary grading and mandatory handover. ISO 42001 is stronger on managing a lifecycle that keeps changing after deployment. The strongest AI governance model would apply Navy-grade accountability inside ISO's more flexible structure.

Translated into the language a corporate risk function already uses: Tier 1 (the unit) and Tier 2 (the Logistics Officer) map to the First Line: the developers and risk owners doing the work and making the first judgement call. Tier 3 (Fleet Logistics Inspection) maps to the Second Line: compliance and risk oversight, independent of the people being checked. Tier 4 (Navy Command) maps to the Third Line: internal audit and the governance board setting risk appetite from a position of independence.

Tier 1: Operational Control. On a unit, this is sub-departmental daily checks, often delegated to junior ratings as part of their training. In AI development, the equivalent is automated CI/CD pipelines, unit tests, and the discipline of treating compliance as "code-first": developers own the initial risk assessment, and the definition of done includes governance, not just function.

Tier 2: Professional Judgement. A Logistics Officer applies judgement on top of Tier 1's box-ticking, deciding whether the underlying risk is acceptable. The AI Risk Officer does the same thing looking at bias metrics and drift analysis, deciding whether what the numbers show is a risk worth escalating.

Tier 3: Independent Assurance. Fleet Logistics Inspection uses a binary grading system running from Fully Compliant to No Compliance: there is no "partially safe" grade, because in a warzone or a regulated market, partial safety is not a category. ISO 42001's internal audit under Clause 9.2 exists for the same reason: independent verification of the safety guardrails, which a self-assessment cannot provide.

Lesson 1: The Supersession check. The Navy protocol is simple: no inheritance of unknown risks. A new officer does not accept an account without a deep-dive audit first. Applied to AI, that means mandatory supersession whenever the model owner changes, the model moves from staging to production, or the training data or service history needs revalidating. The principle is the same: do not inherit a risk position that has not been verified independently.

Lesson 2: Minimum Viable Bureaucracy. Not every check deserves the same weight. Checks fall into three groups: governance obligations that are lawful and non-negotiable, assurance that enables operational capability, and internal compliance checks that can be left to the inspector's risk-based discretion. Where the risk is low, a short entry confirming that nothing significant was found can be a complete and valid record. Applied with care, that logic cuts documentation burden without touching anything load-bearing. The same discipline applies to AI governance: do not document every low-risk parameter change. Focus the energy on the high-risk governance items, such as legal, safety, ethics, and bias thresholds, and automate the rest.

Logistics assurance gives command the confidence to deploy in the first place. As AI moves into supply chains through predictive maintenance and autonomous resupply, it introduces probabilistic risk into what used to be a deterministic system. The stakes are the same shape either way: algorithms need the same level of trust that physical stores already require. If AI is the engine, governance is the steering wheel.

The summary is deliberately simple. First Line: operational judgement, with the shop floor owning the risk. Second Line: inspections with teeth, graded assurance that can force immediate action when something is unsatisfactory. Third Line: strategic direction, where a governance board sets risk appetite and owns the supersession policy. It is the structure the Royal Navy has used to keep complex, high-consequence systems accountable for decades, applied to a governance problem with the same structure.