+Airteagal 50 Oibleagáidí trédhearcachta do sholáthraithe agus d’úsáideoirí gairmiúla córas intleachta saorga áirithe
---+Airteagal 50 1.
---+Airteagal 50 2.
---+Airteagal 50 3.
---+Airteagal 50 4.
---+Airteagal 50 5.
---+Airteagal 50 6.
---+Airteagal 50 7.
|
Airteagal 50 Oibleagáidí trédhearcachta do sholáthraithe agus d’úsáideoirí gairmiúla córas intleachta saorga áirithe
-
1. Forbhreathnú
| Teideal |
Rialáil |
|
Airteagal 50 1.
|
Maidir le córais intleachta saorga atá ceaptha idirghníomhú go díreach le daoine nádúrtha, áiritheoidh soláthraithe go ndéanfar na córais sin a dhearadh agus a fhorbairt ar bhealach a gcuirfidh na daoine nádúrtha lena mbaineann ar an eolas go bhfuil siad ag idirghníomhú le córas intleachta saorga, ach amháin más léir sin ó thaobh duine nádúrtha atá measartha eolasach, géarchúiseach agus cáiréiseach, agus na himthosca agus comhthéacs na húsáide á gcur san áireamh. Ní bheidh feidhm ag an oibleagáid sin maidir le córais intleachta saorga arna n-údarú leis an dlí chun cionta coiriúla a bhrath, a chosc, a imscrúdú nó a ionchúiseamh, faoi réir coimircí iomchuí maidir le cearta agus saoirsí tríú páirtithe, ach amháin má bhíonn na córais sin ar fáil don phobal chun cion coiriúil a thuairisciú.
|
|
Airteagal 50 2.
|
Soláthraithe córas intleachta saorga, lena n-áirítear córais intleachta saorga ilchuspóireacha, lena ngintear ábhar sintéiseach fuaime, íomhá, físe nó téacs, áiritheoidh siad go ndéanfar aschuir an chórais intleachta saorga a mharcáil i bhformáid mheaisín-inléite agus go mbeidh siad inbhraite mar ábhar a gineadh nó a ionramháladh go saorga. Áiritheoidh soláthraithe go mbeidh a réitigh theicniúla éifeachtach, idir-inoibritheach, láidir agus iontaofa a mhéid is indéanta sin go teicniúil, agus sainiúlachtaí agus teorainneacha cineálacha éagsúla ábhair, costais an chur chun feidhme agus an úrscothacht a nglactar leo i gcoitinne á gcur san áireamh, mar a d’fhéadfaí a léiriú sna caighdeáin theicniúla ábhartha. Ní bheidh feidhm ag an oibleagáid sin a mhéid a dhéanann na córais intleachta saorga feidhm chúnta le haghaidh eagarthóireacht chaighdeánach nó nach ndéanann siad athrú substaintiúil ar na sonraí ionchuir arna soláthar ag an úsáideoir gairmiúil ná ar shéimeantaic na sonraí sin, nó i gcás ina n-údaraítear le dlí iad chun cionta coiriúla a bhrath, a chosc, a imscrúdú nó a ionchúiseamh.
|
|
Airteagal 50 3.
|
Cuirfidh úsáideoirí gairmiúla córas aitheanta mothúchán nó córas catagóirithe bhithmhéadraigh na daoine nádúrtha atá nochta dó ar an eolas faoi oibriú an chórais, agus próiseálfaidh siad na sonraí pearsanta i gcomhréir le Rialacháin (AE) 2016/679 agus (AE) 2018/1725 agus Treoir (AE) 2016/680, de réir mar is infheidhme. Ní bheidh feidhm ag an oibleagáid sin maidir le córais intleachta saorga a úsáidtear le haghaidh catagóiriú bithmhéadrach agus aithint mothúchán, a cheadaítear de réir dlí chun cionta coiriúla a bhrath, a chosc agus a imscrúdú, faoi réir coimircí iomchuí do chearta agus saoirsí tríú páirtithe agus i gcomhréir le dlí an Aontais.
|
|
Airteagal 50 4.
|
Maidir le húsáideoirí gairmiúla córais intleachta saorga a ghineann nó a ionramhálann ábhar íomhá, fuaime nó físe ar domhainbhrionnú é, nochtfaidh siad go ndearnadh an t-ábhar a ghiniúint nó a ionramháil go saorga. Ní bheidh feidhm ag an oibleagáid sin i gcás ina bhfuil an úsáid údaraithe le dlí chun cion coiriúil a bhrath, a chosc, a imscrúdú nó a ionchúiseamh. I gcás ina bhfuil an t-ábhar ina chuid de shaothar nó de chlár atá ar aon dul le saothar nó clár ar léir é a bheith ealaíonta, cruthaitheach, aorach nó ficseanúil, tá na hoibleagáidí trédhearcachta a leagtar amach sa mhír seo teoranta do nochtadh gur ann d’inneachar ginte nó cúbláilte den sórt sin ar bhealach iomchuí nach gcuireann isteach ar thaispeáint ná ar theachtadh an tsaothair. I gcás úsáideoirí gairmiúla córais intleachta saorga a ghineann nó a ionramhálann téacs a fhoilsítear chun an pobal a chur ar an eolas faoi ábhair a bhaineann le leas an phobail, nochtfaidh siad go ndearnadh an téacs a ghiniúint nó a ionramháil go saorga. Ní bheidh feidhm ag an oibleagáid sin i gcás ina n-údaraítear le dlí an úsáid chun cionta coiriúla a bhrath, a chosc, a imscrúdú nó a ionchúiseamh nó i gcás ina ndearnadh próiseas athbhreithnithe dhaonna nó rialaithe eagarthóireachta ar an inneachar a ghintear le IS agus i gcás ina bhfuil freagracht eagarthóireachta ar dhuine nádúrtha nó dlítheanach as an ábhar a fhoilsiú.
|
|
Airteagal 50 5.
|
Déanfar an fhaisnéis dá dtagraítear i míreanna 1 go 4 seo a sholáthar do na daoine nádúrtha lena mbaineann ar bhealach soiléir inaitheanta, ar a dhéanaí tráth a dhéanfar an chéad idirghníomhaíocht nó an chéad nochtadh. Beidh an fhaisnéis i gcomhréir leis na ceanglais inrochtaineachta is infheidhme.
|
|
Airteagal 50 6.
|
Ní dhéanfaidh míreanna 1 go 4 difear do na ceanglais agus na hoibleagáidí a leagtar amach i gCaibidil III, agus beidh siad gan dochar d’oibleagáidí trédhearcachta eile a leagtar síos i ndlí an Aontais nó sa dlí náisiúnta le haghaidh úsáideoirí gairmiúla córas intleachta saorga.
|
|
Airteagal 50 7.
|
Déanfaidh an Coimisiún tarraingt suas na gcód cleachtais a spreagadh agus a éascú ar leibhéal an Aontais chun éascú a dhéanamh ar chur chun feidhme éifeachtach na n-oibleagáidí maidir le brath, marcáil agus lipéadú inneachair a ghintear go saorga nó a ndearnadh cúbláil air. Déanfaidh an Coimisiún, agus lánaird á tabhairt aige ar thuairim an Bhoird, measúnú i dtaobh an leor comhlíonadh na gcód cleachtais sin chun a áirithiú go gcomhlíontar an oibleagáid a leagtar síos i míreanna 2 agus 4 den Airteagal seo, i gcomhréir leis an nós imeachta a leagtar síos in Airteagal 56(6). Má mheasann an Coimisiún nach bhfuil an cód cleachtais leordhóthanach, féadfaidh sé gníomh cur chun feidhme a ghlacadh lena sonrófar comhrialacha maidir le cur chun feidhme na n-oibleagáidí sin i gcomhréir leis an nós imeachta scrúdúcháin a leagtar síos in Airteagal 98(2).
|
,
1.1 Tagairtí
1.2 Ceanglais aitheanta
1.3 Caighdeáin ghaolmhara
2. Ceanglais aitheanta
Ceanglais
| Foinse |
Ceanglas |
3. Caighdeáin ghaolmhara
Caighdeáin
| Foinse |
Ceanglas |
|
SCF
|
AI & Autonomous Technologies Output Marking
Description
Mechanisms exist to mark output from Artificial Intelligence (AI) and Autonomous Technologies (AAT) in a machine-readable format so it is detectable as artificially generated or manipulated.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Label AI-generated content when distributing it
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Policy requiring labeling of AI-generated content
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI content marking policy ∙ Machine-readable metadata for AI content
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI content marking program ∙ Technical implementation of C2PA or similar standards
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI content marking framework ∙ C2PA standard implementation ∙ Automated content marking in AI pipelines
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to mark output from AAT in a machine-readable format so it is detectable as artificially generated or manipulated.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program ∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework ∙ Automated disclosure mechanisms ∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are: (1) Utilizing an AAT solution; and (2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|