MP-4.2 Internal risk controls for components of the AI system including third-party AI technologies are identified and documented
Internal risk controls for components of the AI system including third-party AI technologies are identified and documented. For each component carrying risk, the internal control applied to it is identified and written d
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the controls named are actually in place · Vendor register / contract repository
governing documentDocuments that govern the control
- The internal controls identified for each AI system component · Vendor register / contract repository
- Controls specific to third-party and open-source AI technologies · Vendor register / contract repository
- The pre-adoption evaluation practice for third-party material · Vendor register / contract repository
First move
Common gaps auditors find
- Risks identified for components with no control named against them
- Freely available third-party material adopted outside the evaluation practice
- Controls documented centrally but absent in the deployed pipeline
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMP-4.1 Approaches for mapping AI technology and legal risks of its components, including the use of third-party data or software, are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights · MP-5.1 Likelihood and magnitude of each identified impact are identified and documented, based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team, or other data