Overlay HIR
Regulated or high-impact use
Applies when the organisation has uses of AI that are regulated, high-risk under law, or could significantly affect people's rights, safety or access to services.
If this applies to your organisation, these 7 criteria are added to the controls below. If it does not, they are left out: they are neither met nor failed. Every other criterion applies to every organisation.
Integration with existing governance
- GOV-07.3 Uses of AI that could contribute to physical harm have a hazard analysis that feeds the relevant safety case.
Public transparency about AI use
- GOV-09.6 Any registration the law requires for a use of AI is completed before the use starts.
Explanation and challenge for affected people
- RSK-08.5 People are told when they are exposed to emotion recognition or biometric categorisation, at first contact, clearly and accessibly, unless it is obvious.
Risk of AI from suppliers
- RSK-09.7 High-risk AI that is not registered where the law requires it is not used, and the provider or distributor is told.
Serious AI incidents and external notification
- MON-09.2 The definition of serious incidents meets what applicable law requires.
- MON-09.4 Routes and deadlines for notifying regulators of a serious incident are set.
- MON-09.8 When the law requires it, the regulator is also told of such a risk.