+Artigo 13.o Transparência e prestação de informações aos responsáveis pela implantação
---+Artigo 13.o 1.
---+Artigo 13.o 2.
---+Artigo 13.o 3.

Artigo 13.o Transparência e prestação de informações aos responsáveis pela implantação

-

1. Visão geral

,

Título	Regulamentação
Artigo 13.o 1.	Os sistemas de IA de risco elevado devem ser concebidos e desenvolvidos de maneira a assegurar que o seu funcionamento seja suficientemente transparente para permitir aos responsáveis pela implantação interpretar os resultados do sistema e utilizá-los de forma adequada. Deve ser garantido um tipo e um grau adequado de transparência com vista a garantir o cumprimento das obrigações pertinentes que incumbem ao prestador e ao responsável pela implantação por força da secção 3.
Artigo 13.o 2.	Os sistemas de IA de risco elevado devem ser acompanhados de instruções de utilização, num formato digital adequado, ou outro, que incluam informações concisas, completas, corretas e claras que sejam pertinentes, acessíveis e compreensíveis para os responsáveis pela implantação.
Artigo 13.o 3.	As instruções de utilização devem incluir, pelo menos, as seguintes informações: a) A identidade e os dados de contacto do prestador e, se for caso disso, do seu mandatário; b) As características, capacidades e limitações de desempenho do sistema de IA de risco elevado, incluindo: i) a sua finalidade prevista, ii) o nível de exatidão — incluindo os seus parâmetros —, de solidez e de cibersegurança a que se refere o artigo 15.o usado como referência para testar e validar o sistema de IA de risco elevado e que pode ser esperado, bem como quaisquer circunstâncias conhecidas e previsíveis que possam ter um impacto nesse nível esperado de exatidão, solidez e cibersegurança, iii) qualquer circunstância conhecida ou previsível, relacionada com a utilização do sistema de IA de risco elevado de acordo com a sua finalidade prevista ou em condições de utilização indevida razoavelmente previsível, que possa causar os riscos a que se refere o artigo 9.o, n.o 2, para a saúde e a segurança ou para os direitos fundamentais, iv) se for caso disso, as capacidades técnicas e as características do sistema de IA de risco elevado que sejam pertinentes para explicar os seus resultados, v) quando oportuno, o seu desempenho em relação a determinadas pessoas ou grupos de pessoas específicos em que o sistema se destina a ser utilizado, vi) quando oportuno, especificações para os dados de entrada, ou quaisquer outras informações importantes em termos dos conjuntos de dados de treino, validação e teste utilizados, tendo em conta a finalidade prevista do sistema de IA de risco elevado, vii) se for caso disso, informações que permitam aos responsáveis pela implantação interpretar os resultados do sistema de IA de risco elevado e utilizá-los adequadamente; c) As alterações do sistema de IA de risco elevado e do seu desempenho que tenham sido predeterminadas pelo prestador aquando da avaliação da conformidade inicial, se for caso disso; d) As medidas de supervisão humana a que se refere o artigo 14.o, incluindo as soluções técnicas adotadas para facilitar a interpretação dos resultados dos sistemas de IA de risco elevado pelos responsáveis pela implantação; e) Os recursos computacionais e de hardware necessários, a vida útil esperada do sistema de IA de risco elevado e quaisquer medidas de manutenção e assistência necessárias, incluindo a sua frequência, para assegurar o correto funcionamento desse sistema de IA, inclusive no tocante a atualizações do software; f) Sempre que pertinente, uma descrição dos mecanismos incluídos no sistema de IA de risco elevado que permita aos responsáveis pela implantação recolher, armazenar e interpretar corretamente os registos, em conformidade com o artigo 12.o.

1.1 Referências

1.2 Requisitos identificados

1.3 Normas relacionadas

2. Requisitos identificados

Requisitos
Fonte	Requisito

3. Normas relacionadas

Normas
Fonte	Requisito
SCF	AI & Autonomous Technologies Risk Profiling Description Mechanisms exist to document the risks and potential impacts of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that are: (1) Designed; (2) Developed; (3) Deployed; (4) Evaluated; and/or (5) Used. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Basic AI risk profile (document risk level per AI tool: low/medium/high) ∙ AI governance program ∙ NIST AI RMF Map function Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Formal AI risk profiling for each deployed system ∙ AI governance program ∙ NIST AI RMF Map function ∙ EU AI Act risk tier classification (if applicable) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Structured AI risk profiling aligned to NIST AI RMF and EU AI Act tiers ∙ AI risk register with risk profiles ∙ AI governance program Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise AI risk profiling program ∙ NIST AI RMF Map function ∙ EU AI Act risk tier classification (prohibited, high-risk, limited, minimal) ∙ AI risk profiles integrated with GRC platform Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI risk profiling framework (NIST AI RMF, EU AI Act, sector regulations) ∙ Automated AI risk profile scoring and monitoring ∙ AI risk profiles integrated with ERM and GRC ∙ Board-level AI risk portfolio reporting SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices. ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to document the risks and potential impacts of AAT that are: (1) Designed; (2) Developed; (3) Deployed; (4) Evaluated; and/or (5) Used. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies High Risk Designations Description Mechanisms exist to designate Artificial Intelligence (AI) and Autonomous Technologies (AAT) "High Risk" if one (1), or more, of the following criteria are met: (1) AAT is used as a safety component of a product or service; (2) AAT poses a significant risk of harm to an individual's health, safety or fundamental rights; and/or (3) AAT materially influences the outcome of an individual's decision making. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document criteria for high-risk AI use and review before deployment Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI risk classification checklist with high-risk criteria Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI risk classification policy ∙ High-risk designation process Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI risk management framework with formal high-risk designation process ∙ Risk committee review Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI risk classification framework ∙ Automated risk scoring ∙ Legal/compliance review for high-risk AI ∙ Regulatory compliance mapping (e.g., EU AI Act) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to designate AAT "High Risk" if one(1), or more, of the following criteria are met: (1) AAT is used as a safety component of a product or service; (2) AAT poses a significant risk of harm to an individual's health, safety or fundamental rights; and/or (3) AAT materially influences the outcome of an individual's decision making. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Development Practices Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed to: (1) Achieve an appropriate level of accuracy, robustness and cybersecurity; (2) Perform consistently in those respects throughout the AAT system's lifecycle; and (3) Be effectively overseen by competent individuals. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document accuracy and robustness requirements before adopting AI Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI design requirements checklist covering accuracy, robustness, cybersecurity Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI development standards ∙ Security-by-design requirements for AI Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI development security standards ∙ Formal SDLC integration ∙ Security testing requirements Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI development framework ∙ AI security standards (NIST AI RMF, ISO 42001) ∙ DevSecOps integration for AI SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices. ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Measures exist to ensure AAT are designed and developed to: (1) Achieve an appropriate level of accuracy, robustness and cybersecurity; (2) Perform consistently in those respects throughout the AAT system's lifecycle; and (3) Be effectively overseen by competent individuals. Level 4 Quantitatively Controlled Artificial Intelligence and Autonomous Technology (AAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Artificial Intelligence and Autonomous Technology (AAT) capabilities are "world class" efforts the leverage predictive analysis (e.g., machine learning and AI) to enable continuously improving capabilities. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF	AI & Autonomous Technologies Transparency Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed so its operation is sufficiently transparent such that output can be easily interpreted by personnel implementing the AAT. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document how AI decisions are made for key tools Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Transparency requirements in AI tool selection ∙ Basic explainability documentation Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ AI explainability policy ∙ Require documentation of AI decision logic Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI transparency program ∙ Explainability requirements in AI development standards Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI explainability framework ∙ XAI tools (e.g., SHAP, LIME) ∙ Model documentation standards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT are designed and developed so its operation is sufficiently transparent such that output can be easily interpreted by personnel implementing the AAT. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF	AI & Autonomous Technologies Implementation Documentation Description Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document AI implementation steps and configuration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ AI implementation documentation template Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal AI implementation documentation policy ∙ Technical documentation requirements Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ AI documentation program ∙ Standardized implementation documentation templates Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise AI documentation platform ∙ Automated documentation generation from MLOps tools ∙ Model cards and system cards SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments). ▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization. Level 2 Planned Tracked Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners. ▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides: (1) Contact details of the provider; (2) Characteristics, capabilities and limitations of performance of the AAT; (3) Errata from the AAT's initial conformity assessment; (4) Details necessary to interpret the outputs of the AAT; (5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT; (6) Computational and hardware resources needed to operate the AAT; (7) Projected useable lifetime of the AAT; and (8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Builddate: 27.07.2026 00:00:00 -Doknr: CELEX:32024R1689
EULAW -
European Regulation published on http://eur-lex.europa.eu/