+Člen 27 Ocena učinka na temeljne pravice za visokotvegane sisteme UI
---+Člen 27 1.
---+Člen 27 2.
---+Člen 27 3.
---+Člen 27 4.
---+Člen 27 5.

Člen 27 Ocena učinka na temeljne pravice za visokotvegane sisteme UI

-

1. Pregled

,
Člen 27 1.

Pred uvedbo visoko tveganega sistema UI iz člena 6(2), razen visokotveganih sistemov UI, namenjenih uporabi na področju iz Priloge III, točka 2, uvajalci, ki so osebe javnega prava ali zasebni subjekti in zagotavljajo javne storitve, ter uvajalci visokotveganih sistemov UI iz Priloge III, točki 5(b) in (c), izvedejo oceno učinka, ki ga lahko povzroči uporaba takega sistema na temeljne pravice. V ta namen uvajalci izvedejo oceno, ki jo sestavljajo:

(a) 

opis postopkov uvajalca, v katerih se bo visokotvegani sistem UI uporabljal v skladu s predvidenim namenom;

(b) 

opis obdobja in pogostosti uporabe vsakega visokotveganega sistema UI;

(c) 

kategorije fizičnih oseb in skupin, na katere bo verjetno vplivala njegova uporaba v specifičnem kontekstu;

(d) 

posebna tveganja škode, ki bi lahko vplivala na kategorije fizičnih oseb ali skupine oseb, opredeljene na podlagi tega odstavka, točka (c), ob upoštevanju informacij, ki jih je ponudnik predložil na podlagi člena 13;

(e) 

opis izvajanja ukrepov za človeški nadzor v skladu z navodili za uporabo;

(f) 

ukrepi, ki jih je treba sprejeti, v primeru uresničitve teh tveganj, vključno z ureditvami za notranje upravljanje in pritožbene mehanizme.
Člen 27 2.
Obveznost iz odstavka 1 se uporablja za prvo uporabo visokotveganega sistema UI. Uvajalec lahko v podobnih primerih uporabi predhodno izvedeno oceno učinka na temeljne pravice ali obstoječo oceno, ki jo je izvedel ponudnik. Če uvajalec med uporabo visokotveganega sistema UI meni, da se je kateri koli element iz odstavka 1 spremenil ali ni več posodobljen, sprejme potrebne ukrepe za posodobitev informacij.
Člen 27 3.
Po izvedbi ocene iz odstavka 1 tega člena uvajalec obvesti organ za nadzor trga o svojih rezultatih, s predložitvijo izpolnjene predloge iz odstavka 5 tega člena. V primeru iz člena 46(1) so lahko uvajalci izvzeti iz obveznosti obveščanja.
Člen 27 4.
Če je katera od obveznosti iz tega člena že izpolnjena na podlagi ocene učinka v zvezi z varstvom podatkov, izvedene na podlagi člena 35 Uredbe (EU) 2016/679 ali člena 27 Direktive (EU) 2016/680, lahko uvajalec pri izvedbi ocene učinka na temeljne pravice iz odstavka 1 tega člena v oceno učinka na temeljne pravice vključi navzkrižne sklice na ustrezne oddelke te ocene učinka v zvezi z varstvom podatkov ali ustrezne dele te ocene.
Člen 27 5.
Urad za UI pripravi predlogo vprašalnika, tudi z avtomatiziranim orodjem, da bodo lahko uvajalci na poenostavljen način izpolnili svoje obveznosti na podlagi tega člena. Ta predloga uvajalcem omogoča, da v oceno učinka na temeljne pravice na podlagi odstavka 4 po potrebi vključijo navzkrižne sklice na ustrezne oddelke ocene učinka v zvezi z varstvom podatkov ali ustrezne dele te ocene.

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani standardi

2. Ugotovljene zahteve

Zahteve

3. Povezani standardi

Standardi
SCF AI & Autonomous Technologies Impact Assessment

Description

Mechanisms exist to assess the impact(s) of proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT) on individuals, groups, communities, organizations and society (e.g., Fundamental Rights Impact Assessment (FRIA)).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Basic AI impact assessment (documented impact on people, processes, decisions)
∙ AI governance program
∙ NIST AI RMF Map function

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Formal AI impact assessment for each deployed system
∙ AI governance program
∙ NIST AI RMF Map function

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ AI impact assessment process aligned to NIST AI RMF
∙ AI governance program
∙ Algorithmic Impact Assessment (AIA) for higher-risk systems

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Formal AI impact assessment program with independent review for high-risk systems
∙ NIST AI RMF Map function
∙ Algorithmic Impact Assessment (AIA) process
∙ EU AI Act conformity assessment requirements (if applicable)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI impact assessment framework (NIST AI RMF, EU AI Act)
∙ Third-party conformity assessments for high-risk AI (EU AI Act Article 43)
∙ Algorithmic Impact Assessment (AIA) program
∙ Board-level AI impact reporting

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to assess the impact(s) of proposed AAT on individuals, groups, communities, organizations and society (e.g., Fundamental Rights Impact Assessment (FRIA)).

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)

Description

Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Information Assurance (IA) Program
∙ AI TEVV checklist for AI tools (test accuracy, validate outputs, verify security)
∙ AI governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Information Assurance (IA) Program
∙ Formal AI TEVV process for AI systems
∙ AI governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Information Assurance (IA) Program
∙ Formal AI TEVV framework aligned to NIST AI RMF Measure function
∙ AI testing tools (e.g., IBM OpenScale, Great Expectations)
∙ AI governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program
∙ NIST AI RMF Measure function
∙ Third-party AI testing for high-risk systems
∙ AI testing integrated with CI/CD pipelines

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Information Assurance (IA) Program
∙ Enterprise AI TEVV program (NIST AI RMF Measure function)
∙ Independent AI testing and evaluation for high-risk systems
∙ AI TEVV integrated with MLOps and CI/CD
∙ EU AI Act conformity assessment (if applicable)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable AAT-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI TEVV Reporting

Description

Mechanisms exist to report the status and results of Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) to relevant stakeholders, including governing bodies, as required.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Report AI testing results to management

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Document and communicate AI test results to stakeholders

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI TEVV reporting process
∙ Standardized reporting templates

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI TEVV reporting program
∙ Regular stakeholder briefings
∙ Findings tracking

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI TEVV reporting framework
∙ Automated test result dashboards
∙ Board-level AI risk reporting

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to report the status and results of Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) to relevant stakeholders, including governing bodies, as required.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.