+Artikel 52 Fremgangsmåde
---+Artikel 52 1.
---+Artikel 52 2.
---+Artikel 52 3.
---+Artikel 52 4.
---+Artikel 52 5.
---+Artikel 52 6.
|
Artikel 52 Fremgangsmåde
-
1. Oversigt
| Titel |
Regulering |
|
Artikel 52 1.
|
Hvis en AI-model til almen brug opfylder betingelsen i artikel 51, stk. 1, litra a), giver den relevante udbyder Kommissionen meddelelse så hurtigt som muligt og under alle omstændigheder senest to uger efter, at dette krav er opfyldt, eller det bliver kendt, at det vil blive opfyldt. Meddelelsen skal indeholde de oplysninger, der er nødvendige for at påvise, at det relevante krav er opfyldt. Hvis Kommissionen får kendskab til en AI-model til almen brug, der frembyder systemiske risici, som den ikke har fået meddelelse om, kan den beslutte at udpege den som en model med systemisk risiko.
|
|
Artikel 52 2.
|
Udbyderen af en AI-model til almen brug, der opfylder betingelsen omhandlet i artikel 51, stk. 1, litra a), kan sammen med dens meddelelse fremlægge tilstrækkeligt underbyggede argumenter til at påvise, at AI-modellen til almen brug, selv om den opfylder det pågældende krav, undtagelsesvis ikke frembyder systemiske risici på grund af dens specifikke karakteristika og derfor ikke bør klassificeres som en AI-model til almen brug med systemisk risiko.
|
|
Artikel 52 3.
|
Hvis Kommissionen konkluderer, at de argumenter, der er fremsat i henhold til stk. 2, ikke er tilstrækkeligt underbyggede, og den relevante udbyder ikke har været i stand til at påvise, at AI-modellen til almen brug på grund af sine specifikke karakteristika ikke frembyder systemiske risici, afviser den disse argumenter, og AI-modellen til almen brug betragtes som en AI-model til almen brug med systemisk risiko.
|
|
Artikel 52 4.
|
Kommissionen kan udpege en AI-model til almen brug som frembydende systemiske risici på eget initiativ eller efter en kvalificeret varsling fra det videnskabelige panel i henhold til artikel 90, stk. 1, litra a) på grundlag af kriterierne i bilag XIII. Kommissionen tillægges beføjelser til at vedtage delegerede retsakter i overensstemmelse med artikel 97 for at ændre bilag XIII ved at præcisere og ajourføre kriterierne i nævnte bilag.
|
|
Artikel 52 5.
|
Efter en begrundet anmodning fra en udbyder, hvis model er blevet udpeget som en AI-model til almen brug med systemisk risiko i henhold til stk. 4, tager Kommissionen hensyn til anmodningen og kan beslutte på ny at vurdere, om AI-modellen til almen brug stadig kan anses for at frembyde systemiske risici på grundlag af kriterierne i bilag XIII. En sådan anmodning skal indeholde objektive, detaljerede og nye grunde, der er kommet frem siden udpegelsesafgørelsen. Udbydere kan tidligst seks måneder efter udpegelsesafgørelsen anmode om en fornyet vurdering. Hvis Kommissionen efter sin fornyede vurdering beslutter at opretholde udpegelsen som en AI-model til almen brug med systemisk risiko, kan udbyderne tidligst seks måneder efter denne afgørelse anmode om en fornyet vurdering.
|
|
Artikel 52 6.
|
Kommissionen sikrer, at der offentliggøres en liste over AI-modeller til almen brug med systemisk risiko, og ajourfører løbende denne liste, uden at det berører behovet for at overholde og beskytte intellektuelle ejendomsrettigheder og fortrolige forretningsoplysninger eller forretningshemmeligheder i overensstemmelse med EU-retten og national ret.
|
,
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede standarder
2. Identificerede krav
3. Relaterede standarder
Standarder
| Kilde |
Krav |
|
SCF
|
AI & Autonomous Technologies Registration
Description
Mechanisms exist to maintain a current registration for Artificial Intelligence (AI) and Autonomous Technologies (AAT) with the appropriate governing body, as required by statutory or regulatory requirements.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Determine whether any AI use requires registration (e.g., EU AI Act high-risk systems)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Track AI registration obligations by jurisdiction in compliance checklist
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Register high-risk AI systems with relevant authorities as required
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI registration compliance program ∙ Track registration requirements by jurisdiction
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI regulatory compliance platform ∙ Automated registration tracking ∙ EU AI Act database registration compliance
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices. ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners. ▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to maintain a current registration for AAT with the appropriate governing body, as required by statutory or regulatory requirements.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Registration
Description
Mechanisms exist to maintain a current registration for Artificial Intelligence (AI) and Autonomous Technologies (AAT) with the appropriate governing body, as required by statutory or regulatory requirements.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Determine whether any AI use requires registration (e.g., EU AI Act high-risk systems)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Track AI registration obligations by jurisdiction in compliance checklist
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Register high-risk AI systems with relevant authorities as required
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI registration compliance program ∙ Track registration requirements by jurisdiction
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI regulatory compliance platform ∙ Automated registration tracking ∙ EU AI Act database registration compliance
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices. ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners. ▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to maintain a current registration for AAT with the appropriate governing body, as required by statutory or regulatory requirements.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|