Legal evidence - AIUC-1

Legal evidence

Download evidence list

Requirement	Control activity	Evidence	Tags
A001: Establish input data policy Mandatory Requirement	Defining and communicating input data usage policies. Including specifying how customer data is used for inference and model training, establishing data retention periods, and documenting customer data rights.	A001.1 Documentation: Policy for input data ownership, usage and retention. Typically demonstrated by Terms of Service, Privacy Policy or Data Processing Agreement	Mandatory ControlLegal PoliciesTerms of ServicePrivacy PolicyDPA
A001: Establish input data policy Mandatory Requirement	Documenting processes for handling end-user data subject rights. For example, handling requests for opt-in/opt-out rights, access, portability, or deletion of input data.	A001.3 Documentation: Data subject right processes. May be included in DPA, GDPR appendix, External Privacy Policy or similar internal or external policies documenting processes for data handling	Supplemental ControlLegal PoliciesData Processing AgreementPrivacy Policy
A002: Establish output data policy Mandatory Requirement	Establishing output ownership and usage rights policies. For example, specifying customer ownership of AI-generated outputs versus AI inputs, defining permitted uses of outputs (commercial use, redistribution, modification), documenting usage restrictions or limitations, and clarifying how ownership applies to different output types or use cases. Disclosing opt-in/opt-out and deletion policies for AI outputs. For example, documenting how customers can opt out of output storage or reuse, explaining deletion request processes, specifying retention periods and data handling practices, and clarifying how customers can control or revoke permissions for their outputs.	A002.1 Documentation: Output usage and ownership policy. Typically demonstrated by Terms of Service, Data Processing Agreement, Master Service Agreement, Privacy Policy, or AI Addendum. May be a combination of these policies.	Mandatory ControlLegal PoliciesTerms of Service
A004: Protect IP & trade secrets Mandatory Requirement	Leveraging foundation model provider protections. For example, using providers with zero data retention policies, requiring contractual commitments that inputs are not used for training, selecting models with enhanced privacy guarantees for sensitive use cases.	A004.2 Documentation: foundational model IP protections. Provider contracts, terms of service, or documentation showing IP protection commitments. Often found in third party’s terms of use/service, DPA or AI Addendum/Schedule.	Supplemental ControlLegal PoliciesVendor Contracts
A005: Prevent cross-customer data exposure Mandatory Requirement	Establishing explicit consent and disclosure for combined data usage. For example, informing customers when their data will be combined with competitor data, disclosing data anonymization and abstraction policies, providing opt-out mechanisms.	A005.1 Documentation: Consent for combined data usage. Typically demonstrated by Data Processing Agreement or Terms of Service	Mandatory ControlLegal PoliciesData Processing AgreementTerms of Service
A007: Prevent IP violations Mandatory Requirement	Documenting foundation model provider IP protections which may serve as primary infringement safeguards. For example, indemnification clauses or copyright/trademark guardrails.	A007.1 Documentation: Model provider IP infringement protections. Foundation model provider contract, terms of service, or data processing agreement showing IP protection commitments including copyright/trademark handling policies, indemnification clauses, liability coverage, and any documented limitations or exclusions. May include vendor questionnaire responses or certification documents addressing IP protections.	Mandatory ControlLegal PoliciesVendor Contracts
E010: Establish AI acceptable use policy Mandatory Requirement	Defining prohibited AI usage for end-users. For example, jailbreak attempts, malicious prompt injection, unauthorized data extraction, generation of harmful content, and misuse of customer data.	E010.1 Documentation: AI acceptable use policy. Policy document defining acceptable and/or prohibited AI usage - can be standalone document or parts of, e.g., terms of service	Mandatory ControlLegal PoliciesAcceptable Use Policy
E011: Record processing locations Mandatory Requirement	Implementing transfer compliance procedures. For example, assessing data transfer requirements for AI training data and inference processing, maintaining approved transfer mechanisms for foundation model providers and AI infrastructure, mitigating transfer risk for cross-border AI model training.	E011.2 Documentation: Data transfer compliance. Demonstrated by DPA, data transfer impact assessments, approved transfer mechanism documentation (Standard Contractual Clauses, adequacy decisions), cross-border data flow approvals for AI training/inference, or risk assessments for international AI processing.	Supplemental ControlLegal PoliciesInternal policiesData Processing Agreement
E012: Document regulatory compliance Mandatory Requirement	Identifying relevant regulations. For example, data protection laws. For example, GDPR, CCPA, sector-specific requirements, emerging AI standards. For example, EU AI Act. Documenting compliance procedures and strategies appropriate for company size and operations. Reviewing the repository every 6 months and when additional requirements may be triggered. For example, regulations change or business operations expand into new jurisdictions.	E012.1 Documentation: Regulatory compliance reviews. Compliance register, assessment memo or review tickets (e.g. in Notion), or policy listing applicable regulations with compliance strategies - should include review dates or version history showing periodic updates.	Mandatory ControlLegal PoliciesInternal processes
E017: Document system transparency policy Supplemental Requirement	Documenting platform-level and deployer-level security responsibilities for AI systems. For example, delineating which security obligations are managed by the platform versus the deploying organization.	E017.3 Documentation: Platform and deployer security responsibilities. Documentation delineating platform and deployer security responsibilities - may include shared responsibility documentation defining platform-level and deployer-level security obligations.	Supplemental ControlLegal PoliciesTerms of ServiceInternal policies
F001: Prevent AI cyber misuse Mandatory Requirement	Results of testing from foundation model developer on offensive cyber capabilities and mitigations.	F001.1 Documentation: Foundation model cyber capabilities. Provider model cards, cybersecurity assessment reports from model developers, or foundation model documentation describing offensive cyber capabilities and mitigations	Mandatory ControlLegal PoliciesVendor Contracts
F002: Prevent catastrophic misuse Mandatory Requirement	Results of testing from foundation model developer on CBRN capabilities and mitigations.	F002.1 Documentation: Foundation model CBRN capabilities. List of foundation models used with CBRN capability information - may include provider model cards with CBRN assessments, weapons of mass destruction risk evaluations from model developers, or other documentation describing CBRN-related capabilities and mitigations.	Mandatory ControlLegal PoliciesVendor Contracts