+Artikolu 5 Prattiki tal-IA pprojbiti
---+Artikolu 5 1.
---+Artikolu 5 1a.
---+Artikolu 5 1b.
---+Artikolu 5 2.
---+Artikolu 5 3.
---+Artikolu 5 4.
---+Artikolu 5 5.
---+Artikolu 5 6.
---+Artikolu 5 7.
---+Artikolu 5 8.

Artikolu 5 Prattiki tal-IA pprojbiti

-

1. Ħarsa ġenerali

,
Titlu Regolamentazzjoni
Artikolu 5 1.

Il-prattiki tal-IA li ġejjin għandhom ikunu pprojbiti:

(a) 

l-introduzzjoni fis-suq, it-tqegħid fis-servizz jew l-użu ta' sistema tal-IA li tuża tekniki subliminali li persuna ma tkunx konxja tagħhom jew tekniki intenzjonalment manipulattivi jew qarrieqa, bil-għan jew bir-riżultat li materjalment ifixklu l-imġiba ta' persuna jew ta' grupp ta' persuni billi jdgħajfu b'mod sinifikanti l-abbiltà tagħha li tieħu deċiżjoni infurmata, u minħabba f'hekk huma jieħdudeċiżjoni li kieku ma kinux jieħdu b'mod li jikkawża jew li aktarx raġonevolament jikkawża ħsara sinifikanti lil dik il-persuna, lil persuna oħra jew lil grupp ta' persuni;

(b) 

l-introduzzjoni fis-suq, it-tqegħid fis-servizz jew l-użu ta' sistema tal-IA li tisfrutta kwalunkwe waħda mill-vulnerabbiltajiet ta' persuna fiżika jew ta' grupp speċifiku ta' persuni minħabba l-età, diżabbiltà jew sitwazzjoni soċjali jew ekonomika speċifika, bl-għan jew bir-riżultat li tfixkel materjalment l-imġiba ta' dik il-persuna jew ta' persuna li tappartjeni għal dak il-grupp b'mod li jikkawża jew li raġonevolment aktarx jikkawża ħsara sinifikanti lil dik il-persuna jew lil persuna oħra;

▼M1

(ba) 

l-introduzzjoni fis-suq, it-tqegħid fis-servizz jew l-użu ta’ sistema tal-IA li tiġġenera jew timmanipula immaġni, vidjo jew awdjo realistiċi jew materjal simili ta’ partijiet intimi ta’ persuna fiżika identifikabli, jew ta’ persuni fiżiċi identifikabbli involuti f’attivitajiet sesswalment espliċiti, mingħajr il-kunsens mogħti liberament, speċifiku, infurmat u mhux ambigwu u espliċitu ta’ dik il-persuna għal dik il-ġenerazzjoni jew manipulazzjoni;

(bb) 

l-introduzzjonifis-suq, it-tqegħid fis-servizz jew l-użu ta’ sistema tal-IA li tiġġenera jew timmanipula l-materjal jew il-prestazzjoni skont it-tifsira tal-Artikolu 2, il-punti (c) u (e), tad-Direttiva 2011/93/UE, ħlief meta tkun tapplika difiża “mingħajr dritt” taħt il-liġi nazzjonali;

▼B

(c) 

l-introduzzjoni fis-suq, it-tqegħid fis-servizz jew l-użu ta' sistemi tal-IA għall-evalwazzjoni jew il-klassifikazzjoni ta' persuni fiżiċi jew gruppi ta' persuni tul ċertu perjodu ta' żmien abbażi tal-imġiba soċjali tagħhom jew ta' karatteristiċi personali jew tal-personalità magħrufa, inferiti jew previsti, fejn il-punteġġ għaċ-ċittadini jwassal għal wieħed minn dawn li ġejjin jew għat-tnejn li huma:

(i) 

trattament detrimentali jew mhux favorevoli ta' ċerti persuni fiżiċi jew ta' gruppi ta' persuni f'kuntesti soċjali li mhumiex relatati mal-kuntesti li fihom id-data kienet oriġinarjament iġġenerata jew miġbura;

(ii) 

trattament detrimentali jew mhux favorevoli ta' ċerti persuni fiżiċi jew ta' gruppi ta' persuni li ma jkunx ġustifikat jew li jkun sproporzjonat għall-imġiba soċjali tagħhom jew għall-gravità tagħha;

(d) 

l-introduzzjoni fis-suq, it-tqegħid fis-servizz għal dan l-għan speċifiku, jew l-użu ta' sistema tal-IA biex isiru valutazzjonijiet tar-riskju ta' persuni fiżiċi sabiex jiġi vvalutat jew imbassar ir-riskju li persuna fiżika twettaq reat kriminali, abbażi biss tat-tfassil ta' profil ta' persuna fiżika jew fuq il-valutazzjoni tal-karatteristiċi tal-personalità tagħha; din il-projbizzjoni ma għandhiex tapplika għas-sistemi tal-IA użati biex jappoġġaw il-valutazzjoni mill-bniedem tal-involviment ta' persuna f'attività kriminali, li diġà hija bbażata fuq fatti oġġettivi u verifikabbli marbuta direttament ma' attività kriminali;

(e) 

l-introduzzjoni fis-suq, it-tqegħid fis-servizz għal dan l-għan speċifiku, jew l-użu ta' sistemi tal-IA li joħolqu jew jespandu l-bażijiet tad-data tar-rikonoxximent tal-wiċċ permezz ta' scraping mhux immirat tal-immaġnijiet tal-wiċċ mill-internet jew minn filmati tas-CCTV;

(f) 

l-introduzzjoni fis-suq, it-tqegħid fis-servizz għal dan l-għan speċifiku, jew l-użu ta' sistemi tal-IA biex jiġu inferiti l-emozzjonijiet ta' persuna fiżika fl-oqsma tal-post tax-xogħol u tal-istituzzjonijiet edukattivi ħlief fejn l-użu tas-sistema tal-IA jkun maħsub biex tiġi introdotta fis-suq jew mqiegħda fis-servizz għal raġunijiet mediċi jew ta' sikurezza;

(g) 

l-introduzzjoni fis-suq jew it-tqegħid fis-servizz għal dan l-iskop speċifiku, jew l-użu ta' sistemi ta' kategorizzazzjoni bijometrika li jikkategorizzaw individwalment lill-persuni fiżiċi abbażi tad-data bijometrika tagħhom biex jiddeduċu jew jinferixxu r-razza, l-opinjonijiet politiċi, is-sħubija fi trade union, it-twemmin reliġjuż jew filosofiku, il-ħajja sesswali jew l-orjentazzjoni sesswali tagħhom; din il-projbizzjoni ma tkopri l-ebda tikkettar jew iffiltrar ta' settijiet tad-data bijometrika miksuba legalment, bħal immaġnijiet, ibbażati fuq data bijometrika jew kategorizzazzjoni ta' data bijometrika fil-qasam tal-infurzar tal-liġi;

(h) 

l-użu ta' sistemi ta’ identifikazzjoni bijometrika remota “fil-ħin reali” f'żoni aċċessibbli għall-pubbliku għall-finijiet tal-infurzar tal-liġi, dment li u sakemm dan l-użu jkun strettament meħtieġ għal wieħed mill-objettivi li ġejjin:

(i) 

it-tfittxija mmirata għal vittmi speċifiċi ta' ħtif, traffikar ta' bnedmin jew sfruttament sesswali ta' bnedmin kif ukoll it-tfittxija għal persuni neqsin;

(ii) 

il-prevenzjoni ta' theddida speċifika, sostanzjali u imminenti għall-ħajja jew għas-sikurezza fiżika ta' persuni fiżiċi jew theddida ġenwina u preżenti jew ġenwina u prevedibbli ta' attakk terroristiku;

(iii) 

il-lokalizzazzjoni jew l-identifikazzjoni ta' persuna suspettata li wettqet reat kriminali, għall-fini tat-twettiq ta' investigazzjoni kriminali jew il-prosekuzzjoni jew l-eżekuzzjoni ta' piena kriminali għal reati, imsemmija fl-Anness II u punibbli fl-Istat Membru kkonċernat b'sentenza ta' kustodja jew ordni ta' detenzjoni għal perjodu massimu ta' mill-inqas erba' snin.

Il-punt (h) tal-ewwel subparagrafu huwa mingħajr preġudizzju għall-Artikolu 9 tar-Regolament (UE) 2016/679 għall-ipproċessar ta' data bijometrika għal finijiet oħra għajr l-infurzar tal-liġi.

Artikolu 5 1a.

Għall-finijiet tal-paragrafu 1, l-ewwel subparagrafu, il-punti (ba) u (bb):

(a) 

l-introduzzjoni fis-suq jew it-tqegħid fis-servizz ta’ sistema tal-IA li tiġġenera jew timmanipula l-materjal jew il-prestazzjoni msemmija fil-paragrafu 1, l-ewwel subparagrafu, il-punt (ba) jew (bb) huwa pprojbit biss meta:

(i) 

il-ġenerazzjoni jew il-manipulazzjoni huwa l-għan maħsub tas-sistema tal-IA; jew

(ii) 

id-disinn, it-taħriġ, l-arkitettura, il-kapaċitajiet jew il-funzjonalitajiet li jħarsu lejn l-utent tas-sistema jagħmlu dik il-ġenerazzjoni jew manipulazzjoni eżitu raġonevolment prevedibbli u riproduċibbli, mingħajr ma jirrikjedu modifika teknika sinifikanti, u s-sistema ma jkollhiex miżuri tekniċi ta’ sikurezza raġonevoli u adegwati u salvagwardji oħra biex tipprevjeni b’mod affidabbli dik il-ġenerazzjoni jew manipulazzjoni, filwaqt li jitqies l-użu ħażin raġonevolment prevedibbli, u biex tikkoreġi l-użu ħażin osservat jew irrapportat;

(b) 

l-użu ta’ sistema tal-IA li tiġġenera jew timmanipula l-materjal jew il-prestazzjoni msemmija fil-paragrafu 1, l-ewwel subparagrafu, il-punt (ba) u (bb) tal-1 huwa pprojbit biss meta l-implimentatur juża s-sistema għall-fini ta’ ġenerazzjoni jew manipulazzjoni ta’ tali materjal jew prestazzjoni.

Artikolu 5 1b.
Għall-finijiet tal-paragrafu 1, l-ewwel subparagrafu, il-punt (ba), sistema tal-IA li timmanipula l-materjal b’mod li ma jżidx l-esponiment ta’ kwalunkww parti intima murija jew li ma jbiddilx in-natura ta’ xi attivitajiet sesswalment espliċitit murija ma għandhiex tikkostitwixxi manipulazzjoni.
Artikolu 5 2.

L-użu ta' sistemi ta’ identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għall-finijiet tal-infurzar tal-liġi għal kwalunkwe wieħed mill-objettivi msemmija fil-paragrafu 1, l-ewwel subparagrafu, il-punt (h) għandu jiġi implimentat għall-finijiet stipulati f’ dak biss biex tiġi kkonfermata l-identità tal-individwu speċifikament taħt mira u għandu jqis l-elementi li ġejjin:

(a) 

in-natura tas-sitwazzjoni li twassal għall-użu possibbli, b'mod partikolari s-serjetà, il-probabbiltà u l-iskala tal-ħsara li kienet tiġi kkawżata kieku s-sistema ma ntużatx;

(b) 

il-konsegwenzi tal-użu tas-sistema għad-drittijiet u l-libertajiet tal-persuni kollha kkonċernati, b'mod partikolari s-serjetà, il-probabbiltà u l-iskala ta' dawk il-konsegwenzi.

Barra minn hekk, l-użu ta' sistemi ta’ identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għall-finijiet tal-infurzar tal-liġi għal kwalunkwe wieħed mill-objettivi msemmija fil-paragrafu 1, l-ewwel subparagrafu, il-punt (h) ta' dan l-Artikolu għandu jikkonforma mas-salvagwardji u l-kundizzjonijiet meħtieġa u proporzjonati fir-rigward tal-użu f'konformità mal-liġi nazzjonali li tawtorizza l-użu tagħhom, b'mod partikolari fir-rigward tal-limitazzjonijiet temporali, ġeografiċi u personali. L-użu tas-sistema ta’ identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għandu jiġi awtorizzat biss jekk l-awtorità tal-infurzar tal-liġi tkun lestiet valutazzjoni tal-impatt fuq id-drittijiet fundamentali kif previst fl-Artikolu 27 u tkun irreġistrat is-sistema fil-bażi tad-data tal-UE skont l-Artikolu 49. Madankollu, f'każijiet ta' urġenza debitament ġustifikati, l-użu ta' tali sistemi jista' jinbeda mingħajr ir-reġistrazzjoni fil-bażi tad-data tal-UE, dment li tali reġistrazzjoni titlesta mingħajr dewmien żejjed.

Artikolu 5 3.
Għall-finijiet tal-paragrafu 1, l-ewwel subparagrafu, il-punt (h) u l-paragrafu 2, kull użu għall-finijiet tal-infurzar tal-liġi ta' sistema ta’ identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għandu jkun soġġett għal awtorizzazzjoni minn qabel mogħtija minn awtorità ġudizzjarja jew awtorità amministrattiva indipendenti li d-deċiżjoni tagħha hija vinkolanti tal-Istat Membru li fih ser isir l-użu, maħruġa wara talba motivata u f'konformità mar-regoli dettaljati tal-liġi nazzjonali msemmija fil-paragrafu 5. Madankollu, f'sitwazzjoni ta' urġenza debitament ġustifikata, l-użu ta' tali sistema jista' jinbeda mingħajr awtorizzazzjoni dment li dik l-awtorizzazzjoni tintalab mingħajr dewmien żejjed, sa mhux aktar tard minn 24 siegħa wara. Jekk tali awtorizzazzjoni tiġi rrifjutata, l-użu għandu jitwaqqaf b'effett immedjat u d-data kollha, kif ukoll ir-riżultati u l-outputs ta' dak l-użu għandhom jiġu skartati u mħassra minnufih.

L-awtorità ġudizzjarja kompetenti jew awtorità amministrattiva indipendenti li d-deċiżjoni tagħha tkun vinkolanti għandha tagħti l-awtorizzazzjoni biss meta tkun sodisfatta, abbażi ta' evidenza oġġettiva jew indikazzjonijiet ċari ppreżentati lilha, li l-użu tas-sistema ta’ identifikazzjoni bijometrika remota “fil-ħin reali” ikkonċernata hu meħtieġ u proporzjonat biex jintlaħaq wieħed mill-objettivi speċifikati fil-paragrafu 1, l-ewwel subparagrafu, il-punt (h), kif identifikat fit-talba u, b'mod partikolari, jibqa' limitat għal dak li huwa strettament meħtieġ fir-rigward tat-tul ta' żmien u l-firxa ġeografika u personali. Meta tiddeċiedi dwar it-talba, dik l-awtorità għandha tqis l-elementi msemmijin fil-paragrafu 2. L-ebda deċiżjoni li tipproduċi effett legali negattiv fuq persuna ma tista' tittieħed abbażi biss tal-output tas-sistema ta’ identifikazzjoni bijometrika remota “fil-ħin reali”.

Artikolu 5 4.
Mingħajr preġudizzju għall-paragrafu 3, kull użu ta' sistema ta' identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għal finijiet tal-infurzar tal-liġi għandu jiġi notifikat lill-awtorità tas-sorveljanza tas-suq rilevanti u lill-awtorità nazzjonali għall-protezzjoni tad-data f'konformità mar-regoli nazzjonali msemmija fil-paragrafu 5. Bħala minimu, in-notifika għandha tinkludi l-informazzjoni speċifikata fil-paragrafu 6 u ma għandhiex tinkludi data operazzjonali sensittiva.
Artikolu 5 5.
Stat Membru jista' jiddeċiedi li jipprevedi l-possibbiltà li jawtorizza għalkollox jew parzjalment l-użu ta' sistemi ta’ identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għall-finijiet tal-infurzar tal-liġi skont il-limiti u l-kundizzjonijiet elenkati fil-paragrafu 1, l-ewwel subparagrafu, il-punt (h), u l-paragrafi 2 u 3. L-Istati Membri kkonċernati għandhom jistabbilixxu fil-liġi nazzjonali tagħhom ir-regoli dettaljati meħtieġa għat-talba, il-ħruġ u l-eżerċitar tal-awtorizzazzjonijiet imsemmija fil-paragrafu 3, kif ukoll għas-superviżjoni u r-rappurtar relatati magħhom. Dawk ir-regoli għandhom jispeċifikaw ukoll fir-rigward ta' liema objettivi elenkati fil-paragrafu 1, l-ewwel subparagrafu, il-punt (h), inkluż liema reati kriminali msemmija fil-punt (h)(iii) tiegħu, l-awtoritajiet kompetenti jistgħu jkunu awtorizzati jużaw dawk is-sistemi għall-finijiet tal-infurzar tal-liġi. L-Istati Membri għandhom jinnotifikaw dawk ir-regoli lill-Kummissjoni sa mhux aktar tard minn 30 jum wara l-adozzjoni tagħhom. L-Istati Membri jistgħu jintroduċu, f'konformità mal-liġi tal-Unjoni, liġijiet aktar restrittivi dwar l-użu ta' sistemi ta’ identifikazzjoni bijometrika remota.
Artikolu 5 6.
L-awtoritajiet nazzjonali tas-sorveljanza tas-suq u l-awtoritajiet nazzjonali tal-protezzjoni tad-data tal-Istati Membri li ġew notifikati dwar l-użu ta' sistemi ta’ identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għal finijiet tal-infurzar tal-liġi skont il-paragrafu 4 għandhom jippreżentaw lill-Kummissjoni rapporti annwali dwar it-tali użu. Għal dak il-għan, il-Kummissjoni għandha tipprovdi lill-Istati Membri u lill-awtoritajiet nazzjonali tas-sorveljanza tas-suq u tal-protezzjoni tad-data, mudell, fejn jinkludi informazzjoni dwar l-għadd tad-deċiżjonijiet meħuda mill-awtoritajiet ġudizzjarji kompetenti jew awtorità amministrattiva indipendenti li d-deċiżjoni tagħha hija vinkolanti fuq talbiet għal awtorizzazzjonijiet f'konformità mal-paragrafu 3 u r-riżultat tagħhom.
Artikolu 5 7.
Il-Kummissjoni għandha tippubblika rapporti annwali dwar l-użu ta' sistemi ta’ identifikazzjoni bijometrika remota “fil-ħin reali” fi spazji aċċessibbli għall-pubbliku għal finijiet tal-infurzar tal-liġi abbażi tad-data aggregata fl-Istati Membri bbażati fuq ir-rapporti annwali msemmija fil-paragrafu 6. Dawk ir-rapporti annwali ma għandhomx jinkludu data operazzjonali sensittiva tal-attivitajiet relatati tal-infurzar tal-liġi.
Artikolu 5 8.
Dan l-Artikolu ma għandux jaffettwa l-projbizzjonijiet li japplikaw meta prattika tal-IA tikser liġi oħra tal-Unjoni.

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Standards relatati

2. Rekwiżiti identifikati

Rekwiżiti
Sors Rekwiżit

3. Standards relatati

Standards
Sors Rekwiżit
SCF AI & Autonomous Technologies Conformity

Description

Mechanisms exist to ensure deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) conform to applicable statutory and regulatory requirements, based on:
(1) Defined use cases;
(2) Geographic markets; and
(3) Use of Intellectual Property (IP).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Review applicable AI regulations before deploying AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Legal review of AI deployments for regulatory compliance

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI compliance review process
∙ Regulatory mapping (EU AI Act, NIST AI RMF)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI regulatory compliance program
∙ Dedicated compliance review for AI deployments

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI regulatory compliance framework
∙ Legal and compliance team integration
∙ Automated regulatory tracking
∙ AI Act conformity assessments

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure deployed AAT conform to applicable statutory and regulatory requirements, based on:
(1) Defined use cases;
(2) Geographic markets; and
(3) Use of Intellectual Property (IP).

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Manipulative or Deceptive Techniques

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that utilize manipulative or deceptive techniques (including biased data) to impair an individual's ability to make a reasonably informed decision.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting use of AI tools with deceptive/manipulative capabilities

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting manipulative AI techniques

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy prohibiting manipulative AI
∙ Review process before AI tool adoption

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program
∙ Formal prohibition on manipulative AI
∙ Vendor agreements with ethics requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Ethics board review
∙ Regulatory compliance for AI manipulation prohibitions

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that utilize manipulative or deceptive techniques (including biased data) to impair an individual's ability to make a reasonably informed decision.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Materially Distorting Behaviors

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that exploit a human subject to materially affect a targeted behavior due to their:
(1) Age;
(2) Disability; or
(3) Specific social or economic situation.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting AI tools that exploit human vulnerabilities

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting exploitative AI behaviors

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy prohibiting materially distorting AI
∙ Impact assessment process

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Vendor compliance requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Human rights impact assessments
∙ Regulatory compliance mapping

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that exploit a human subject to materially affect a targeted behavior due to their:
(1) Age;
(2) Disability; or
(3) Specific social or economic situation.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Social Scoring

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that:
(1) Evaluate human subjects over a certain period of time based on their social behavior or known, inferred or predicted personal or personality characteristics; and
(2) Assign a "social score" branding or equivalent classification.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting social scoring AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting social scoring

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on social scoring AI
∙ Review process before AI adoption

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Legal review for AI deployments

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Regulatory compliance (EU AI Act Art. 5)
∙ Automated detection of prohibited practices

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that:
(1) Evaluate human subjects over a certain period of time based on their social behavior or known, inferred or predicted personal or personality characteristics; and
(2) Assign a "social score" branding or equivalent classification.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Detrimental or Unfavorable Treatment

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting AI tools causing unfair treatment

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting discriminatory AI

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy on AI fairness and non-discrimination

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI fairness program
∙ Bias testing before deployment
∙ Vendor requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI fairness framework
∙ Automated bias detection tools
∙ Third-party AI audits

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Detrimental or Unfavorable Treatment

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting AI tools causing unfair treatment

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting discriminatory AI

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal policy on AI fairness and non-discrimination

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI fairness program
∙ Bias testing before deployment
∙ Vendor requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI fairness framework
∙ Automated bias detection tools
∙ Third-party AI audits

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that is:
(1) Are unrelated to the contexts in which the data was originally generated or collected; and/or
(2) Is unjustified or disproportionate to their social behavior or its gravity.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Risk and Criminal Profiling

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that:
(1) Assess the risk of an individual committing a criminal offence; and
(2) Predict risk based solely on the profiling of personality traits and characteristics.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting criminal risk profiling AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting criminal profiling AI

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on AI-based criminal profiling
∙ Legal review

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Legal and compliance review

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Regulatory compliance (EU AI Act Art. 5)
∙ Legal review process

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that:
(1) Assess the risk of an individual committing a criminal offence; and
(2) Predicts risk based solely on the profiling of personality traits and characteristics.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Populating Facial Recognition Databases

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that create, or expand, facial recognition databases through scraping facial images from:
(1) The Internet; or
(2) Closed-Circuit Television (CCTV) footage.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting facial recognition database scraping tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting facial recognition database scraping

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on scraping facial recognition databases

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Technical controls to prevent scraping

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Technical controls against facial recognition scraping
∙ Regulatory compliance

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that create, or expand, facial recognition databases through scraping facial images from:
(1) The Internet; or
(2) Closed-Circuit Television (CCTV) footage.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Emotion Inference

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that infer human emotions of an individual based on observed characteristics.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting emotion inference AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting emotion inference

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on AI emotion inference tools

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program
∙ Prohibition enforced in vendor agreements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics framework
∙ Regulatory compliance mapping
∙ Technical controls against emotion inference

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that infer human emotions of an individual based on observed characteristics.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Biometric Categorization

Description

Mechanisms exist to prohibit the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's:
(1) Race;
(2) Political opinions;
(3) Trade union membership;
(4) Religious or philosophical beliefs;
(5) Sex life or sexual orientation; and/or
(6) Age.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Policy prohibiting biometric categorization AI tools

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI acceptable use policy prohibiting biometric categorization

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal prohibition on biometric categorization AI

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI ethics program with formal prohibition
∙ Legal review for biometric technologies

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI ethics and privacy framework
∙ Regulatory compliance (EU AI Act, GDPR)
∙ Technical controls

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to prohibit the sale, deployment and/or use of AAT that categorize an individual based on their biometric data to deduce, or infer, the individual's:
(1) Race;
(2) Political opinions;
(3) Trade union membership;
(4) Religious or philosophical beliefs;
(5) Sex life or sexual orientation; and/or
(6) Age.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.