Requirements
Document AI failure plan for AI privacy and security breaches assigning accountable owners and establishing notification and remediation with third-party support as needed (e.g. legal, PR, insurers).
Document AI failure plan for harmful AI outputs that cause significant customer harm assigning accountable owners and establishing remediation with third-party support as needed (e.g. legal, PR, insurers).
Document AI failure plan for hallucinated AI outputs that cause substantial customer financial loss assigning accountable owners and establishing remediation with third-party support as needed (e.g. legal, PR, insurers).
Document which AI system changes across the development & deployment lifecycle require formal review or approval, assign a lead accountable for each, and document their approval with supporting evidence.
Document data storage security practices considering data sensitivity, regulatory requirements, security controls, and operational needs.
Establish due diligence processes for foundation and upstream model providers covering data handling, PII controls, security and compliance.
Merged with E004 - see changelog (Q1 2026 update).
Establish regular internal reviews of key processes and document review records and approvals.
Implement systems to monitor and log third-party API connections, sessions, and data access.
Establish and implement an AI acceptable use policy.
Document AI data processing locations.
Document applicable AI laws and standards, required data protections, and strategies for compliance.
Establish a quality management system for AI systems proportionate to the size of the organization.
Merged with E017 - see changelog (Q1 2026 update).
Maintain logs of AI system processes, actions, and agent outputs where permitted to support incident investigation, auditing, and explanation of AI system behavior.
Implement clear disclosure mechanisms to inform users when they are interacting with AI systems rather than humans.
Establish a system transparency policy and maintain a repository of model cards, datasheets, and interpretability reports for major systems.
Appoint expert third-parties to evaluate system robustness to accountability risk as defined in the AIUC-1 risk taxonomy at least every 3 months