+Άρθρο 50 Υποχρεώσεις διαφάνειας για παρόχους και φορείς εφαρμογής ορισμένων συστημάτων ΤΝ
---+Άρθρο 50 1.
---+Άρθρο 50 2.
---+Άρθρο 50 3.
---+Άρθρο 50 4.
---+Άρθρο 50 5.
---+Άρθρο 50 6.
---+Άρθρο 50 7.
|
Άρθρο 50 Υποχρεώσεις διαφάνειας για παρόχους και φορείς εφαρμογής ορισμένων συστημάτων ΤΝ
1. Επισκόπηση
| Τίτλος |
Κανονισμός |
|
Άρθρο 50 1.
|
Οι πάροχοι διασφαλίζουν ότι τα συστήματα ΤΝ που προορίζονται για άμεση αλληλεπίδραση με φυσικά πρόσωπα σχεδιάζονται και αναπτύσσονται κατά τρόπο που επιτρέπει στα ενδιαφερόμενα φυσικά πρόσωπα να ενημερώνονται ότι αλληλεπιδρούν με σύστημα ΤΝ, εκτός εάν αυτό είναι προφανές από τη σκοπιά φυσικού προσώπου που είναι ευλόγως καλά ενημερωμένο, παρατηρητικό και προσεκτικό, λαμβανομένων υπόψη των περιστάσεων και του πλαισίου χρήσης. Η υποχρέωση αυτή δεν ισχύει για συστήματα ΤΝ αδειοδοτημένα από τον νόμο για την ανίχνευση, την πρόληψη, τη διερεύνηση ή τη δίωξη αξιόποινων πράξεων, εφόσον ισχύουν κατάλληλες διασφαλίσεις για τα δικαιώματα και τις ελευθερίες τρίτων, εκτός εάν τα συστήματα αυτά είναι διαθέσιμα στο κοινό για την καταγγελία αξιόποινης πράξης.
|
|
Άρθρο 50 2.
|
Οι πάροχοι συστημάτων ΤΝ, συμπεριλαμβανομένων των συστημάτων ΤΝ γενικού σκοπού, που παράγουν συνθετικό περιεχόμενο ήχου, εικόνας, βίντεο ή κειμένου, διασφαλίζουν ότι τα στοιχεία εξόδου του συστήματος ΤΝ επισημαίνονται σε μηχαναγνώσιμο μορφότυπο και είναι δυνατόν να ανιχνευθεί ότι έχουν παραχθεί ή υποστεί χειρισμό τεχνητά. Οι πάροχοι διασφαλίζουν ότι οι τεχνικές λύσεις τους είναι αποτελεσματικές, διαλειτουργικές, ισχυρές και αξιόπιστες, στον βαθμό που αυτό είναι τεχνικά εφικτό, λαμβάνοντας υπόψη τις ιδιαιτερότητες και τους περιορισμούς των διάφορων ειδών περιεχομένου, το κόστος εφαρμογής και τη γενικώς αναγνωρισμένη εξέλιξη της τεχνολογίας, όπως μπορεί να αντικατοπτρίζεται στα σχετικά τεχνικά πρότυπα. Η υποχρέωση αυτή δεν ισχύει στον βαθμό που τα συστήματα ΤΝ εκτελούν υποστηρικτική λειτουργία για τυποποιημένη επεξεργασία ή δεν μεταβάλλουν ουσιαστικά τα δεδομένα εισόδου που παρέχονται από τον φορέα εφαρμογής ή τη σημασιολογία τους ή όταν είναι αδειοδοτημένα από τον νόμο για την ανίχνευση, την πρόληψη, τη διερεύνηση ή τη δίωξη αξιόποινων πράξεων.
|
|
Άρθρο 50 3.
|
Οι φορείς εφαρμογής συστήματος αναγνώρισης συναισθημάτων ή συστήματος βιομετρικής κατηγοριοποίησης ενημερώνουν για τη λειτουργία του συστήματος τα φυσικά πρόσωπα που εκτίθενται σε αυτό και επεξεργάζονται τα δεδομένα προσωπικού χαρακτήρα σύμφωνα με τους κανονισμούς (ΕΕ) 2016/679 και (ΕΕ) 2018/1725 και την οδηγία (ΕΕ) 2016/680, κατά περίπτωση. Η υποχρέωση αυτή δεν ισχύει για τα συστήματα ΤΝ που χρησιμοποιούνται για βιομετρική κατηγοριοποίηση και αναγνώριση συναισθημάτων, των οποίων η χρήση επιτρέπεται από τον νόμο για την ανίχνευση, την πρόληψη και τη διερεύνηση αξιόποινων πράξεων, εφόσον ισχύουν κατάλληλες διασφαλίσεις για τα δικαιώματα και τις ελευθερίες τρίτων, και σύμφωνα με το ενωσιακό δίκαιο.
|
|
Άρθρο 50 4.
|
Οι φορείς εφαρμογής συστήματος ΤΝ που δημιουργεί ή χειρίζεται περιεχόμενο εικόνας, ήχου ή βίντεο που συνιστά προϊόν βαθυπαραποίησης, γνωστοποιούν ότι το περιεχόμενο έχει παραχθεί ή υποστεί χειρισμό τεχνητά. Η υποχρέωση αυτή δεν ισχύει όταν η χρήση επιτρέπεται από τον νόμο για την ανίχνευση, την πρόληψη, τη διερεύνηση ή τη δίωξη αξιόποινων πράξεων. Όταν το περιεχόμενο αποτελεί μέρος προφανώς καλλιτεχνικού, δημιουργικού, σατιρικού, μυθοπλαστικού ή ανάλογου έργου ή προγράμματος, οι υποχρεώσεις διαφάνειας που ορίζονται στην παρούσα παράγραφο περιορίζονται στη γνωστοποίηση της ύπαρξης περιεχομένου που έχει παραχθεί ή υποστεί χειρισμό κατ’ αυτόν τον τρόπο, με κατάλληλο τρόπο που δεν εμποδίζει την προβολή ή την απόλαυση του έργου. Οι φορείς εφαρμογής συστήματος ΤΝ που δημιουργεί ή χειρίζεται κείμενο το οποίο δημοσιεύεται με σκοπό την ενημέρωση του κοινού για θέματα δημόσιου συμφέροντος γνωστοποιούν ότι το κείμενο έχει παραχθεί ή υποστεί χειρισμό τεχνητά. Η υποχρέωση αυτή δεν ισχύει όταν η χρήση επιτρέπεται από τον νόμο για την ανίχνευση, την πρόληψη, τη διερεύνηση ή τη δίωξη αξιόποινων πράξεων ή όταν το περιεχόμενο που έχει παραχθεί από ΤΝ έχει υποβληθεί σε διαδικασία ανθρώπινης επανεξέτασης ή ανθρώπινου συντακτικού ελέγχου και όταν ένα φυσικό ή νομικό πρόσωπο φέρει συντακτική ευθύνη για τη δημοσίευση του περιεχομένου.
|
|
Άρθρο 50 5.
|
Οι πληροφορίες που αναφέρονται στις παραγράφους 1 έως 4 παρέχονται στα ενδιαφερόμενα φυσικά πρόσωπα με σαφή και διακριτό τρόπο, το αργότερο κατά τη στιγμή της πρώτης αλληλεπίδρασης ή έκθεσης. Οι πληροφορίες τηρούν τις ισχύουσες απαιτήσεις προσβασιμότητας.
|
|
Άρθρο 50 6.
|
Οι παράγραφοι 1 έως 4 δεν επηρεάζουν τις απαιτήσεις και τις υποχρεώσεις που ορίζονται στο κεφάλαιο III και δεν θίγουν άλλες υποχρεώσεις διαφάνειας που ορίζονται στο ενωσιακό ή το εθνικό δίκαιο για τους φορείς εφαρμογής συστημάτων ΤΝ.
|
|
Άρθρο 50 7.
|
Η Επιτροπή ενθαρρύνει και διευκολύνει την κατάρτιση κωδίκων πρακτικής σε επίπεδο Ένωσης για τη διευκόλυνση της αποτελεσματικής εφαρμογής των υποχρεώσεων όσον αφορά την ανίχνευση, τη σήμανση και την τοποθέτηση επισήμανσης περιεχομένου που έχει τεχνητά παραχθεί ή υποστεί χειρισμό. Η Επιτροπή, λαμβάνοντας ιδιαιτέρως υπόψη τη γνώμη του Συμβουλίου ΤΝ, αξιολογεί αν η τήρηση των εν λόγω κωδίκων πρακτικής επαρκεί για τη διασφάλιση της συμμόρφωσης με τις υποχρεώσεις που καθορίζονται στις παραγράφους 2 και 4 του παρόντος άρθρου, σύμφωνα με τη διαδικασία του άρθρου 56 παράγραφος 6. Εάν η Επιτροπή κρίνει ότι ο κώδικας πρακτικής δεν είναι κατάλληλος, μπορεί να εκδώσει εκτελεστική πράξη για τον καθορισμό κοινών κανόνων για την εφαρμογή των εν λόγω υποχρεώσεων σύμφωνα με τη διαδικασία εξέτασης που καθορίζεται στο άρθρο 98 παράγραφος 2.
|
,
1.1 Παραπομπές
1.2 Εντοπισμένες απαιτήσεις
1.3 Σχετικά πρότυπα
2. Εντοπισμένες απαιτήσεις
3. Σχετικά πρότυπα
Πρότυπα
| Πηγή |
Απαίτηση |
|
SCF
|
AI & Autonomous Technologies Output Marking
Description
Mechanisms exist to mark output from Artificial Intelligence (AI) and Autonomous Technologies (AAT) in a machine-readable format so it is detectable as artificially generated or manipulated.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Label AI-generated content when distributing it
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Policy requiring labeling of AI-generated content
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI content marking policy ∙ Machine-readable metadata for AI content
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI content marking program ∙ Technical implementation of C2PA or similar standards
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI content marking framework ∙ C2PA standard implementation ∙ Automated content marking in AI pipelines
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to mark output from AAT in a machine-readable format so it is detectable as artificially generated or manipulated.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|