AACF
Overlay GEN

Generative AI

Applies when the organisation uses AI that generates text, images, audio, video or code.

If this applies to your organisation, these 6 criteria are added to the controls below. If it does not, they are left out: they are neither met nor failed. Every other criterion applies to every organisation.

  • GOV-10 · Governance & Accountability

    Review and disclosure of AI-generated content

    1. GOV-10.1 Approved rules set how AI-generated content released outside the organisation, including synthetic media, is reviewed and disclosed.
    2. GOV-10.2 Approved rules set how AI-generated content used inside the organisation to inform decisions or form official records is reviewed and disclosed.
    3. GOV-10.3 The rules require disclosure at least to the extent the law requires, made clearly when a person first meets the content.
  • RSK-02 · Risk, Ethics & Compliance

    AI risk assessment method

    1. RSK-02.7 The method covers the recognised generative AI risk categories.
  • TEC-06 · Technology & Platforms

    Testing and evaluation before release

    1. TEC-06.5 Testing of generative AI covers harmful output.
  • SEC-06 · AI Security

    Security testing of AI before release

    1. SEC-06.4 Testing of generative AI includes attempts to bypass its safeguards.

All overlays · Set your scope in the self-assessment