Data & Information
Covers the data and information that AI uses and produces: who owns it, whether it is good enough for the job, whether its use is lawful and fair, whether people can find and understand it, how long it is kept, who can reach it and where it came from. Most problems with AI in use trace back to data, so these controls apply to bought and embedded AI as much as to anything built in-house.
Data strategy supports AI
The organisation's data strategy states what its planned uses of AI need from data and sets out how those needs will be met.
Data ownership and stewardship
Every data set used by AI has a named accountable owner and day-to-day stewards who understand the data and look after it.
Data quality fit for purpose
The quality of data used by each AI system is assessed against what that use needs, and shortfalls are fixed or their effects managed before and during live use.
Finding and understanding data
Data available for AI is catalogued and described well enough that people can find it, understand what it means and its limits, and use it correctly.
Lawful and fair use of data
Before data is used in an AI system, its use is confirmed as lawful, consistent with the purpose for which it was collected, and fair to the people it describes.
Records management for AI
Retention and records rules cover what AI systems take in and produce, including prompts, outputs and the decisions they supported, and are applied in practice.
Controlled access and sharing
AI systems and their users can reach only the data they need for the agreed purpose, and data is shared into and out of AI systems only under agreed rules.
Provenance of training and test data
For data used to train, tune or test AI, the organisation knows and records where it came from, what rights it holds over it, and any limits on its use.