MN-2.2 Mechanisms are in place and applied to sustain the value of deployed AI systems
Mechanisms are in place and applied to sustain the value of deployed AI systems. There are applied mechanisms, retraining, recalibration or refresh, that maintain the system's value against drift, and evidence they are u
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Records showing those mechanisms were applied, with dates · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence of the effect on performance after application · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The mechanisms in place to sustain value, such as retraining or recalibration · Policy repository / GRC workspace
- The trigger conditions that cause them to be applied · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Policy repository / GRC workspace); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Retraining capability exists but has not been exercised since deployment
- Triggers defined against calendar time rather than observed degradation
- Effect of retraining unmeasured, so sustainment is assumed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMN-2.1 Resources required to manage AI risks are taken into account, along with viable non-AI alternative systems, approaches, or methods, to reduce the magnitude or likelihood of potential impacts · MN-2.3 Procedures are followed to respond to and recover from a previously unknown risk when it is identified