MP-1.1 Intended purpose, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented
Intended purpose, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: specif
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- A documented statement of intended purpose and the uses considered beneficial · Document repository
- Identification of user types and their expectations of the system · Document repository
- The laws, norms and expectations specific to the deployment setting · Policy repository / GRC workspace
- Recorded assumptions and limitations about purpose, and the uses ruled out · Document repository
- Analysis of foreseeable misuse and repurposing of the deployed system · Document repository
First move
Common gaps auditors find
- Purpose written at product-marketing level, too broad to bound anything
- Foreseeable misuse omitted because it is outside the intended use
- Documented once at concept and never reconciled with how the system is actually used
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMN-4.3 Incidents and errors are communicated to relevant AI actors including affected communities, and processes for tracking, responding to, and recovering from incidents and errors are followed and documented · MP-1.2 Inter-disciplinary AI actors, competencies, skills and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented