+50 artikla Tiettyjen tekoälyjärjestelmien tarjoajia ja käyttöönottajia koskevat avoimuusvelvoitteet
---+50 artikla 1.
---+50 artikla 2.
---+50 artikla 3.
---+50 artikla 4.
---+50 artikla 5.
---+50 artikla 6.
---+50 artikla 7.
|
50 artikla Tiettyjen tekoälyjärjestelmien tarjoajia ja käyttöönottajia koskevat avoimuusvelvoitteet
-
1. Yleiskatsaus
| Otsikko |
Sääntely |
|
50 artikla 1.
|
Tarjoajien on varmistettava, että luonnollisten henkilöiden kanssa suoraan vuorovaikutukseen tarkoitetut tekoälyjärjestelmät suunnitellaan ja toteutetaan siten, että asianomaisille luonnollisille henkilöille ilmoitetaan, että he ovat vuorovaikutuksessa tekoälyjärjestelmän kanssa, ellei tämä ole ilmeistä sellaisen luonnollisen henkilön näkökulmasta, joka on suhteellisen valistunut, tarkkaavainen ja huolellinen ottaen huomioon olosuhteet ja käytön asiayhteys. Tätä velvoitetta ei sovelleta tekoälyjärjestelmiin, joita on lain mukaan sallittua käyttää rikosten paljastamiseen, estämiseen tai tutkimiseen ja rikoksiin liittyviin syytetoimiin, edellyttäen, että kolmansien osapuolten oikeudet ja vapaudet turvataan asianmukaisesti, paitsi jos kyseiset järjestelmät ovat julkisesti saatavilla rikosilmoitusten tekemistä varten.
|
|
50 artikla 2.
|
Synteettistä ääni-, kuva-, video- tai tekstisisältöä tuottavien tekoälyjärjestelmien, mukaan lukien yleiskäyttöiset tekoälyjärjestelmät, tarjoajien on varmistettava, että tekoälyjärjestelmän tuotokset merkitään koneellisesti luettavassa muodossa ja että ne voidaan tunnistaa keinotekoisesti tuotetuiksi tai manipuloiduiksi. Tarjoajien on varmistettava siinä määrin kuin se on teknisesti mahdollista, että niiden tekniset ratkaisut ovat tehokkaita, yhteentoimivia, vakaita ja luotettavia, ottaen huomioon monenlaisten sisältöjen erityispiirteet ja rajoitukset, toteuttamiskustannukset ja yleisesti tunnustettu uusin teknologia, jotka voidaan huomioida asianmukaisissa teknisissä standardeissa. Tätä velvoitetta ei sovelleta tapauksissa, joissa tekoälyjärjestelmät avustavat vakiomuokkaamista tai eivät olennaisesti muuta käyttöönottajan toimittamia syöttödataa tai sen semantiikkaa tai jos niitä on lain mukaan sallittua käyttää rikosten paljastamiseen, estämiseen ja tutkimiseen tai rikoksiin liittyviin syytetoimiin.
|
|
50 artikla 3.
|
Tunteentunnistusjärjestelmän tai biometrisen luokitusjärjestelmän käyttöönottajien on ilmoitettava järjestelmän toiminnasta niille luonnollisille henkilöille, jotka altistuvat järjestelmälle, ja käsiteltävä heidän henkilötietonsa tapauksen mukaan asetuksen (EU) 2016/679, asetuksen (EU) 2018/1725 ja direktiivin (EU) 2016/680 mukaisesti. Tätä velvoitetta ei sovelleta biometriseen luokitteluun ja tunteentunnistamiseen käytettyihin tekoälyjärjestelmiin, joita on lain mukaan luvallista käyttää rikosten paljastamiseen, estämiseen tai tutkimiseen, edellyttäen, että kolmansien osapuolten oikeudet ja vapaudet turvataan asianmukaisesti, ja että unionin oikeuden mukaisesti.
|
|
50 artikla 4.
|
Sellaisen tekoälyjärjestelmän, joka tuottaa tai manipuloi syväväärennöksen muodostavaa kuva-, ääni- tai videosisältöä, käyttöönottajien on ilmoitettava, että sisältö on keinotekoisesti tuotettu tai että sitä on manipuloitu. Tätä velvoitetta ei sovelleta, jos käyttö on lain mukaan sallittu rikosten paljastamiseen, estämiseen ja tutkimiseen tai rikoksiin liittyviin syytetoimiin. Jos sisältö on osa selvästi taiteellista, luovaa, satiirista, fiktiivistä tai vastaavaa teosta tai ohjelmaa, tässä kohdassa säädetyt avoimuusvelvoitteet rajoittuvat siihen, että tällaisesta tuotetusta tai manipuloidusta sisällöstä ilmoitetaan asianmukaisesti tavalla, joka ei haittaa teoksen esittämistä tai sen käyttöä. Tekoälyjärjestelmän, joka tuottaa tai manipuloi tekstiä, jonka julkaisemisen tarkoituksena on tiedottaa yleisölle yleistä etua koskevista asioista, käyttöönottajien on ilmoitettava, että teksti on keinotekoisesti tuotettu tai sitä on manipuloitu. Tätä velvoitetta ei sovelleta, jos käyttö on lain mukaan sallittu rikosten paljastamiseen, estämiseen, tutkimiseen tai rikoksiin liittyviin syytetoimiin, tai jos tekoälyn tuottama sisältö on läpikäynyt ihmisen suorittaman arviointiprosessin tai toimituksellisen valvonnan ja jos luonnollisella henkilöllä tai oikeushenkilöllä on toimituksellinen vastuu sisällön julkaisemisesta.
|
|
50 artikla 5.
|
Edellä 1–4 kohdassa tarkoitetut tiedot on annettava asiaankuuluville luonnollisille henkilöille selkeällä ja selvästi erottuvalla tavalla viimeistään ensimmäisen vuorovaikutuksen tai altistumisen yhteydessä. Tietojen on oltava sovellettavien esteettömyysvaatimusten mukaisia.
|
|
50 artikla 6.
|
Edellä olevat 1–4 kohta eivät vaikuta III luvussa vahvistettuihin vaatimuksiin ja velvoitteisiin, eivätkä ne rajoita muiden unionin tai kansallisessa lainsäädännössä tekoälyjärjestelmien käyttöönottajille asetettujen avoimuusvelvoitteiden soveltamista.
|
|
50 artikla 7.
|
Komissio kannustaa ja helpottaa käytännesääntöjen laatimista unionin tasolla, jotta voidaan helpottaa keinotekoisesti tuotetun tai manipuloidun sisällön havaitsemista ja merkitsemistä koskevien velvoitteiden tehokasta täytäntöönpanoa. Komissio arvioi 56 artiklan 6 kohdassa säädettyä menettelyä noudattaen, ottaen tekoälyneuvoston lausunnon mahdollisimman tarkasti huomioon, riittääkö näiden käytännesääntöjen noudattaminen varmistamaan tämän artiklan 2 ja 4 kohdassa säädettyjen velvoitteiden noudattamisen. Jos komissio katsoo, että käytännesäännöt ovat riittämättömiä, komissio voi antaa 98 artiklan 2 kohdassa säädettyä tarkastelumenettelyä noudattaen täytäntöönpanosäädöksen, jossa täsmennetään yhteiset säännöt kyseisten velvoitteiden täytäntöönpanemiseksi.
|
,
1.1 Viittaukset
1.2 Tunnistetut vaatimukset
1.3 Liittyvät standardit
2. Tunnistetut vaatimukset
Vaatimukset
| Lähde |
Vaatimus |
3. Liittyvät standardit
Standardit
| Lähde |
Vaatimus |
|
SCF
|
AI & Autonomous Technologies Output Marking
Description
Mechanisms exist to mark output from Artificial Intelligence (AI) and Autonomous Technologies (AAT) in a machine-readable format so it is detectable as artificially generated or manipulated.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Label AI-generated content when distributing it
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Policy requiring labeling of AI-generated content
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI content marking policy ∙ Machine-readable metadata for AI content
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI content marking program ∙ Technical implementation of C2PA or similar standards
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI content marking framework ∙ C2PA standard implementation ∙ Automated content marking in AI pipelines
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to mark output from AAT in a machine-readable format so it is detectable as artificially generated or manipulated.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|