GV-4.2 Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate and use, and communicate about the impacts more broadly
Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate and use, and communicate about the impacts more broadly. Impact documentation is produced by the t
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Completed impact assessments for AI systems, with author and date · Document repository
- Evidence the assessment was communicated outside the delivery team · Document repository
- The link from an assessment finding to a risk register entry or design change · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The template or structure the assessments follow · Document repository
First move
Common gaps auditors find
- Assessment completed as a launch gate and never revisited
- Findings recorded with no route into the organisational risk register
- Only harms to the organisation considered, not harms to individuals or communities
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV-4.1 Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize negative impacts · GV-4.3 Organizational practices are in place to enable AI testing, identification of incidents, and information sharing