GV-6.1 Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third party's intellectual property or other rights
Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third party’s intellectual property or other rights. Third-party AI risk is addressed
4
artefacts
0
held by a system
1
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Due diligence records for third-party AI components in use · Vendor register / contract repository
governing documentDocuments that govern the control
- Third-party AI policy covering data, pre-trained models, software and services · Vendor register / contract repository
- Contract terms addressing intellectual property, data rights and liability for AI components · Vendor register / contract repository
- The intellectual property position recorded for training data and model outputs · HR system / LMS
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Standard vendor due diligence applied with no AI-specific questions
- Open source models adopted with no review of the licence or the training data provenance
- Policy addresses suppliers but not freely obtained models and datasets
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV-5.2 Mechanisms are established to enable AI actors to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation · GV-6.2 Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk