+Член 50 Задължения за прозрачност за доставчиците и внедрителите на определени системи с ИИ
---+Член 50 1.
---+Член 50 2.
---+Член 50 3.
---+Член 50 4.
---+Член 50 5.
---+Член 50 6.
---+Член 50 7.
|
Член 50 Задължения за прозрачност за доставчиците и внедрителите на определени системи с ИИ
-
1. Преглед
| Наименование |
Регулация |
|
Член 50 1.
|
Доставчиците гарантират, че системите с ИИ, предназначени да взаимодействат пряко с физически лица, са проектирани и разработени по такъв начин, че съответните физически лица да бъдат информирани, че взаимодействат със система с ИИ, освен ако това не е очевидно от гледна точка на физическо лице, което е в разумни граници осведомено, наблюдателно и съобразително предвид обстоятелствата и контекстът на използване. Това задължение не се прилага за системи с ИИ, разрешени по закон за разкриване, предотвратяване, разследване или наказателно преследване на престъпления, при спазване на подходящи гаранции за правата и свободите на трети лица, о свен когато тези системи са общодостъпни с цел подаване на сигнали за престъпление.
|
|
Член 50 2.
|
Доставчиците на системи с ИИ, включително системи с ИИ с общо предназначение, които генерират синтетично аудио съдържание, изображения, видео или текстово съдържание, гарантират, че резултатите от системата с ИИ са представени в машинночетим формат и са разпознаваеми като изкуствено генерирани или обработени. Доставчиците гарантират, че техните технически решения са ефективни, оперативно съвместими, сигурни и надеждни, доколкото това е технически осъществимо, като се вземат предвид особеностите и ограниченията на различните видове съдържание, разходите за прилагане и общопризнатите съвременни технически постижения, които може да бъдат отразени в подходящи технически стандарти. Това задължение не се прилага, доколкото системите с ИИ изпълняват помощна функция при стандартно редактиране или не променят съществено въведените от внедрителя входящи данни или семантиката им, или когато са разрешени по закон за разкриване, предотвратяване, разследване или наказателно преследване на престъпления.
|
|
Член 50 3.
|
Внедрителите на системи за разпознаване на емоции или на системи за биометрично категоризиране информират физическите лица, които са изложени на съответната система, за функционирането на системата и обработват личните данни в съответствие с регламенти (ЕС) 2016/679 и (ЕС) 2018/1725 и Директива (ЕС) 2016/680, в зависимост от случая. Това задължение не се прилага за системи с ИИ, използвани за биометрично категоризиране и разпознаване на емоции, които са разрешени по закон за разкриване, предотвратяване или разследване на престъпления, при спазване на подходящи гаранции за правата и свободите на трети лица и в съответствие с правото на Съюза.
|
|
Член 50 4.
|
Внедрителите на система с ИИ за генериране или обработка на изображения, аудио или видео съдържание, които представляват убедителен фалшификат, оповестяват обстоятелството, че съдържанието е изкуствено генерирано или обработено. Това задължение не се прилага, когато използването е разрешено по закон за разкриване, предотвратяване, разследване или наказателно преследване на престъпления. Когато съдържанието е част от произведение или програма, които имат очевиден творчески, сатиричен, артистичен, художествен или подобен характер, задълженията за прозрачност, посочени в настоящия параграф, се ограничават до оповестяване на съществуването на такова генерирано или обработено съдържание по подходящ, ясен и видим начин, който не възпрепятства показването или използването на произведението. Внедрителите на система с ИИ, която генерира или обработва текст, публикуван с цел информиране на обществеността по въпроси от обществен интерес, оповестяват обстоятелството, че текстът е бил изкуствено генериран или обработен. Това задължение не се прилага, когато използването е разрешено по закон за разкриване, предотвратяване, разследване или наказателно преследване на престъпления или когато генерираното от ИИ съдържание е преминало през процес на преглед от човек или редакционен контрол и когато физическо или юридическо лице носи редакционна отговорност за публикуването на съдържанието.
|
|
Член 50 5.
|
Информацията, посочена в параграфи 1 – 4, се предоставя на засегнатите физически лица по ясен и добре различим начин най-късно в момента на първото взаимодействие или първия контакт. Информацията трябва да отговаря на приложимите изисквания за достъпност.
|
|
Член 50 6.
|
Параграфи 1 – 4 не засягат изискванията и задълженията, установени в глава III, нито други задължения за прозрачност, установени в правото на Съюза или в националното право спрямо внедрителите на системи с ИИ.
|
|
Член 50 7.
|
Комисията насърчава и улеснява изготвянето на кодекси за добри практики на равнището на Съюза, за да се улесни ефективното изпълнение на задълженията по отношение на откриването, маркирането и обозначаването на изкуствено генерирано или обработено съдържание. Комисията, като взема под внимание в максимална степен становището на Съвета по ИИ, оценява дали спазването на тези кодекси за добри практики е достатъчно, за да се гарантира спазването на задълженията, определени в параграфи 2 и 4 от настоящия член, в съответствие с процедурата, изложена в член 56, параграф 6. Ако сметне кодекса за добри практики за неподходящ, Комисията може да приеме акт за изпълнение, в който се установяват общите правила за изпълнението на тези задължения в съответствие с процедурата по разглеждане, предвидена в член 98, параграф 2.
|
,
1.1 Препратки
1.2 Идентифицирани изисквания
1.3 Свързани стандарти
2. Идентифицирани изисквания
Изисквания
| Източник |
Изискване |
3. Свързани стандарти
Стандарти
| Източник |
Изискване |
|
SCF
|
AI & Autonomous Technologies Output Marking
Description
Mechanisms exist to mark output from Artificial Intelligence (AI) and Autonomous Technologies (AAT) in a machine-readable format so it is detectable as artificially generated or manipulated.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Label AI-generated content when distributing it
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Policy requiring labeling of AI-generated content
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI content marking policy ∙ Machine-readable metadata for AI content
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI content marking program ∙ Technical implementation of C2PA or similar standards
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI content marking framework ∙ C2PA standard implementation ∙ Automated content marking in AI pipelines
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to mark output from AAT in a machine-readable format so it is detectable as artificially generated or manipulated.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|