Requirements
Document AI failure plan for AI privacy and security breaches assigning accountable owners and establishing notification and remediation with third-party support as needed (e.g. legal, PR, insurers)
Document AI failure plan for harmful AI outputs that cause significant customer harm assigning accountable owners and establishing remediation with third-party support as needed (e.g. legal, PR, insurers)
Document AI failure plan for hallucinated AI outputs that cause substantial customer financial loss assigning accountable owners and establishing remediation with third-party support as needed (e.g. legal, PR, insurers)
Document which AI system changes across the development & deployment lifecycle require formal review or approval, assign a lead accountable for each, and document their approval with supporting evidence
Document data storage security practices considering data sensitivity, regulatory requirements, security controls, and operational needs
Establish AI vendor due diligence processes for foundation and upstream model providers covering data handling, PII controls, security and compliance
Merged with E004 - see changelog (Q1 2026 update)
Establish regular internal reviews of key processes and document review records and approvals
Implement systems to monitor and log third-party API connections, sessions, and data access
Establish and implement an AI acceptable use policy
Document AI data processing locations
Document applicable AI laws and standards, required data protections, and strategies for compliance
Establish a quality management system for AI systems proportionate to the size of the organization
Merged with E017 - see changelog (Q1 2026 update)
Maintain logs of AI system processes, actions, and agent outputs where permitted to support incident investigation, auditing, and explanation of AI system behavior
Implement clear disclosure mechanisms to inform users when they are interacting with AI systems rather than humans
Establish a system transparency policy and maintain a repository of model cards, datasheets, and interpretability reports for major systems