Governance & Accountability ยท GOV-09
Public transparency about AI use
The organisation publishes information about how and why it uses AI, to the extent its obligations and public role require, and keeps it current.
Why it matters
Public bodies are expected to explain how they use algorithmic tools, and some are required to. Openness also builds trust and catches problems early, because people outside the organisation can see and question what it does.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No public information about AI use. |
| 2 Developing | Some information is published, for example a statement or a single record, but it is incomplete or out of date. |
| 3 Defined | Decisions on what to publish about each use of AI are recorded, required records and registrations are completed and kept current, and sensitive communications are cleared. |
| 4 Managed | Publication is checked against the AI inventory for completeness, and public questions and feedback are tracked and answered. |
| 5 Optimising | Transparency is used as a design input: uses of AI are shaped so they can be explained publicly from the start. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- GOV-09.1 For each AI inventory entry, a recorded decision states whether a transparency record must be published, judged against the criteria that apply, and why.
- GOV-09.2 Transparency records are published in the required format for all in-scope uses of AI. PUB
- GOV-09.3 Each published transparency record has a named owner and a review cycle. PUB
- GOV-09.4 Transparency records are updated when a use changes materially or is retired. PUB
- GOV-09.5 Each transparency record is checked through information access and security routes before release, with the reason recorded for anything withheld. PUB
- GOV-09.6 Any registration the law requires for a use of AI is completed before the use starts. HIR
- GOV-09.7 For each use of AI, a recorded decision states whether its impact assessments are published, and why.
- GOV-09.8 External communications about sensitive uses of AI are cleared through a designated route.
Assessment questions
- Which of your uses of AI are you required, or choose, to publish information about?
- Is what is published complete and current against the AI inventory?
- Published transparency records or statements
- Reconciliation of published records against the inventory
- Registration records where the law requires them
- Publication decisions with reasons, update records, and pre-release checks showing reasons for anything withheld
How to reach Level 3
- Find out which transparency obligations and formats apply, and for each inventory entry decide against those criteria whether a record must be published, recording the reason.
- Complete any registration the law requires before the use starts, and give each published record an owner and review cycle.
- Check each record through information access and security routes before release, recording the reason for anything withheld, and update records when a use changes materially or is retired.
- For each use, decide whether its impact assessments are published and record the reason.
- Set up a designated clearance route for external communications about sensitive uses of AI.
Common pitfalls
- Publishing records once and leaving them out of date as uses change.
- Withholding information without recording why, which cannot be defended if challenged.
Starter artefacts
- Publication decision log per inventory entry
- Transparency record template in the required format
- Pre-release check and clearance procedure
Ownership and sequence
- Accountable
- executive sponsor
- Contributors
- ai governance lead, business owner
- Depends on
- GOV-06
- Roadmap step
- 4
- Lifecycle
- deploy, operate, retire
Cross-references
| AI Cyber Security Code of Practice | 10.1 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 1 Summary information partial; Scope mandatory organisations partial; Scope tools in scope direct; Scope timing and updates direct; Scope exemptions direct |
| EU AI Act | Art 26(8) partial; Art 49(3) direct; Art 50(4) partial |
| GDS AI Playbook | P7 partial |
| ISO/IEC 42001 | 7.4 partial; A.6.2.7 partial; A.8.2 partial; A.8.5 partial |
| JSP 936 Part 1 | para 64 partial; para 95 partial; para 107 partial |
| MITRE AI Maturity Model | P1.2 partial; P2.3 partial |
| NIST AI 600-1 | R8 partial |
| NIST AI RMF 1.0 | GOVERN 4.2 partial; MEASURE 2.8 partial |
| UK Data and AI Ethics Framework | Transparency 1 partial; Transparency 3 direct; Transparency 4 direct; Transparency 7 direct; Accountability 6 direct; Fairness 4 partial; SAT 2.3 partial; SAT 3.6 direct; SAT 4.7 direct; SAT 4.11 partial |
| UNESCO AI Maturity Framework | 5.5 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.