AACF
Overlay BLD

Builds or tunes its own models

Applies when the organisation trains, fine-tunes or otherwise develops models or AI components itself, rather than only configuring others' products.

If this applies to your organisation, these 5 criteria are added to the controls below. If it does not, they are left out: they are neither met nor failed. Every other criterion applies to every organisation.

  • OPM-02 · Operating Model & Delivery

    Build, buy or configure approach

    1. OPM-02.4 Reuse of existing and openly available models is considered before any new model is trained.
  • TEC-01 · Technology & Platforms

    Approved AI tools and platforms

    1. TEC-01.5 The list covers the environments and toolchains used to build, test and run the organisation's own AI, each with an owner and support.
  • TEC-02 · Technology & Platforms

    Reference architecture for AI

    1. TEC-02.7 Where the organisation builds or offers generative AI, the patterns mark its outputs as AI-generated in a machine-readable way.
  • SEC-04 · AI Security

    Preventing information leakage through AI

    1. SEC-04.4 Models trained or tuned on protected information are handled at least at that protection level, taking account of aggregation.
  • PPL-05 · People & Skills

    Role-based learning

    1. PPL-05.6 Pathways for people who build AI include secure design and development.

All overlays · Set your scope in the self-assessment