+Airteagal 5 Cleachtais intleachta saorga a gcuirtear toirmeasc orthu
---+Airteagal 5 1.
---+Airteagal 5 1a.
---+Airteagal 5 1b.
---+Airteagal 5 2.
---+Airteagal 5 3.
---+Airteagal 5 4.
---+Airteagal 5 5.
---+Airteagal 5 6.
---+Airteagal 5 7.
---+Airteagal 5 8.

Airteagal 5 Cleachtais intleachta saorga a gcuirtear toirmeasc orthu

-

1. Forbhreathnú

,
Teideal Rialáil
Airteagal 5 1.

Cuirfear toirmeasc ar na cleachtais intleachta saorga seo a leanas:

(a) 

córas intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse nó a úsáid, ar córas é lena n-imscartar teicnící fo-thairseachúla nach bhfuil fios ag an duine orthu nó teicnící ionramhála nó meabhlacha d’aon ghnó, agus é mar chuspóir leis sin nó mar thoradh air sin iompraíocht duine nó grúpa daoine a shaobhadh go hábhartha trí chumas an duine a lagú go suntasach i dtaobh cinneadh feasach a dhéanamh, rud a chuirfeadh faoi deara dóibh cinneadh a dhéanamh nach ndéanfadh siad murach sin ar mhodh is cúis le díobháil shuntasach don duine sin, do dhuine eile nó do ghrúpa daoine, nó ar dócha le réasún gurb é is cúis léi sin;

(b) 

córas intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse nó a úsáid, ar córas é a théann i dtír ar dhuine nádúrtha nó ar aon cheann de leochaileachtaí atá ag grúpa sonrach daoine i ngeall ar a n-aois, ar a míchumas nó staid shonrach shóisialta nó eacnamaíoch, agus é de chuspóir nó d’éifeacht iompar an duine sin nó duine a bhaineann leis an ngrúpa sin a shaobhadh go hábhartha ar mhodh is cúis le díobháil shuntasach don duine sin nó do dhuine eile, nó ar dócha gurb é is cúis leis sin;

▼M1

(ba) 

córas intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse nó a úsáid, ar córas é a ghineann nó a ionramhálann íomhánna, físeáin, fuaim nó ábhar comhchosúil de bhaill collaí duine nádúrtha in-sainaitheanta nó de dhuine nádúrtha in-sainaitheanta atá ag gabháil do ghníomhaíochtaí gáirsiúla, gan toiliú sonrach, feasach, gan débhrí agus sainráite a bheith tugtha faoi shaoirse ag an duine sin don ghiniúint nó don ionramháil sin;

(bb) 

córas intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse nó a úsáid, ar córas é ghineann nó a ionramhálann ábhar nó taibhiú de réir bhrí Airteagal 2, pointí (c) agus (e), de Threoir 2011/93/AE, ach amháin i gcás ina bhfuil feidhm ag cosaint “gan cheart” faoin dlí náisiúnta;

▼B

(c) 

córais intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse nó a úsáid chun meastóireacht nó aicmiú a dhéanamh ar dhaoine nádúrtha nó ar ghrúpaí díobh i gcaitheamh tréimhse áirithe ama bunaithe ar a n-iompraíocht shóisialta nó a saintréithe pearsanta nó pearsantachta atá ar eolas, intuigthe nó tuartha, agus an scór sóisialta as a dtiocfaidh ceachtar díobh seo a leanas nó an dá cheann díobh seo a leanas:

(i) 

caitheamh díobhálach nó neamhfhabhrach le daoine nádúrtha áirithe nó le grúpaí daoine i gcomhthéacsanna sóisialta nach mbaineann leis na comhthéacsanna inar gineadh nó inar bailíodh na sonraí i dtosach;

(ii) 

caitheamh díobhálach nó neamhfhabhrach le daoine nádúrtha áirithe nó le grúpaí daoine nach bhfuil údar léi nó atá díréireach lena n-iompraíocht shóisialta nó le tromchúis na hiompraíochta sin;

(d) 

córas intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse chun na críche sonraí sin, nó a úsáid chun measúnuithe riosca a dhéanamh ar dhaoine nádúrtha chun a mheas nó a thuar an riosca go ndéanfaidh duine nádúrtha cion coiriúil bunaithe ar phróifíliú duine nádúrtha, agus air sin amháin, nó ar mheasúnú a dhéanamh ar a thréithe agus a shaintréithe pearsantachta; ní bheidh feidhm ag an toirmeasc seo maidir le córais intleachta saorga a úsáidtear chun tacú leis an measúnú daonna ar rannpháirtíocht duine i ngníomhaíocht choiriúil atá bunaithe cheana féin ar fhíorais oibiachtúla infhíoraithe a bhfuil baint dhíreach acu le gníomhaíocht choiriúil;

(e) 

córais intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse chun na críche sonraí sin, nó a úsáid, ar córais iad lena gcruthaítear nó lena leathnaítear bunachair sonraí aghaidh-aitheanta trí íomhánna den aghaidh a chnuaschóipeáil gan spriocdhíriú ón idirlíon nó ó thaifid TCI;

(f) 

córais intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse chun na críche sonraí sin, nó a úsáid chun mothúcháin duine nádúrtha a thuiscint i réimsí an ionaid oibre agus na n-institiúidí oideachais, ach amháin i gcás ina bhfuil sé beartaithe úsáid an chórais intleachta saorga a chur ar bun nó a chur isteach sa mhargadh ar chúiseanna leighis nó sábháilteachta;

(g) 

córais catagóirithe bhithmhéadraigh a chur ar an margadh, a chur i mbun seirbhíse chun na críche sonraí sin, nó a úsáid ar córais iad lena ndéantar daoine nádúrtha aonair a aicmiú bunaithe ar a sonraí bithmhéadracha chun cine, tuairimí polaitiúla, ballraíocht i gceardchumann, creideamh reiligiúnach nó fealsúnach, saol gnéis nó gnéaschlaonadh a dhéanamh amach nó a thuiscint; ní chumhdaítear faoin toirmeasc sin aon lipéadú ná scagadh ar thacair sonraí bithmhéadracha a fuarthas go dleathach, amhail íomhánna, bunaithe ar shonraí bithmhéadracha nó catagóiriú sonraí bithmhéadracha i réimse fhorfheidhmiú an dlí;

(h) 

córais cian-sainaitheanta bithmhéadraí fíor-ama a bheith á n-úsáid i spásanna atá inrochtana don phobal chun críocha a bhaineann le forfheidhmiú an dlí, ach amháin a mhéid agus atá géarghá le húsáid den sórt sin le haghaidh ceann de na cuspóirí seo a leanas:

(i) 

cuardach spriocdhírithe a dhéanamh ar íospartaigh shonracha a bhaineann le fuadach, gáinneáil ar dhaoine nó teacht i dtír gnéasach ar dhaoine, chomh maith le daoine atá ar iarraidh a chuardach;

(ii) 

garbhagairt shonrach shubstaintiúil ar bheatha nó ar shábháilteacht fhisiciúil daoine nádúrtha ó ionsaí sceimhlitheoireachta a chosc nó fíorbhagairt láithreach nó fíorbhagairt intuartha ó ionsaí sceimhlitheoireachta a chosc;

(iii) 

logánú nó sainaithint duine a bhfuil amhras faoi go ndearna sé cion coiriúil, chun críoch imscrúdú coiriúil nó ionchúiseamh coiriúil a dhéanamh nó pionós coiriúil a fhorghníomhú i leith na gcionta dá dtagraítear in Iarscríbhinn II agus atá inphionóis sa Bhallstát lena mbaineann le pianbhreith choimeádta nó le hordú coinneála go ceann uastréimhse 4 bliana, ar a laghad.

Tá pointe (h) den chéad fhomhír gan dochar d’Airteagal 9 de Rialachán (AE) 2016/679 i ndáil le sonraí bithmhéadracha a phróiseáil chun críocha seachas forfheidhmiú an dlí.

Airteagal 5 1a.

Chun críocha mhír 1, an chéad fhomhír, pointí (ba) agus (bb):

(a) 

ní chuirfear toirmeasc ar chóras intleachta saorga a chur ar an margadh, a chur i mbun seirbhíse nó a úsáid, ar córas é a ghineann nó a ionramhálann an t-ábhar nó an taibhiú dá dtagraítear i mír 1, an chéad fhomhír, pointe (ba) nó (bb) ach amháin sna cásanna seo a leanas:

(i) 

is í an ghiniúint nó an ionramháil sin an chríoch atá beartaithe don chóras intleachta saorga; nó

(ii) 

fágann dearadh, oiliúint, ailtireacht, nó cumais an chórais, nó feidhmiúlachtaí an chórais a n-idirghníomhaíonn an t-úsáideoir leo, gur toradh atá measartha intuartha agus in-atáirgthe í an ghiniúint nó an ionramháil sin nach n-éilíonn modhnú teicniúil suntasach, agus níl bearta sábháilteachta teicniúla réasúnta agus leormhaithe ná coimircí eile ag an gcóras chun an ghiniúint nó an ionramháil sin a chosc go hiontaofa, agus mí-úsáid atá measartha intuartha á cur san áireamh, agus chun mí-úsáid bhreathnaithe nó thuairiscithe a cheartú;

(b) 

ní chuirtear toirmeasc ar úsáid córais intleachta saorga a ghineann nó a ionramhálann an t-ábhar nó an taibhiú dá dtagraítear i mír 1, an chéad fhomhír, pointí (ba) agus (bb) ach amháin i gcás ina n-úsáideann an t-úsáideoir gairmiúil an córas chun an t-ábhar nó an taibhiú sin a ghiniúint nó a ionramháil.

Airteagal 5 1b.
Chun críocha mhír 1, an chéad fhomhír, pointe (ba), ní hionramháil a bheidh i gcóras intleachta saorga a dhéanann ábhar a ionramháil ar bhealach nach méadaíonn an nochtadh d’aon bhaill chollaí a léirítear ná nach n-athraíonn cineál aon ghníomhaíochtaí gáirsiúla a léirítear.
Airteagal 5 2.

Ní úsáidfear córas cian-sainaitheanta bithmhéadraí “fíor-ama” i spásanna atá inrochtana don phobal chun críocha forfheidhmiú an dlí le haghaidh aon cheann de na cuspóirí dá dtagraítear i mír 1, an chéad fhomhír, pointe (h), chun na gcríoch a leagtar amach sa phointe sin ach amháin chun céannacht an duine a bhfuiltear ag díriú air go sonrach a dheimhniú, agus cuirfear na heilimintí seo a leanas san áireamh ann:

(a) 

staid an cháis a d’fhágfadh go bhféadfaí é a úsáid, go háirithe i gcás nach n-úsáidtear an córas, a thromchúisí a bheadh an díobháil agus dóchúlacht agus scála na díobhála sin;

(b) 

iarmhairtí úsáid an chórais do chearta agus saoirsí gach duine lena mbaineann, go háirithe a thromchúisí a bheadh na hiarmhairtí sin agus dóchúlacht agus scála na n-iarmhairtí sin.

Ina theannta sin, maidir le húsáid córas cian-sainaitheanta bithmhéadraí “fíor-ama” i spásanna atá inrochtana don phobal chun críocha a bhaineann le forfheidhmiú an dlí le haghaidh aon cheann de na cuspóirí dá dtagraítear i mír 1, an chéad fhomhír, pointe (h), den Airteagal seo, comhlíonfar na coimircí agus na coinníollacha is gá agus is comhréireach i ndáil lena n-úsáid, i gcomhréir leis an dlí náisiúnta lena n-údaraítear a n-úsáid, go háirithe a mhéid a bhaineann leis na teorainneacha ama, geografacha agus pearsanta. Ní údarófar úsáid an chórais cian-sainaitheanta bithmhéadraí “fíor-ama” i spásanna atá inrochtana don phobal ach amháin má tá measúnú tionchair ar chearta bunúsacha dá bhforáiltear in Airteagal 27 curtha i gcrích ag an údarás forfheidhmithe dlí agus má chláraigh sé an córas i mbunachar sonraí an Aontais de réir Airteagal 49. I gcásanna práinne a bhfuil údar cuí leo, áfach, féadfar tús a chur le húsáid na gcóras sin agus gan iad a bheith cláraithe i mbunachar sonraí an Aontais, ar choinníoll go gcuirfear an clárú sin i gcrích gan moill mhíchuí.

Airteagal 5 3.
Chun críocha mhír 1, an chéad fhomhír, pointe (h) agus mhír 2, maidir le gach úsáid a bhaintear as an gcóras cian-sainaitheanta bithmhéadraí “fíor-ama” chun críocha a bhaineann le forfheidhmiú an dlí i spásanna atá inrochtana don phobal, beidh an úsáid sin faoi réir údarú roimh ré arna dheonú ag údarás breithiúnach nó ag údarás riaracháin neamhspleách a bhfuil a chinneadh ceangailteach ar an mBallstát ina bhfuil an úsáid le baint as an gcóras, údarú arna eisiúint ar iarraidh réasúnaithe agus i gcomhréir le rialacha mionsonraithe an dlí náisiúnta dá dtagraítear i mír 5. Mar sin féin, i gcás práinne a bhfuil údar cuí léi, féadfar tús a chur le húsáid an chórais sin gan údarú ar choinníoll go n-iarrtar an t-údarú sin gan moill mhíchuí, laistigh de 24 uair an chloig, ar a dhéanaí. Má dhiúltaítear an t-údarú sin, cuirfear deireadh leis an úsáid le héifeacht láithreach agus, déanfar na sonraí go léir, chomh maith le torthaí agus aschur na húsáide sin, a chur i leataobh agus a scriosadh láithreach.

Ní thabharfaidh an t-údarás inniúil breithiúnach ná an t-údarás riaracháin neamhspleách a bhfuil a chinneadh ceangailteach an t-údarú ach amháin i gcás inar deimhin leis, bunaithe ar fhianaise oibiachtúil nó ar thásca soiléire arna gcur faoina bhráid, gur gá an córas cian-sainaitheanta bithmhéadraí “fíor-ama” atá i gceist a úsáid agus gur comhréireach é a úsáid chun ceann de na cuspóirí a shonraítear i mír 1, an chéad fhomhír, pointe (h), a bhaint amach, faoi mar a shainaithnítear san iarraidh agus, go háirithe, go bhfuil sé fós teoranta don mhéid atá fíor-riachtanach maidir leis an tréimhse ama chomh maith leis an raon feidhme geografach agus pearsanta. Agus cinneadh á dhéanamh maidir leis an iarraidh sin, cuirfidh an t-údarás sin na gnéithe dá dtagraítear i mír 2 san áireamh. Ní fhéadfar aon chinneadh a mbeidh éifeacht dhíobhálach dhlíthiúil aige ar dhuine a dhéanamh bunaithe ar aschur an chórais cian-sainaitheanta bithmhéadraí “fíor-ama” amháin.

Airteagal 5 4.
Gan dochar do mhír 3, déanfar gach úsáid a bhaintear as córas cian-sainaitheanta bithmhéadraí “fíor-ama” i spásanna atá inrochtana don phobal chun críocha a bhaineann le forfheidhmiú an dlí a chur in iúl don údarás faireachais margaidh ábhartha agus don údarás náisiúnta cosanta sonraí i gcomhréir leis na rialacha náisiúnta dá dtagraítear i mír 5. Beidh san fhógra, ar a laghad, an fhaisnéis a shonraítear faoi mhír 6 agus ní áireofar ann sonraí oibríochtúla íogaire.
Airteagal 5 5.
Féadfaidh Ballstát a chinneadh foráil a dhéanamh maidir leis an bhféidearthacht úsáid córas cian-sainaitheanta bithmhéadraí “fíor-ama” a údarú go hiomlán nó i bpáirt i spásanna atá inrochtana don phobal chun críocha a bhaineann le forfheidhmiú an dlí laistigh de na teorainneacha agus faoi na coinníollacha a liostaítear i mír 1, an chéad fhomhír, pointe (h), agus i míreanna 2 agus 3. Leagfaidh na Ballstáit sin lena mbaineann síos ina ndlí náisiúnta na rialacha mionsonraithe is gá maidir leis na húdaruithe dá dtagraítear i mír 3 a iarraidh, a eisiúint agus a fheidhmiú mar aon le maoirseacht agus tuairisciú a bhaineann leis na húdaruithe sin. Maidir leis na cuspóirí a liostaítear i mír 1, an chéad fhomhír, pointe (h), lena n-áirítear na cionta coiriúla dá dtagraítear i bpointe (h)(iii) di, sonrófar sna rialacha sin freisin cé acu na cuspóirí sin agus cé acu na cionta sin a bhféadfaidh na húdaráis inniúla a údarú ina leith na córais sin a úsáid chun críocha a bhaineann le forfheidhmiú an dlí. Tabharfaidh na Ballstáit fógra don Choimisiún faoi na rialacha sin 30 lá, ar a dhéanaí, tar éis a nglactha. Féadfaidh na Ballstáit, i gcomhréir le dlí an Aontais, dlíthe níos sriantaí a thabhairt isteach maidir le húsáid córas cian-sainaitheanta bithmhéadraí “fíor-ama”.
Airteagal 5 6.
Cuirfidh údaráis náisiúnta faireachas margaidh agus údaráis náisiúnta cosanta sonraí na mBallstát ar tugadh fógra dóibh maidir le húsáid córas cian-sainaitheanta bithmhéadraí “fíor-ama” i spásanna atá inrochtana don phobal chun críocha a bhaineann le forfheidhmiú an dlí de bhun mhír 4, cuirfidh siad tuarascálacha bliantúla maidir leis an úsáid sin faoi bhráid an Choimisiúin. Chun na críche sin, cuirfidh an Coimisiún teimpléad ar fáil do na Ballstáit agus do na húdaráis náisiúnta faireachais margaidh agus do na húdaráis náisiúnta cosanta sonraí, lena n-áirítear faisnéis faoi líon na gcinntí a rinne an t-údarás inniúil breithiúnach nó an t-údarás riaracháin neamhspleách a bhfuil a chinneadh ceangailteach ar iarrataí ar údaruithe i gcomhréir le mír 3 agus ar thorthaí na gcinntí sin.
Airteagal 5 7.
Foilseoidh an Coimisiún tuarascálacha bliantúla maidir le húsáid córas cian-sainaitheanta bithmhéadraí fíor-ama i spásanna atá inrochtana don phobal chun críocha a bhaineann le forfheidhmiú an dlí, bunaithe ar shonraí comhiomlánaithe sna Ballstáit ar bhonn na dtuarascálacha bliantúla dá dtagraítear i mír 6. Ní áireofar sna tuarascálacha bliantúla sin sonraí oibríochtúla íogaire maidir le gníomhaíochtaí na n-údarás forfheidhmithe dlí lena mbaineann.
Airteagal 5 8.
Ní dhéanfaidh an tAirteagal seo difear do na toirmisc a bhfuil feidhm leo i gcás ina sáraíonn cleachtas intleachta saorga dlí eile de chuid an Aontais.

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais
Foinse Ceanglas

3. Caighdeáin ghaolmhara

Caighdeáin
Foinse Ceanglas
SCF AI & Autonomous Technologies Conformity

Description

Mechanisms exist to ensure deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) conform to applicable statutory and regulatory requirements, based on:
(1) Defined use cases;
(2) Geographic markets; and
(3) Use of Intellectual Property (IP).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Review applicable AI regulations before deploying AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Legal review of AI deployments for regulatory compliance

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI compliance review process
∙ Regulatory mapping (EU AI Act, NIST AI RMF)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI regulatory compliance program
∙ Dedicated compliance review for AI deployments

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI regulatory compliance framework
∙ Legal and compliance team integration
∙ Automated regulatory tracking
∙ AI Act conformity assessments

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure deployed AAT conform to applicable statutory and regulatory requirements, based on:
(1) Defined use cases;
(2) Geographic markets; and
(3) Use of Intellectual Property (IP).

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Manipulative or Deceptive Techniques

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that utilize manipulative or deceptive techniques (including biased data) to impair an individual's ability to make a reasonably informed decision.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting use of AI tools with deceptive/manipulative capabilities

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting manipulative AI techniques

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy prohibiting manipulative AI
∙ Review process before AI tool adoption

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program
∙ Formal prohibition on manipulative AI
∙ Vendor agreements with ethics requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Ethics board review
∙ Regulatory compliance for AI manipulation prohibitions

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that utilize manipulative or deceptive techniques (including biased data) to impair an individual's ability to make a reasonably informed decision.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Materially Distorting Behaviors

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that exploit a human subject to materially affect a targeted behavior due to their:
(1) Age;
(2) Disability; or
(3) Specific social or economic situation.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting AI tools that exploit human vulnerabilities

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting exploitative AI behaviors

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy prohibiting materially distorting AI
∙ Impact assessment process

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Vendor compliance requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Human rights impact assessments
∙ Regulatory compliance mapping

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that exploit a human subject to materially affect a targeted behavior due to their:
(1) Age;
(2) Disability; or
(3) Specific social or economic situation.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Social Scoring

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that:
(1) Evaluate human subjects over a certain period of time based on their social behavior or known, inferred or predicted personal or personality characteristics; and
(2) Assign a "social score" branding or equivalent classification.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting social scoring AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting social scoring

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on social scoring AI
∙ Review process before AI adoption

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Legal review for AI deployments

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Regulatory compliance (EU AI Act Art. 5)
∙ Automated detection of prohibited practices

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that:
(1) Evaluate human subjects over a certain period of time based on their social behavior or known, inferred or predicted personal or personality characteristics; and
(2) Assign a "social score" branding or equivalent classification.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Detrimental or Unfavorable Treatment

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting AI tools causing unfair treatment

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting discriminatory AI

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy on AI fairness and non-discrimination

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI fairness program
∙ Bias testing before deployment
∙ Vendor requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI fairness framework
∙ Automated bias detection tools
∙ Third-party AI audits

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Detrimental or Unfavorable Treatment

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting AI tools causing unfair treatment

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting discriminatory AI

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy on AI fairness and non-discrimination

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI fairness program
∙ Bias testing before deployment
∙ Vendor requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI fairness framework
∙ Automated bias detection tools
∙ Third-party AI audits

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Risk and Criminal Profiling

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that:
(1) Assess the risk of an individual committing a criminal offence; and
(2) Predict risk based solely on the profiling of personality traits and characteristics.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting criminal risk profiling AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting criminal profiling AI

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on AI-based criminal profiling
∙ Legal review

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Legal and compliance review

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Regulatory compliance (EU AI Act Art. 5)
∙ Legal review process

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that:
(1) Assess the risk of an individual committing a criminal offence; and
(2) Predicts risk based solely on the profiling of personality traits and characteristics.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Populating Facial Recognition Databases

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that create, or expand, facial recognition databases through scraping facial images from:
(1) The Internet; or
(2) Closed-Circuit Television (CCTV) footage.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting facial recognition database scraping tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting facial recognition database scraping

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on scraping facial recognition databases

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Technical controls to prevent scraping

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Technical controls against facial recognition scraping
∙ Regulatory compliance

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that create, or expand, facial recognition databases through scraping facial images from:
(1) The Internet; or
(2) Closed-Circuit Television (CCTV) footage.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Emotion Inference

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that infer human emotions of an individual based on observed characteristics.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting emotion inference AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting emotion inference

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on AI emotion inference tools

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program
∙ Prohibition enforced in vendor agreements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Regulatory compliance mapping
∙ Technical controls against emotion inference

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that infer human emotions of an individual based on observed characteristics.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Biometric Categorization

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's:
(1) Race;
(2) Political opinions;
(3) Trade union membership;
(4) Religious or philosophical beliefs;
(5) Sex life or sexual orientation; and/or
(6) Age.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting biometric categorization AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting biometric categorization

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on biometric categorization AI

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Legal review for biometric technologies

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics and privacy framework
∙ Regulatory compliance (EU AI Act, GDPR)
∙ Technical controls

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that categorize an individual based on their biometric data to deduce, or infer, the individual's:
(1) Race;
(2) Political opinions;
(3) Trade union membership;
(4) Religious or philosophical beliefs;
(5) Sex life or sexual orientation; and/or
(6) Age.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.