Cross-reference
Algorithmic Transparency Recording Standard
14 items: 13 met directly by a control at Level 3, 1 partly, 0 deliberately out of scope.
| Ref | Item (our description) | Controls | Note |
|---|---|---|---|
| Tier 1 Summary information | Give a plain, non-technical public summary of the tool, what it is and why it is used, with a web link and contact | GOV-06 direct, GOV-09 partial, MON-06 partial, CUL-08 partial | GOV-06 holds the name, purpose and status of every use, which gives the what, the why and the metadata phase field; GOV-09 publishes the record. Not required at Level 3: a public contact point for each use (MON-06 gives users and affected people a feedback route, and GOV-09 only tracks public questions at Level 4), and the region a tool affects. |
| Tier 2 Owner and responsibility | Say which organisation and team are responsible, who the senior owner is, and which suppliers were involved and on what terms | GOV-05 direct, TEC-07 partial, RSK-09 partial, OPM-04 partial, OPM-05 partial | GOV-05 names business, data, technical and assurance owners for each use in the inventory. Suppliers come from TEC-07 (recorded supplier dependencies per service), RSK-09 (due diligence) and OPM-05 (an owner per supplier); OPM-04 contract terms on data use and rights give the supplier's data access terms. The supplier's role in development or deployment and the procurement route are held in procurement records, not with the use of AI. |
| Tier 2 Description and rationale | Describe how the tool works, its users, scope and limits, its benefits, the process it replaced and the alternatives considered | TEC-05 direct, POR-05 partial, OPM-02 partial, MON-01 partial, GOV-06 partial | TEC-05 Level 3 requires documentation for each version to state the intended purpose and users, how it works, its inputs and outputs, known limitations and where it must not be used or relied on. The rationale comes from POR-05 (benefits, assumptions and options), OPM-02 (why configure, procure, build or wait was chosen) and MON-01 (a baseline of the process being replaced). |
| Tier 2 Deployment context | Explain how the tool fits the wider process, how people review its output, how often it is used, the training needed and how the public can appeal | RSK-07 direct, RSK-08 direct, TEC-04 partial, PPL-05 partial, MON-05 partial, MON-02 partial | RSK-07 states who reviews output, when, with what information and authority, and that reviewers are trained; MON-05 gives independent assurance of that review; RSK-08 gives affected people a challenge route with human review. TEC-04 documents data flows into core systems and PPL-05 sets role-based learning. Frequency and scale of use are not required to be recorded, though MON-02 monitoring and OPM-03 usage tracking would produce the figures. |
| Tier 2 Tool specification | Describe the tool's architecture, inputs and outputs, maintenance and review schedule, and the models in it | TEC-02 partial, TEC-04 partial, TEC-05 partial, TEC-07 partial, OPM-07 partial, GOV-06 partial | TEC-05 documentation states how each use works and its inputs and outputs, and GOV-06 links each inventory entry to its models, data sets and integrations, which gives the models field; architecture comes through TEC-02 design review and TEC-04 documented integrations. Still missing: a stated maintenance and review schedule for each tool, including how often models are retrained (TEC-07 refresh plans and OPM-07 change management cover maintenance without fixing a schedule). |
| Tier 2 Model specification | For each model the organisation trained, tuned or tested, give its name, version, task, inputs, outputs, design, test performance and datasets | TEC-06 direct, DAT-08 direct, TEC-05 partial, TEC-07 partial | TEC-06 records acceptance criteria, test data and results for each release (model performance); DAT-08 records every training, tuning and test data set and links it to the models that used it (datasets and their purposes); TEC-05 versions models, with their data sets, and its documentation states how the model works and its inputs and outputs; TEC-07 records the model and supplier. Model type and design are not required to be recorded as such. The template lets off-the-shelf models the organisation has not trained or tested skip this section. |
| Tier 2 Development data specification | Describe the data used to develop the tool, its size, sensitive attributes, representativeness, cleaning, collection, storage and sharing | DAT-08 direct, DAT-03 direct, DAT-05 direct, DAT-07 direct, DAT-04 partial, DAT-06 partial, DAT-02 partial, RSK-06 partial | DAT-08 gives source, collection method, rights and limits; DAT-03 representativeness and completeness for the purpose; DAT-05 purpose compatibility when data is repurposed, and fairness; DAT-07 access and sharing agreements; DAT-04 meaning, coverage and limits; DAT-02 the owner responsible for storage; RSK-06 the groups at risk, which covers protected characteristics and proxies. Not explicit: cleaning and pre-processing steps, and retention of development data (DAT-06 names inputs, prompts, outputs and decisions). The optional dataset card draws on the same controls. |
| Tier 2 Operational data specification | Describe the data the tool uses in live operation, its sensitive attributes, processing, storage, access and sharing | DAT-06 direct, DAT-07 direct, DAT-05 partial, TEC-04 partial, SEC-04 partial, RSK-03 partial, MON-02 partial | DAT-06 covers how inputs, prompts, outputs and logs are kept, retrieved and deleted; DAT-07 who can access them and the sharing agreements; TEC-04 data flows show where operational data comes from; DAT-05, RSK-03 (sensitive inferences) and SEC-04 cover sensitive attributes and their protection. Pre-processing of live data is only touched by MON-02 drift monitoring. |
| Tier 2 Risks, mitigations and impact assessments | List the impact assessments done with dates and findings, and the key risks of the tool with their mitigations | RSK-03 direct, RSK-02 direct, DAT-05 partial, RSK-06 partial, SEC-02 partial | RSK-03 is signed off before go-live and covers equality, privacy, rights, safety, societal and environmental effects with tracked mitigations; RSK-02 records each risk, the treatment and controls chosen and the residual risk. DAT-05 feeds the data protection assessment, RSK-06 unfair outcomes and SEC-02 security threats. |
| Scope mandatory organisations | Know whether the organisation is one that must publish records, and when the requirement reaches it | RSK-04 direct, GOV-09 partial | RSK-04 keeps a register of the laws, regulations and standards that apply, with an owner for each, which is where a publication mandate and its rollout phase are recorded; GOV-09 publishes to the extent obligations and public role require. For bodies outside the mandate the standard is recommended, and publishing is a choice GOV-09 allows but does not require. |
| Scope tools in scope | Identify which uses of AI must have a record, namely those with significant influence on decisions affecting the public or that interact directly with the public | GOV-09 direct, GOV-06 partial, RSK-08 partial, RSK-04 partial | GOV-09 Level 3 requires a decision for each inventory entry, against the criteria that apply, on whether a record must be published, with the reason recorded. For a mandated body the criteria are the ATRS ones (significant influence on decisions affecting the public, or direct interaction with the public), which stay in this mapping; RSK-08 identifies uses that support decisions about people or that people interact with. |
| Scope timing and updates | Publish once a tool reaches pilot or live use, keep the record current, and update it to show retirement | GOV-09 direct, GOV-06 partial, POR-09 partial, POR-04 partial | GOV-09 Level 3 requires published records to be updated when a use changes materially or is retired, on top of an owner and review cycle for each. The stage at which a record is due (pilot or production under ATRS) stays in this mapping; POR-04 stages and GOV-06 status give it, and POR-09 updates the inventory at retirement. |
| Scope exemptions | Withhold or summarise only information that access-to-information law would exempt, record the reason, and leave a tool unpublished only if its existence cannot be confirmed | GOV-09 direct, GOV-07 partial, SEC-04 partial, RSK-04 partial | GOV-09 Level 3 requires each record to be checked through information access and security routes before release, with the reason recorded for anything withheld, and a publication decision with reasons for each inventory entry. The policy's test (the FOI and related exemptions, applied as if to a request for the full record, and leaving a tool unpublished only where its existence cannot be confirmed) stays in this mapping for the assessor. |
| Scope supplier transparency | Tell suppliers from the start that this level of transparency is expected, and work with them so little is withheld for commercial reasons | OPM-04 direct, RSK-09 partial | OPM-04 Level 3 puts transparency terms in every relevant AI contract, including the information the organisation needs to publish about the use, so suppliers know from the start; RSK-09 gathers what the AI does, its data use and assurance before use. |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.