AACF
Overlay PRV

Provides AI to others

Applies when the organisation offers AI services, products or models to customers, partners or the public, not only for its own use.

If this applies to your organisation, these 5 criteria are added to the controls below. If it does not, they are left out: they are neither met nor failed. Every other criterion applies to every organisation.

  • GOV-01 · Governance & Accountability

    AI policy

    1. GOV-01.7 Acceptable use terms are set for users of AI services the organisation offers to others, and are reviewed.
    2. GOV-01.8 Breaches of the acceptable use terms by users of the organisation's AI services are acted on.
  • TEC-02 · Technology & Platforms

    Reference architecture for AI

    1. TEC-02.7 Where the organisation builds or offers generative AI, the patterns mark its outputs as AI-generated in a machine-readable way.
  • SEC-03 · AI Security

    Security of the AI supply chain

    1. SEC-03.6 Organisations that receive AI from this organisation are told which security responsibilities they hold.
  • SEC-05 · AI Security

    AI in security incident response

    1. SEC-05.6 Agreements with those the organisation provides AI to set out the incident support they and affected users will receive.

All overlays · Set your scope in the self-assessment