{"text_format":"1","workbook":"xlsx","n_sheets":14,"sheets":["Introduction","Dashboard","Master sheet","Tables & graphs","Lookup","1. Governance & accountability","2. Transparency","3. Contracts & 3rd parties ","4. Data minimisation","5. Info security & integrity","6. DP by design","7. Statistical accuracy","8. Discrimination & bias","9. Human review"],"not_rendered":{"charts":12,"images":1,"macros":1,"external_links":0,"defined_names":10,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[5,1,42,15],[4,1,4,15]]}
[]
[]
[]
[]
[null,"AI Toolkit Tracker"]
[null,"\nYou can use this Tracker to record and track your actions once you have read the toolkit. \n\nThe first tab is called ‘Dashboard’. The dashboard will update automatically when you fill in the spreadsheet.\n\nThe next tab is called ‘Master Sheet’. This shows the toolkit and records all your responses in one place.\n\nWe have suggested some columns to help you to build your own action plan and improve your compliance. However, as the spreadsheet contains formula we would not recommend altering any of the existing columns. If you do make changes, you may impact the dashboard, master sheet or general functionality. Please note that we cannot offer support for maintaining the spreadsheet.\n\nKey phrases:\n\nCurrent status – This refers to whether you are ‘fully meeting our expectation’, ‘partially meeting our expectation’, or ‘not meeting our expectation’. You can also record the status as ‘not applicable’ to your organisation. You can choose the status from a drop-down list.\n\nReasons for status – You can record the reasons why you have chosen the ‘Current status’ for this expectation.\n\nActions – You can describe what you need to do next to meet the expectation.\n\nAction Owner(s) – You can specify who is responsible for the action.\n\nAction Status – You can choose what stage the action is at from a drop-down list. \n\nDue Date – You can record when you expect to complete the action.\n\n\n\nThe Data Protection Audit Framework, including the Tracker, is available under the terms of the Open Government Licence v3.0."]

{"sheet":"Dashboard","index":1,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Master sheet","index":2,"n_rows":304,"n_cols":16,"rows_kept":304,"cut":false,"hidden":false,"merged":[[290,12,299,12],[300,12,303,12],[260,12,267,12],[268,12,272,12],[273,12,277,12],[278,12,281,12],[282,12,289,12],[228,12,234,12],[235,12,237,12],[238,12,245,12],[246,12,254,12],[255,12,259,12],[191,12,196,12],[197,12,204,12],[205,12,208,12],[209,12,216,12],[217,12,227,12],[2,12,8,12],[9,12,17,12],[18,12,21,12],[22,12,27,12],[28,12,31,12],[32,12,40,12],[41,12,44,12],[45,12,52,12],[53,12,62,12],[63,12,69,12],[70,12,76,12],[77,12,91,12],[92,12,97,12],[98,12,104,12],[105,12,117,12],[118,12,127,12],[128,12,132,12],[133,12,138,12],[139,12,150,12],[151,12,158,12],[159,12,170,12],[171,12,181,12],[182,12,190,12],[228,0,237,0],[217,2,227,2],[228,1,234,1],[228,2,234,2],[235,1,237,1],[235,2,237,2],[159,1,170,1],[159,2,170,2],[171,1,181,1],[171,2,181,2],[159,0,227,0],[182,1,190,1],[182,2,190,2],[191,1,196,1],[191,2,196,2],[197,1,204,1],[197,2,204,2],[205,1,208,1],[205,2,208,2],[209,1,216,1],[209,2,216,2],[217,1,227,1],[133,0,158,0],[133,1,138,1],[133,2,138,2],[139,1,150,1],[139,2,150,2],[151,1,158,1],[151,2,158,2],[128,1,132,1],[77,0,97,0],[53,1,62,1],[53,2,62,2],[63,1,69,1],[63,2,69,2],[70,1,76,1],[70,2,76,2],[98,2,104,2],[105,2,117,2],[118,2,127,2],[128,2,132,2],[98,0,132,0],[98,1,104,1],[105,1,117,1],[118,1,127,1],[45,1,52,1],[45,2,52,2],[77,2,91,2],[92,1,97,1],[92,2,97,2],[77,1,91,1],[0,0,0,3],[2,1,8,1],[2,2,8,2],[9,1,17,1],[9,2,17,2],[2,0,76,0],[18,1,21,1],[18,2,21,2],[22,1,27,1],[22,2,27,2],[28,1,31,1],[28,2,31,2],[32,1,40,1],[32,2,40,2],[41,1,44,1],[41,2,44,2],[260,1,267,1],[260,2,267,2],[268,1,272,1],[268,2,272,2],[238,0,272,0],[238,1,245,1],[238,2,245,2],[246,1,254,1],[246,2,254,2],[255,1,259,1],[255,2,259,2],[273,0,289,0],[290,1,299,1],[290,2,299,2],[300,1,303,1],[300,2,303,2],[290,0,303,0],[273,1,277,1],[273,2,277,2],[278,1,281,1],[278,2,281,2],[282,1,289,1],[282,2,289,2]]}
["AI Tracker\nMaster Sheet"]
["Category","Number","Our expectations","Reference","Ways to meet our expectations ","Current Status","Reasons for Status","Action(s)","Action owner","Action Status","Completion date\n(DD/MM/YYYY)",{"$f":"IF(ISBLANK('1. Governance & accountability'!K1),\"\",'1. Governance & accountability'!K1)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!L1),\"\",'1. Governance & accountability'!L1)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!M1),\"\",'1. Governance & accountability'!M1)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!N1),\"\",'1. Governance & accountability'!N1)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!O1),\"\",'1. Governance & accountability'!O1)","v":""}]
["Governance and accountability",1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.1","\tEnsure the overall governance and privacy management framework supports the compliant use of AI systems.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E2),\"\",'1. Governance & accountability'!E2)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F2),\"\",'1. Governance & accountability'!F2)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G2),\"\",'1. Governance & accountability'!G2)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H2),\"\",'1. Governance & accountability'!H2)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I2),\"\",'1. Governance & accountability'!I2)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J2),\"\",'1. Governance & accountability'!J2)","v":""}]
[{"$f":"A3","v":"Governance and accountability"},{"$f":"B3","v":1.1000000000000001},{"$f":"C3","v":"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight."},"1.1.2","\tInclude appropriate technical and organisational measures into the framework that are designed to implement the data protection principles in an effective manner.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E3),\"\",'1. Governance & accountability'!E3)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F3),\"\",'1. Governance & accountability'!F3)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G3),\"\",'1. Governance & accountability'!G3)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H3),\"\",'1. Governance & accountability'!H3)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I3),\"\",'1. Governance & accountability'!I3)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J3),\"\",'1. Governance & accountability'!J3)","v":""}]
["Governance and accountability",1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.3","\tEvidence that senior management have seen and signed off the risks associated with using AI. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E4),\"\",'1. Governance & accountability'!E4)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F4),\"\",'1. Governance & accountability'!F4)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G4),\"\",'1. Governance & accountability'!G4)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H4),\"\",'1. Governance & accountability'!H4)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I4),\"\",'1. Governance & accountability'!I4)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J4),\"\",'1. Governance & accountability'!J4)","v":""}]
["Governance and accountability",1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.4","\tAppoint a DPO, or a nominated data protection lead, with designated responsibility for overseeing AI systems.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E5),\"\",'1. Governance & accountability'!E5)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F5),\"\",'1. Governance & accountability'!F5)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G5),\"\",'1. Governance & accountability'!G5)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H5),\"\",'1. Governance & accountability'!H5)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I5),\"\",'1. Governance & accountability'!I5)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J5),\"\",'1. Governance & accountability'!J5)","v":""}]
["Governance and accountability",1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.5","\tAssign technical and operational roles and responsibilities to ensure the effective management and security of AI systems and personal information they hold.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E6),\"\",'1. Governance & accountability'!E6)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F6),\"\",'1. Governance & accountability'!F6)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G6),\"\",'1. Governance & accountability'!G6)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H6),\"\",'1. Governance & accountability'!H6)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I6),\"\",'1. Governance & accountability'!I6)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J6),\"\",'1. Governance & accountability'!J6)","v":""}]
["Governance and accountability",1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.6","\tDocument in policy the privacy measures in place for information processing and for ongoing training, testing or evaluation of an AI system or service. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E7),\"\",'1. Governance & accountability'!E7)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F7),\"\",'1. Governance & accountability'!F7)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G7),\"\",'1. Governance & accountability'!G7)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H7),\"\",'1. Governance & accountability'!H7)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I7),\"\",'1. Governance & accountability'!I7)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J7),\"\",'1. Governance & accountability'!J7)","v":""}]
["Governance and accountability",1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.7","\tSupport policies with operational procedures, guidance or manuals to direct operational staff on using AI systems and applying data protection law.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E8),\"\",'1. Governance & accountability'!E8)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F8),\"\",'1. Governance & accountability'!F8)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G8),\"\",'1. Governance & accountability'!G8)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H8),\"\",'1. Governance & accountability'!H8)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I8),\"\",'1. Governance & accountability'!I8)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J8),\"\",'1. Governance & accountability'!J8)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.1","\tDocument the DPIA policy or process, with supporting templates and guidance to help staff complete an effective DPIA that meets the UK GDPR requirements (article 35).",{"$f":"IF(ISBLANK('1. Governance & accountability'!E9),\"\",'1. Governance & accountability'!E9)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F9),\"\",'1. Governance & accountability'!F9)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G9),\"\",'1. Governance & accountability'!G9)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H9),\"\",'1. Governance & accountability'!H9)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I9),\"\",'1. Governance & accountability'!I9)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J9),\"\",'1. Governance & accountability'!J9)","v":""}]
["Governance and accountability",{"$f":"B10","v":1.2},{"$f":"C10","v":"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA)."},"1.2.2","\tComplete the DPIA before starting the processing.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E10),\"\",'1. Governance & accountability'!E10)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F10),\"\",'1. Governance & accountability'!F10)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G10),\"\",'1. Governance & accountability'!G10)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H10),\"\",'1. Governance & accountability'!H10)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I10),\"\",'1. Governance & accountability'!I10)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J10),\"\",'1. Governance & accountability'!J10)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.3","\tConsult internal stakeholders, technical specialists within AI product teams and the public, as part of the DPIA assessment, as appropriate.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E11),\"\",'1. Governance & accountability'!E11)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F11),\"\",'1. Governance & accountability'!F11)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G11),\"\",'1. Governance & accountability'!G11)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H11),\"\",'1. Governance & accountability'!H11)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I11),\"\",'1. Governance & accountability'!I11)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J11),\"\",'1. Governance & accountability'!J11)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.4","\tShare completed DPIAs with senior management and get sign off on the outcome of the assessment.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E12),\"\",'1. Governance & accountability'!E12)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F12),\"\",'1. Governance & accountability'!F12)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G12),\"\",'1. Governance & accountability'!G12)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H12),\"\",'1. Governance & accountability'!H12)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I12),\"\",'1. Governance & accountability'!I12)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J12),\"\",'1. Governance & accountability'!J12)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.5","\tAct on the outputs of the DPIA to effectively mitigate or manage any risks it identified.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E13),\"\",'1. Governance & accountability'!E13)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F13),\"\",'1. Governance & accountability'!F13)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G13),\"\",'1. Governance & accountability'!G13)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H13),\"\",'1. Governance & accountability'!H13)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I13),\"\",'1. Governance & accountability'!I13)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J13),\"\",'1. Governance & accountability'!J13)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.6","\tReview DPIAs, particularly when there is a change to processing, to ensure they remain accurate and up-to-date",{"$f":"IF(ISBLANK('1. Governance & accountability'!E14),\"\",'1. Governance & accountability'!E14)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F14),\"\",'1. Governance & accountability'!F14)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G14),\"\",'1. Governance & accountability'!G14)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H14),\"\",'1. Governance & accountability'!H14)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I14),\"\",'1. Governance & accountability'!I14)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J14),\"\",'1. Governance & accountability'!J14)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.7","\tImplement an effective risk management strategy to help to formally document the risks of using AI systems. Ensure they are tracked and managed at a corporate level through an appropriate risk register.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E15),\"\",'1. Governance & accountability'!E15)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F15),\"\",'1. Governance & accountability'!F15)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G15),\"\",'1. Governance & accountability'!G15)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H15),\"\",'1. Governance & accountability'!H15)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I15),\"\",'1. Governance & accountability'!I15)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J15),\"\",'1. Governance & accountability'!J15)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.8","\tMitigate privacy risks effectively and in a timely manner through ongoing AI system development and enhancements.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E16),\"\",'1. Governance & accountability'!E16)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F16),\"\",'1. Governance & accountability'!F16)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G16),\"\",'1. Governance & accountability'!G16)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H16),\"\",'1. Governance & accountability'!H16)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I16),\"\",'1. Governance & accountability'!I16)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J16),\"\",'1. Governance & accountability'!J16)","v":""}]
["Governance and accountability",1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.9","\tEnsure there is proactive engagement between all parties as part of the procurement process to appropriately assess the risk of the AI system.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E17),\"\",'1. Governance & accountability'!E17)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F17),\"\",'1. Governance & accountability'!F17)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G17),\"\",'1. Governance & accountability'!G17)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H17),\"\",'1. Governance & accountability'!H17)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I17),\"\",'1. Governance & accountability'!I17)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J17),\"\",'1. Governance & accountability'!J17)","v":""}]
["Governance and accountability",1.3,"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies.","1.3.1","\tEmploy an external auditor to provide independent assurance (or certification) on your compliance with data protection law and information security.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E18),\"\",'1. Governance & accountability'!E18)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F18),\"\",'1. Governance & accountability'!F18)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G18),\"\",'1. Governance & accountability'!G18)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H18),\"\",'1. Governance & accountability'!H18)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I18),\"\",'1. Governance & accountability'!I18)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J18),\"\",'1. Governance & accountability'!J18)","v":""}]
["Governance and accountability",{"$f":"B19","v":1.3},{"$f":"C19","v":"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies."},"1.3.2","\tMaintain a central audit plan.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E19),\"\",'1. Governance & accountability'!E19)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F19),\"\",'1. Governance & accountability'!F19)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G19),\"\",'1. Governance & accountability'!G19)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H19),\"\",'1. Governance & accountability'!H19)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I19),\"\",'1. Governance & accountability'!I19)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J19),\"\",'1. Governance & accountability'!J19)","v":""}]
["Governance and accountability",1.3,"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies.","1.3.3","\tIntroduce a programme of internal audits to periodically assess AI systems compliance with data protection law.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E20),\"\",'1. Governance & accountability'!E20)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F20),\"\",'1. Governance & accountability'!F20)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G20),\"\",'1. Governance & accountability'!G20)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H20),\"\",'1. Governance & accountability'!H20)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I20),\"\",'1. Governance & accountability'!I20)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J20),\"\",'1. Governance & accountability'!J20)","v":""}]
["Governance and accountability",1.3,"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies.","1.3.4","\tProduce audit reports to document the findings from audits and share with senior management.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E21),\"\",'1. Governance & accountability'!E21)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F21),\"\",'1. Governance & accountability'!F21)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G21),\"\",'1. Governance & accountability'!G21)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H21),\"\",'1. Governance & accountability'!H21)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I21),\"\",'1. Governance & accountability'!I21)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J21),\"\",'1. Governance & accountability'!J21)","v":""}]
["Governance and accountability",1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.1","\tImplement measures to control the release of any changes or new versions of your system, software reconfiguration, or security patch applications.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E22),\"\",'1. Governance & accountability'!E22)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F22),\"\",'1. Governance & accountability'!F22)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G22),\"\",'1. Governance & accountability'!G22)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H22),\"\",'1. Governance & accountability'!H22)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I22),\"\",'1. Governance & accountability'!I22)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J22),\"\",'1. Governance & accountability'!J22)","v":""}]
["Governance and accountability",{"$f":"B23","v":1.4},{"$f":"C23","v":"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties."},"1.4.2","\tDesign and document an agreed communication plan so that all parties understand the impacts of the change(s) and are able to reassess any potential privacy implications.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E23),\"\",'1. Governance & accountability'!E23)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F23),\"\",'1. Governance & accountability'!F23)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G23),\"\",'1. Governance & accountability'!G23)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H23),\"\",'1. Governance & accountability'!H23)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I23),\"\",'1. Governance & accountability'!I23)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J23),\"\",'1. Governance & accountability'!J23)","v":""}]
["Governance and accountability",1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.3","\tLog all changes made, patches applied or new versions released (when and who to) and ensure historical information on these changes is easy to locate, if required.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E24),\"\",'1. Governance & accountability'!E24)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F24),\"\",'1. Governance & accountability'!F24)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G24),\"\",'1. Governance & accountability'!G24)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H24),\"\",'1. Governance & accountability'!H24)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I24),\"\",'1. Governance & accountability'!I24)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J24),\"\",'1. Governance & accountability'!J24)","v":""}]
["Governance and accountability",1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.4","\tInvestigate when overly-frequent updates or releases are happening, as this could suggest a lack of internal checks or sign-off before each one.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E25),\"\",'1. Governance & accountability'!E25)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F25),\"\",'1. Governance & accountability'!F25)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G25),\"\",'1. Governance & accountability'!G25)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H25),\"\",'1. Governance & accountability'!H25)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I25),\"\",'1. Governance & accountability'!I25)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J25),\"\",'1. Governance & accountability'!J25)","v":""}]
["Governance and accountability",1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.5","\tReview contracts and contract service level agreements (SLAs), following any significant changes.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E26),\"\",'1. Governance & accountability'!E26)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F26),\"\",'1. Governance & accountability'!F26)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G26),\"\",'1. Governance & accountability'!G26)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H26),\"\",'1. Governance & accountability'!H26)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I26),\"\",'1. Governance & accountability'!I26)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J26),\"\",'1. Governance & accountability'!J26)","v":""}]
["Governance and accountability",1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.6","\tPlan version releases or changes in advance (including software reconfiguration, or security patch applications) to allow time to educate and train the deployer or client on what they mean in practice.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E27),\"\",'1. Governance & accountability'!E27)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F27),\"\",'1. Governance & accountability'!F27)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G27),\"\",'1. Governance & accountability'!G27)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H27),\"\",'1. Governance & accountability'!H27)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I27),\"\",'1. Governance & accountability'!I27)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J27),\"\",'1. Governance & accountability'!J27)","v":""}]
["Governance and accountability",1.5,"Information flows across the entire supply chain have been comprehensively mapped.","1.5.1","\tImplement a process to ensure all processing activities are documented accurately and effectively.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E28),\"\",'1. Governance & accountability'!E28)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F28),\"\",'1. Governance & accountability'!F28)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G28),\"\",'1. Governance & accountability'!G28)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H28),\"\",'1. Governance & accountability'!H28)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I28),\"\",'1. Governance & accountability'!I28)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J28),\"\",'1. Governance & accountability'!J28)","v":""}]
["Governance and accountability",{"$f":"B29","v":1.5},{"$f":"C29","v":"Information flows across the entire supply chain have been comprehensively mapped."},"1.5.2","\tConduct information audits (or information mapping exercises) to find out how information moves across the supply chain and where it originates from.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E29),\"\",'1. Governance & accountability'!E29)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F29),\"\",'1. Governance & accountability'!F29)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G29),\"\",'1. Governance & accountability'!G29)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H29),\"\",'1. Governance & accountability'!H29)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I29),\"\",'1. Governance & accountability'!I29)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J29),\"\",'1. Governance & accountability'!J29)","v":""}]
["Governance and accountability",1.5,"Information flows across the entire supply chain have been comprehensively mapped.","1.5.3","\tMaintain an internal record of all processing activities (ROPA).",{"$f":"IF(ISBLANK('1. Governance & accountability'!E30),\"\",'1. Governance & accountability'!E30)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F30),\"\",'1. Governance & accountability'!F30)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G30),\"\",'1. Governance & accountability'!G30)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H30),\"\",'1. Governance & accountability'!H30)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I30),\"\",'1. Governance & accountability'!I30)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J30),\"\",'1. Governance & accountability'!J30)","v":""}]
["Governance and accountability",1.5,"Information flows across the entire supply chain have been comprehensively mapped.","1.5.4","\tHighlight information flow processes within the privacy management framework and encourage maintaining an updated version of this document. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E31),\"\",'1. Governance & accountability'!E31)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F31),\"\",'1. Governance & accountability'!F31)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G31),\"\",'1. Governance & accountability'!G31)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H31),\"\",'1. Governance & accountability'!H31)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I31),\"\",'1. Governance & accountability'!I31)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J31),\"\",'1. Governance & accountability'!J31)","v":""}]
["Governance and accountability",1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.1","\tReview your processing activities to determine the most appropriate lawful basis (or bases) for each activity.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E32),\"\",'1. Governance & accountability'!E32)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F32),\"\",'1. Governance & accountability'!F32)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G32),\"\",'1. Governance & accountability'!G32)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H32),\"\",'1. Governance & accountability'!H32)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I32),\"\",'1. Governance & accountability'!I32)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J32),\"\",'1. Governance & accountability'!J32)","v":""}]
["Governance and accountability",{"$f":"B33","v":1.6},{"$f":"C33","v":"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system."},"1.6.2","\tDocument each lawful basis and the justification as part of a DPIA, before processing. Assess whether the processing is a targeted and proportionate way of achieving a specific purpose and whether you could achieve the purpose by some other less intrusive means, or by processing less information.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E33),\"\",'1. Governance & accountability'!E33)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F33),\"\",'1. Governance & accountability'!F33)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G33),\"\",'1. Governance & accountability'!G33)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H33),\"\",'1. Governance & accountability'!H33)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I33),\"\",'1. Governance & accountability'!I33)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J33),\"\",'1. Governance & accountability'!J33)","v":""}]
["Governance and accountability",1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.3","\tDetermine an appropriate lawful basis, if you use personal information to train or develop any aspect of the AI before deployment. Follow the principles of data minimisation for these activities and do not repurpose this information for another use.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E34),\"\",'1. Governance & accountability'!E34)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F34),\"\",'1. Governance & accountability'!F34)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G34),\"\",'1. Governance & accountability'!G34)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H34),\"\",'1. Governance & accountability'!H34)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I34),\"\",'1. Governance & accountability'!I34)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J34),\"\",'1. Governance & accountability'!J34)","v":""}]
[{"$f":"A35","v":"Governance and accountability"},1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.4","\tIdentify and document an additional article 9 or 10 condition, if processing special category or criminal offence information.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E35),\"\",'1. Governance & accountability'!E35)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F35),\"\",'1. Governance & accountability'!F35)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G35),\"\",'1. Governance & accountability'!G35)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H35),\"\",'1. Governance & accountability'!H35)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I35),\"\",'1. Governance & accountability'!I35)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J35),\"\",'1. Governance & accountability'!J35)","v":""}]
["Governance and accountability",1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.5","\tAssess whether any special category information is accidentally created or collected. If so, delete it.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E36),\"\",'1. Governance & accountability'!E36)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F36),\"\",'1. Governance & accountability'!F36)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G36),\"\",'1. Governance & accountability'!G36)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H36),\"\",'1. Governance & accountability'!H36)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I36),\"\",'1. Governance & accountability'!I36)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J36),\"\",'1. Governance & accountability'!J36)","v":""}]
["Governance and accountability",1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.6","\tCease processing and delete any information if you are unable to identify an article 6 lawful basis and article 9 condition.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E37),\"\",'1. Governance & accountability'!E37)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F37),\"\",'1. Governance & accountability'!F37)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G37),\"\",'1. Governance & accountability'!G37)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H37),\"\",'1. Governance & accountability'!H37)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I37),\"\",'1. Governance & accountability'!I37)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J37),\"\",'1. Governance & accountability'!J37)","v":""}]
["Governance and accountability",1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.7","\tDocument the lawful basis you are relying on for processing children's information. Apply additional safeguards and security measures before processing.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E38),\"\",'1. Governance & accountability'!E38)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F38),\"\",'1. Governance & accountability'!F38)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G38),\"\",'1. Governance & accountability'!G38)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H38),\"\",'1. Governance & accountability'!H38)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I38),\"\",'1. Governance & accountability'!I38)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J38),\"\",'1. Governance & accountability'!J38)","v":""}]
["Governance and accountability",1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.8","If you rely on the outputs of an AI system to support marketing activities, ensure that you:\n- \tappropriately obtain the personal information (in line with your privacy notice); and \n- \tuse an appropriate lawful basis to process the personal information.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E39),\"\",'1. Governance & accountability'!E39)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F39),\"\",'1. Governance & accountability'!F39)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G39),\"\",'1. Governance & accountability'!G39)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H39),\"\",'1. Governance & accountability'!H39)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I39),\"\",'1. Governance & accountability'!I39)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J39),\"\",'1. Governance & accountability'!J39)","v":""}]
["Governance and accountability",1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.9","\tReview documented lawful bases to check that the relationship, the processing and the purposes have not changed.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E40),\"\",'1. Governance & accountability'!E40)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F40),\"\",'1. Governance & accountability'!F40)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G40),\"\",'1. Governance & accountability'!G40)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H40),\"\",'1. Governance & accountability'!H40)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I40),\"\",'1. Governance & accountability'!I40)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J40),\"\",'1. Governance & accountability'!J40)","v":""}]
["Governance and accountability",1.7,"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis.","1.7.1","Ensure the LIA considers the following:\n- \tNot using people’s information in ways they would find intrusive or which could cause them harm, unless there is a very good reason.\n- \tWhat extra steps to take when processing children’s information to make sure their interests are protected.\n- \tWhat safeguards to introduce to reduce the impact where possible.\n- \tWhether you can offer an opt out.\n- \tWhether a DPIA is required.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E41),\"\",'1. Governance & accountability'!E41)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F41),\"\",'1. Governance & accountability'!F41)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G41),\"\",'1. Governance & accountability'!G41)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H41),\"\",'1. Governance & accountability'!H41)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I41),\"\",'1. Governance & accountability'!I41)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J41),\"\",'1. Governance & accountability'!J41)","v":""}]
["Governance and accountability",{"$f":"B42","v":1.7},{"$f":"C42","v":"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis."},"1.7.2","\tConsult with key technical staff such as system developers when completing the LIA.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E42),\"\",'1. Governance & accountability'!E42)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F42),\"\",'1. Governance & accountability'!F42)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G42),\"\",'1. Governance & accountability'!G42)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H42),\"\",'1. Governance & accountability'!H42)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I42),\"\",'1. Governance & accountability'!I42)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J42),\"\",'1. Governance & accountability'!J42)","v":""}]
["Governance and accountability",1.7,"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis.","1.7.3","\tComplete the LIA before starting the processing and document the decision and the assessment.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E43),\"\",'1. Governance & accountability'!E43)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F43),\"\",'1. Governance & accountability'!F43)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G43),\"\",'1. Governance & accountability'!G43)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H43),\"\",'1. Governance & accountability'!H43)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I43),\"\",'1. Governance & accountability'!I43)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J43),\"\",'1. Governance & accountability'!J43)","v":""}]
["Governance and accountability",1.7,"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis.","1.7.4","\tPeriodically assess the model usage to ensure the purpose remains the same and necessity and legitimate interests are still valid.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E44),\"\",'1. Governance & accountability'!E44)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F44),\"\",'1. Governance & accountability'!F44)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G44),\"\",'1. Governance & accountability'!G44)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H44),\"\",'1. Governance & accountability'!H44)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I44),\"\",'1. Governance & accountability'!I44)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J44),\"\",'1. Governance & accountability'!J44)","v":""}]
["Governance and accountability",1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.1","\tInform people about processing in the AI system before asking them to give consent (or consent may not be valid).",{"$f":"IF(ISBLANK('1. Governance & accountability'!E45),\"\",'1. Governance & accountability'!E45)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F45),\"\",'1. Governance & accountability'!F45)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G45),\"\",'1. Governance & accountability'!G45)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H45),\"\",'1. Governance & accountability'!H45)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I45),\"\",'1. Governance & accountability'!I45)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J45),\"\",'1. Governance & accountability'!J45)","v":""}]
["Governance and accountability",{"$f":"B46","v":1.8},{"$f":"C46","v":"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements."},"1.8.2","\tEnsure consent mechanisms are specific, granular, and separate from other terms and conditions or acceptances.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E46),\"\",'1. Governance & accountability'!E46)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F46),\"\",'1. Governance & accountability'!F46)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G46),\"\",'1. Governance & accountability'!G46)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H46),\"\",'1. Governance & accountability'!H46)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I46),\"\",'1. Governance & accountability'!I46)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J46),\"\",'1. Governance & accountability'!J46)","v":""}]
["Governance and accountability",1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.3","\tProvide clear, prominent, positive opt-ins that are freely given and not a pre-condition of signing up to a service or pre-ticked boxes.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E47),\"\",'1. Governance & accountability'!E47)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F47),\"\",'1. Governance & accountability'!F47)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G47),\"\",'1. Governance & accountability'!G47)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H47),\"\",'1. Governance & accountability'!H47)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I47),\"\",'1. Governance & accountability'!I47)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J47),\"\",'1. Governance & accountability'!J47)","v":""}]
["Governance and accountability",1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.4","\tEnsure you actively provide information to people when you seek consent about how they can withdraw that consent.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E48),\"\",'1. Governance & accountability'!E48)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F48),\"\",'1. Governance & accountability'!F48)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G48),\"\",'1. Governance & accountability'!G48)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H48),\"\",'1. Governance & accountability'!H48)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I48),\"\",'1. Governance & accountability'!I48)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J48),\"\",'1. Governance & accountability'!J48)","v":""}]
["Governance and accountability",1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.5","\tKeep records or a log of when and how you obtained consent.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E49),\"\",'1. Governance & accountability'!E49)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F49),\"\",'1. Governance & accountability'!F49)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G49),\"\",'1. Governance & accountability'!G49)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H49),\"\",'1. Governance & accountability'!H49)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I49),\"\",'1. Governance & accountability'!I49)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J49),\"\",'1. Governance & accountability'!J49)","v":""}]
["Governance and accountability",1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.6","\tReview consent regularly to check that the relationship, the processing, and the purposes have not changed.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E50),\"\",'1. Governance & accountability'!E50)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F50),\"\",'1. Governance & accountability'!F50)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G50),\"\",'1. Governance & accountability'!G50)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H50),\"\",'1. Governance & accountability'!H50)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I50),\"\",'1. Governance & accountability'!I50)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J50),\"\",'1. Governance & accountability'!J50)","v":""}]
["Governance and accountability",1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.7","\tImplement processes to refresh consent at appropriate intervals.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E51),\"\",'1. Governance & accountability'!E51)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F51),\"\",'1. Governance & accountability'!F51)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G51),\"\",'1. Governance & accountability'!G51)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H51),\"\",'1. Governance & accountability'!H51)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I51),\"\",'1. Governance & accountability'!I51)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J51),\"\",'1. Governance & accountability'!J51)","v":""}]
["Governance and accountability",1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.8","\tImplement dynamic consent mechanisms that allow people to control and revise their consent preferences over time. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E52),\"\",'1. Governance & accountability'!E52)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F52),\"\",'1. Governance & accountability'!F52)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G52),\"\",'1. Governance & accountability'!G52)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H52),\"\",'1. Governance & accountability'!H52)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I52),\"\",'1. Governance & accountability'!I52)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J52),\"\",'1. Governance & accountability'!J52)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.1","\tCheck the purposes and lawful basis when information was collected and ensure they have not changed when developing the AI system.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E53),\"\",'1. Governance & accountability'!E53)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F53),\"\",'1. Governance & accountability'!F53)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G53),\"\",'1. Governance & accountability'!G53)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H53),\"\",'1. Governance & accountability'!H53)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I53),\"\",'1. Governance & accountability'!I53)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J53),\"\",'1. Governance & accountability'!J53)","v":""}]
["Governance and accountability",{"$f":"B54","v":1.9},{"$f":"C54","v":"There is a comprehensive and effective approach in place to ensure: "},"1.9.2","Undertake due diligence when sourcing information indirectly to train your AI system to check:\n- \tunder which lawful basis the information was originally collected;\n- \twhat privacy information was provided to support its repurpose; and \n- \tthere is not a change in lawful basis when using the information to train the system.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E54),\"\",'1. Governance & accountability'!E54)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F54),\"\",'1. Governance & accountability'!F54)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G54),\"\",'1. Governance & accountability'!G54)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H54),\"\",'1. Governance & accountability'!H54)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I54),\"\",'1. Governance & accountability'!I54)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J54),\"\",'1. Governance & accountability'!J54)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.3","\tEnsure due diligence checks include the entire information supply chain.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E55),\"\",'1. Governance & accountability'!E55)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F55),\"\",'1. Governance & accountability'!F55)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G55),\"\",'1. Governance & accountability'!G55)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H55),\"\",'1. Governance & accountability'!H55)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I55),\"\",'1. Governance & accountability'!I55)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J55),\"\",'1. Governance & accountability'!J55)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.4","\tCheck that if the information was originally collected under consent, the consent statement was clear and granular enough to permit you to use it to train the AI system (and that people are aware that their information will be used in this way).",{"$f":"IF(ISBLANK('1. Governance & accountability'!E56),\"\",'1. Governance & accountability'!E56)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F56),\"\",'1. Governance & accountability'!F56)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G56),\"\",'1. Governance & accountability'!G56)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H56),\"\",'1. Governance & accountability'!H56)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I56),\"\",'1. Governance & accountability'!I56)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J56),\"\",'1. Governance & accountability'!J56)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.5","\tConduct a fairness and lawfulness assessment as part of the DPIA.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E57),\"\",'1. Governance & accountability'!E57)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F57),\"\",'1. Governance & accountability'!F57)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G57),\"\",'1. Governance & accountability'!G57)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H57),\"\",'1. Governance & accountability'!H57)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I57),\"\",'1. Governance & accountability'!I57)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J57),\"\",'1. Governance & accountability'!J57)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.6","\tEstablish comprehensive audit trails to log and monitor access to datasets. This includes tracking who accessed the information, when, and for what purpose.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E58),\"\",'1. Governance & accountability'!E58)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F58),\"\",'1. Governance & accountability'!F58)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G58),\"\",'1. Governance & accountability'!G58)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H58),\"\",'1. Governance & accountability'!H58)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I58),\"\",'1. Governance & accountability'!I58)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J58),\"\",'1. Governance & accountability'!J58)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.7","\tUse role-based access control (RBAC) mechanisms to assign permissions based on staff roles and responsibilities. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E59),\"\",'1. Governance & accountability'!E59)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F59),\"\",'1. Governance & accountability'!F59)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G59),\"\",'1. Governance & accountability'!G59)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H59),\"\",'1. Governance & accountability'!H59)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I59),\"\",'1. Governance & accountability'!I59)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J59),\"\",'1. Governance & accountability'!J59)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.8","\tEnsure only authorised staff or systems have access to the specific datasets they need. This reduces the opportunity for repurposing the information. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E60),\"\",'1. Governance & accountability'!E60)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F60),\"\",'1. Governance & accountability'!F60)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G60),\"\",'1. Governance & accountability'!G60)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H60),\"\",'1. Governance & accountability'!H60)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I60),\"\",'1. Governance & accountability'!I60)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J60),\"\",'1. Governance & accountability'!J60)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.9","\tEmploy encryption techniques to protect information both in transit and at rest. This ensures that even if unauthorised access occurs, the information remains unintelligible without the appropriate decryption keys.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E61),\"\",'1. Governance & accountability'!E61)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F61),\"\",'1. Governance & accountability'!F61)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G61),\"\",'1. Governance & accountability'!G61)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H61),\"\",'1. Governance & accountability'!H61)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I61),\"\",'1. Governance & accountability'!I61)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J61),\"\",'1. Governance & accountability'!J61)","v":""}]
["Governance and accountability",1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.10","\tApply anonymisation and pseudonymisation techniques to remove personal information in the datasets.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E62),\"\",'1. Governance & accountability'!E62)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F62),\"\",'1. Governance & accountability'!F62)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G62),\"\",'1. Governance & accountability'!G62)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H62),\"\",'1. Governance & accountability'!H62)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I62),\"\",'1. Governance & accountability'!I62)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J62),\"\",'1. Governance & accountability'!J62)","v":""}]
["Governance and accountability",1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.1","\tAssess whether the processing is solely automated.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E63),\"\",'1. Governance & accountability'!E63)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F63),\"\",'1. Governance & accountability'!F63)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G63),\"\",'1. Governance & accountability'!G63)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H63),\"\",'1. Governance & accountability'!H63)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I63),\"\",'1. Governance & accountability'!I63)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J63),\"\",'1. Governance & accountability'!J63)","v":""}]
["Governance and accountability",{"$f":"B64","v":1.1000000000000001},{"$f":"C64","v":"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems."},"1.10.2","\tAnalyse the impact of decision making on people and detail all potential legal or similar effects.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E64),\"\",'1. Governance & accountability'!E64)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F64),\"\",'1. Governance & accountability'!F64)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G64),\"\",'1. Governance & accountability'!G64)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H64),\"\",'1. Governance & accountability'!H64)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I64),\"\",'1. Governance & accountability'!I64)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J64),\"\",'1. Governance & accountability'!J64)","v":""}]
["Governance and accountability",1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.3","\tAsses the likelihood that you will accidentally create special category information and use it to make a decision.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E65),\"\",'1. Governance & accountability'!E65)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F65),\"\",'1. Governance & accountability'!F65)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G65),\"\",'1. Governance & accountability'!G65)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H65),\"\",'1. Governance & accountability'!H65)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I65),\"\",'1. Governance & accountability'!I65)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J65),\"\",'1. Governance & accountability'!J65)","v":""}]
["Governance and accountability",1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.4","\tEnsure that any AI models you use do not unintentionally infer special category or criminal conviction information and use those inferences to make decisions about people. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E66),\"\",'1. Governance & accountability'!E66)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F66),\"\",'1. Governance & accountability'!F66)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G66),\"\",'1. Governance & accountability'!G66)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H66),\"\",'1. Governance & accountability'!H66)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I66),\"\",'1. Governance & accountability'!I66)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J66),\"\",'1. Governance & accountability'!J66)","v":""}]
[{"$f":"A67","v":"Governance and accountability"},1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.5","\tDelete any special category or criminal conviction information created as a result of automated decision making, if there is no appropriate article 6 lawful basis or article 9 condition. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E67),\"\",'1. Governance & accountability'!E67)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F67),\"\",'1. Governance & accountability'!F67)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G67),\"\",'1. Governance & accountability'!G67)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H67),\"\",'1. Governance & accountability'!H67)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I67),\"\",'1. Governance & accountability'!I67)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J67),\"\",'1. Governance & accountability'!J67)","v":""}]
["Governance and accountability",1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.6","\tEnsure people have provided their explicit consent or assess whether the processing is necessary for substantial public interest reasons.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E68),\"\",'1. Governance & accountability'!E68)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F68),\"\",'1. Governance & accountability'!F68)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G68),\"\",'1. Governance & accountability'!G68)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H68),\"\",'1. Governance & accountability'!H68)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I68),\"\",'1. Governance & accountability'!I68)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J68),\"\",'1. Governance & accountability'!J68)","v":""}]
["Governance and accountability",1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.7","\tApply additional safeguards to enhance the security of the information if you are using special category information (such as biometric data). ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E69),\"\",'1. Governance & accountability'!E69)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F69),\"\",'1. Governance & accountability'!F69)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G69),\"\",'1. Governance & accountability'!G69)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H69),\"\",'1. Governance & accountability'!H69)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I69),\"\",'1. Governance & accountability'!I69)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J69),\"\",'1. Governance & accountability'!J69)","v":""}]
["Governance and accountability",1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.1","\tPublish guidance for people so they know how to make a request. ",{"$f":"IF(ISBLANK('1. Governance & accountability'!E70),\"\",'1. Governance & accountability'!E70)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F70),\"\",'1. Governance & accountability'!F70)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G70),\"\",'1. Governance & accountability'!G70)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H70),\"\",'1. Governance & accountability'!H70)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I70),\"\",'1. Governance & accountability'!I70)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J70),\"\",'1. Governance & accountability'!J70)","v":""}]
["Governance and accountability",{"$f":"B71","v":1.1100000000000001},{"$f":"C71","v":"There is a policy or process for dealing with people’s rights requests in the information processing pipeline."},"1.11.2","\tEstablish a well-organised model management system and deployment pipeline to make it easier and cheaper to accommodate requests.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E71),\"\",'1. Governance & accountability'!E71)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F71),\"\",'1. Governance & accountability'!F71)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G71),\"\",'1. Governance & accountability'!G71)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H71),\"\",'1. Governance & accountability'!H71)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I71),\"\",'1. Governance & accountability'!I71)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J71),\"\",'1. Governance & accountability'!J71)","v":""}]
["Governance and accountability",1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.3","\tConsider data indexing or tracing and making systems searchable as part of the system design to effectively respond to requests within statutory timeframes.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E72),\"\",'1. Governance & accountability'!E72)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F72),\"\",'1. Governance & accountability'!F72)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G72),\"\",'1. Governance & accountability'!G72)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H72),\"\",'1. Governance & accountability'!H72)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I72),\"\",'1. Governance & accountability'!I72)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J72),\"\",'1. Governance & accountability'!J72)","v":""}]
["Governance and accountability",1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.4","\tMonitor the time taken to respond to requests in order to identify systems which are potentially more complex.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E73),\"\",'1. Governance & accountability'!E73)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F73),\"\",'1. Governance & accountability'!F73)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G73),\"\",'1. Governance & accountability'!G73)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H73),\"\",'1. Governance & accountability'!H73)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I73),\"\",'1. Governance & accountability'!I73)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J73),\"\",'1. Governance & accountability'!J73)","v":""}]
["Governance and accountability",1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.5","\tEnsure AI systems have the technical capability to action any requests by people asking you to stop processing their personal information.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E74),\"\",'1. Governance & accountability'!E74)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F74),\"\",'1. Governance & accountability'!F74)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G74),\"\",'1. Governance & accountability'!G74)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H74),\"\",'1. Governance & accountability'!H74)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I74),\"\",'1. Governance & accountability'!I74)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J74),\"\",'1. Governance & accountability'!J74)","v":""}]
["Governance and accountability",1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.6","\tEnsure AI systems have the technical capability to action any requests by people asking you to erase their personal information from the system permanently.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E75),\"\",'1. Governance & accountability'!E75)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F75),\"\",'1. Governance & accountability'!F75)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G75),\"\",'1. Governance & accountability'!G75)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H75),\"\",'1. Governance & accountability'!H75)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I75),\"\",'1. Governance & accountability'!I75)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J75),\"\",'1. Governance & accountability'!J75)","v":""}]
["Governance and accountability",1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.7","\tRegularly and proactively evaluate the possibility of personal information being inferred from models in light of the state-of-the-art technology. This minimises the risk of accidental disclosure.",{"$f":"IF(ISBLANK('1. Governance & accountability'!E76),\"\",'1. Governance & accountability'!E76)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!F76),\"\",'1. Governance & accountability'!F76)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!G76),\"\",'1. Governance & accountability'!G76)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!H76),\"\",'1. Governance & accountability'!H76)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!I76),\"\",'1. Governance & accountability'!I76)","v":""},{"$f":"IF(ISBLANK('1. Governance & accountability'!J76),\"\",'1. Governance & accountability'!J76)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.1","\tProvide information about AI systems that is clear and meaningful, explains the processing in everyday language, and does not use overly complex explanations of the AI or confusing and technical terminology, jargon or legalistic language.",{"$f":"IF(ISBLANK('2. Transparency'!E2),\"\",'2. Transparency'!E2)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F2),\"\",'2. Transparency'!F2)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G2),\"\",'2. Transparency'!G2)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H2),\"\",'2. Transparency'!H2)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I2),\"\",'2. Transparency'!I2)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J2),\"\",'2. Transparency'!J2)","v":""}]
[{"$f":"A78","v":"Transparency"},{"$f":"B78","v":2.1},{"$f":"C78","v":"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. "},"2.1.2","\tAvoid hiding information within lengthy terms and conditions.",{"$f":"IF(ISBLANK('2. Transparency'!E3),\"\",'2. Transparency'!E3)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F3),\"\",'2. Transparency'!F3)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G3),\"\",'2. Transparency'!G3)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H3),\"\",'2. Transparency'!H3)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I3),\"\",'2. Transparency'!I3)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J3),\"\",'2. Transparency'!J3)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.3","\tBe proactive when making people aware of the information and provide an easy way to access it. ",{"$f":"IF(ISBLANK('2. Transparency'!E4),\"\",'2. Transparency'!E4)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F4),\"\",'2. Transparency'!F4)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G4),\"\",'2. Transparency'!G4)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H4),\"\",'2. Transparency'!H4)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I4),\"\",'2. Transparency'!I4)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J4),\"\",'2. Transparency'!J4)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.4","\tUse a combination of appropriate techniques, such as a layered approach, dashboards, just-in-time notices, icons and mobile and smart device functionalities.",{"$f":"IF(ISBLANK('2. Transparency'!E5),\"\",'2. Transparency'!E5)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F5),\"\",'2. Transparency'!F5)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G5),\"\",'2. Transparency'!G5)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H5),\"\",'2. Transparency'!H5)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I5),\"\",'2. Transparency'!I5)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J5),\"\",'2. Transparency'!J5)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.5","\tAssess whether privacy information is easy to understand (eg by assessing how well people understand processing, or conducting user testing to gain feedback on the content). ",{"$f":"IF(ISBLANK('2. Transparency'!E6),\"\",'2. Transparency'!E6)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F6),\"\",'2. Transparency'!F6)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G6),\"\",'2. Transparency'!G6)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H6),\"\",'2. Transparency'!H6)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I6),\"\",'2. Transparency'!I6)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J6),\"\",'2. Transparency'!J6)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.6","\tProvide evidence that the underlying processing is within the reasonable expectations of people and does not have an unjustified adverse effect on them.",{"$f":"IF(ISBLANK('2. Transparency'!E7),\"\",'2. Transparency'!E7)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F7),\"\",'2. Transparency'!F7)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G7),\"\",'2. Transparency'!G7)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H7),\"\",'2. Transparency'!H7)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I7),\"\",'2. Transparency'!I7)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J7),\"\",'2. Transparency'!J7)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.7","If decisions are made by AI without human intervention, provide extra details on: \n- \tthe logic of decision making involved; \n- \tthe significance of the processing; and \n- \tthe envisaged consequences of it. ",{"$f":"IF(ISBLANK('2. Transparency'!E8),\"\",'2. Transparency'!E8)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F8),\"\",'2. Transparency'!F8)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G8),\"\",'2. Transparency'!G8)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H8),\"\",'2. Transparency'!H8)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I8),\"\",'2. Transparency'!I8)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J8),\"\",'2. Transparency'!J8)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.8","\tInform people within one month when AI creates new information about them (which you intend to keep and use).",{"$f":"IF(ISBLANK('2. Transparency'!E9),\"\",'2. Transparency'!E9)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F9),\"\",'2. Transparency'!F9)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G9),\"\",'2. Transparency'!G9)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H9),\"\",'2. Transparency'!H9)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I9),\"\",'2. Transparency'!I9)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J9),\"\",'2. Transparency'!J9)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.9","\tUse explainable AI techniques to understand and interpret the decision-making processes of machine learning models. This enhances transparency and helps identify which features contribute significantly to the model's predictions.",{"$f":"IF(ISBLANK('2. Transparency'!E10),\"\",'2. Transparency'!E10)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F10),\"\",'2. Transparency'!F10)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G10),\"\",'2. Transparency'!G10)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H10),\"\",'2. Transparency'!H10)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I10),\"\",'2. Transparency'!I10)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J10),\"\",'2. Transparency'!J10)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.10","\tInclude details to enable people to challenge the outcome if they think it is flawed (eg if some of the input information was incorrect or irrelevant, or additional information wasn't taken into account that the person thinks is relevant).",{"$f":"IF(ISBLANK('2. Transparency'!E11),\"\",'2. Transparency'!E11)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F11),\"\",'2. Transparency'!F11)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G11),\"\",'2. Transparency'!G11)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H11),\"\",'2. Transparency'!H11)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I11),\"\",'2. Transparency'!I11)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J11),\"\",'2. Transparency'!J11)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.11","\tTake steps to explain any trade-offs to people or any human tasked with reviewing AI output.",{"$f":"IF(ISBLANK('2. Transparency'!E12),\"\",'2. Transparency'!E12)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F12),\"\",'2. Transparency'!F12)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G12),\"\",'2. Transparency'!G12)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H12),\"\",'2. Transparency'!H12)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I12),\"\",'2. Transparency'!I12)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J12),\"\",'2. Transparency'!J12)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.12","\tProvide privacy information if you collect special category information in order to monitor and prevent discrimination or unfair bias. Include the processing purpose and lawful basis and condition in the privacy information.",{"$f":"IF(ISBLANK('2. Transparency'!E13),\"\",'2. Transparency'!E13)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F13),\"\",'2. Transparency'!F13)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G13),\"\",'2. Transparency'!G13)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H13),\"\",'2. Transparency'!H13)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I13),\"\",'2. Transparency'!I13)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J13),\"\",'2. Transparency'!J13)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.13","\tRegularly review existing AI privacy information and, where necessary, update it appropriately.",{"$f":"IF(ISBLANK('2. Transparency'!E14),\"\",'2. Transparency'!E14)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F14),\"\",'2. Transparency'!F14)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G14),\"\",'2. Transparency'!G14)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H14),\"\",'2. Transparency'!H14)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I14),\"\",'2. Transparency'!I14)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J14),\"\",'2. Transparency'!J14)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.14","\tUpdate privacy information and communicate the changes to people before starting any new processing, particularly if there are plans to use personal information for a new purpose within AI processing.",{"$f":"IF(ISBLANK('2. Transparency'!E15),\"\",'2. Transparency'!E15)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F15),\"\",'2. Transparency'!F15)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G15),\"\",'2. Transparency'!G15)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H15),\"\",'2. Transparency'!H15)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I15),\"\",'2. Transparency'!I15)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J15),\"\",'2. Transparency'!J15)","v":""}]
["Transparency",2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.15","\tTrain staff so they understand what privacy information to provide to people and how best to do so.",{"$f":"IF(ISBLANK('2. Transparency'!E16),\"\",'2. Transparency'!E16)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F16),\"\",'2. Transparency'!F16)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G16),\"\",'2. Transparency'!G16)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H16),\"\",'2. Transparency'!H16)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I16),\"\",'2. Transparency'!I16)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J16),\"\",'2. Transparency'!J16)","v":""}]
["Transparency",2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.1","\tInform people if the purpose for using their personal information is different to what it was originally obtained for.",{"$f":"IF(ISBLANK('2. Transparency'!E17),\"\",'2. Transparency'!E17)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F17),\"\",'2. Transparency'!F17)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G17),\"\",'2. Transparency'!G17)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H17),\"\",'2. Transparency'!H17)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I17),\"\",'2. Transparency'!I17)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J17),\"\",'2. Transparency'!J17)","v":""}]
["Transparency",{"$f":"B93","v":2.2000000000000002},{"$f":"C93","v":"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain."},"2.2.2","\tInclude meaningful information about the logic involved, as well as the significance and the envisaged consequences of the processing",{"$f":"IF(ISBLANK('2. Transparency'!E18),\"\",'2. Transparency'!E18)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F18),\"\",'2. Transparency'!F18)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G18),\"\",'2. Transparency'!G18)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H18),\"\",'2. Transparency'!H18)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I18),\"\",'2. Transparency'!I18)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J18),\"\",'2. Transparency'!J18)","v":""}]
["Transparency",2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.3","\tProvide privacy information within a reasonable period of obtaining the information, and no later than one month.",{"$f":"IF(ISBLANK('2. Transparency'!E19),\"\",'2. Transparency'!E19)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F19),\"\",'2. Transparency'!F19)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G19),\"\",'2. Transparency'!G19)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H19),\"\",'2. Transparency'!H19)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I19),\"\",'2. Transparency'!I19)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J19),\"\",'2. Transparency'!J19)","v":""}]
["Transparency",2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.4","\tCheck and confirm what privacy information is provided across the supply chain and that it informs people about their information being shared with others. ",{"$f":"IF(ISBLANK('2. Transparency'!E20),\"\",'2. Transparency'!E20)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F20),\"\",'2. Transparency'!F20)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G20),\"\",'2. Transparency'!G20)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H20),\"\",'2. Transparency'!H20)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I20),\"\",'2. Transparency'!I20)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J20),\"\",'2. Transparency'!J20)","v":""}]
["Transparency",2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.5","\tBe very clear with people about any unexpected or intrusive uses of their personal information, such as combining information about them from a number of different sources.",{"$f":"IF(ISBLANK('2. Transparency'!E21),\"\",'2. Transparency'!E21)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F21),\"\",'2. Transparency'!F21)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G21),\"\",'2. Transparency'!G21)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H21),\"\",'2. Transparency'!H21)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I21),\"\",'2. Transparency'!I21)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J21),\"\",'2. Transparency'!J21)","v":""}]
["Transparency",2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.6","Carry out a DPIA to determine whether providing privacy information would involve a disproportionate effort when balanced against people's rights and freedoms.",{"$f":"IF(ISBLANK('2. Transparency'!E22),\"\",'2. Transparency'!E22)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!F22),\"\",'2. Transparency'!F22)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!G22),\"\",'2. Transparency'!G22)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!H22),\"\",'2. Transparency'!H22)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!I22),\"\",'2. Transparency'!I22)","v":""},{"$f":"IF(ISBLANK('2. Transparency'!J22),\"\",'2. Transparency'!J22)","v":""}]
["Contracts and third parties",3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.1","\tIdentify the distinct sets of processing operations and their purposes in order to understand the relationship.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E2),\"\",'3. Contracts & 3rd parties '!E2)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F2),\"\",'3. Contracts & 3rd parties '!F2)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G2),\"\",'3. Contracts & 3rd parties '!G2)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H2),\"\",'3. Contracts & 3rd parties '!H2)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I2),\"\",'3. Contracts & 3rd parties '!I2)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J2),\"\",'3. Contracts & 3rd parties '!J2)","v":""}]
[{"$f":"A99","v":"Contracts and third parties"},{"$f":"B99","v":3.1},{"$f":"C99","v":"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented."},"3.1.2","\tConsider the whole supply chain within the assessment.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E3),\"\",'3. Contracts & 3rd parties '!E3)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F3),\"\",'3. Contracts & 3rd parties '!F3)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G3),\"\",'3. Contracts & 3rd parties '!G3)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H3),\"\",'3. Contracts & 3rd parties '!H3)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I3),\"\",'3. Contracts & 3rd parties '!I3)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J3),\"\",'3. Contracts & 3rd parties '!J3)","v":""}]
["Contracts and third parties",3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.3","\tEvidence the consideration of the relationship between all parties (eg in emails, meeting minutes, model design or specification documents).",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E4),\"\",'3. Contracts & 3rd parties '!E4)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F4),\"\",'3. Contracts & 3rd parties '!F4)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G4),\"\",'3. Contracts & 3rd parties '!G4)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H4),\"\",'3. Contracts & 3rd parties '!H4)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I4),\"\",'3. Contracts & 3rd parties '!I4)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J4),\"\",'3. Contracts & 3rd parties '!J4)","v":""}]
["Contracts and third parties",3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.4","\tInclude a requirement within DPIA templates to assess the relationship.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E5),\"\",'3. Contracts & 3rd parties '!E5)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F5),\"\",'3. Contracts & 3rd parties '!F5)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G5),\"\",'3. Contracts & 3rd parties '!G5)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H5),\"\",'3. Contracts & 3rd parties '!H5)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I5),\"\",'3. Contracts & 3rd parties '!I5)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J5),\"\",'3. Contracts & 3rd parties '!J5)","v":""}]
["Contracts and third parties",3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.5","\tEnsure considerations and conclusions are in line with ICO and sectoral or EU guidance on the role of controllers and processors.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E6),\"\",'3. Contracts & 3rd parties '!E6)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F6),\"\",'3. Contracts & 3rd parties '!F6)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G6),\"\",'3. Contracts & 3rd parties '!G6)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H6),\"\",'3. Contracts & 3rd parties '!H6)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I6),\"\",'3. Contracts & 3rd parties '!I6)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J6),\"\",'3. Contracts & 3rd parties '!J6)","v":""}]
["Contracts and third parties",3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.6","\tFormally document and agree the relationship within contracts or agreements.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E7),\"\",'3. Contracts & 3rd parties '!E7)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F7),\"\",'3. Contracts & 3rd parties '!F7)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G7),\"\",'3. Contracts & 3rd parties '!G7)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H7),\"\",'3. Contracts & 3rd parties '!H7)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I7),\"\",'3. Contracts & 3rd parties '!I7)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J7),\"\",'3. Contracts & 3rd parties '!J7)","v":""}]
["Contracts and third parties",3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.7","\tCommunicate the relationship in privacy information.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E8),\"\",'3. Contracts & 3rd parties '!E8)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F8),\"\",'3. Contracts & 3rd parties '!F8)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G8),\"\",'3. Contracts & 3rd parties '!G8)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H8),\"\",'3. Contracts & 3rd parties '!H8)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I8),\"\",'3. Contracts & 3rd parties '!I8)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J8),\"\",'3. Contracts & 3rd parties '!J8)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.1","\tDecide the acceptable level of accuracy before procurement and complete due diligence to understand and confirm this.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E9),\"\",'3. Contracts & 3rd parties '!E9)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F9),\"\",'3. Contracts & 3rd parties '!F9)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G9),\"\",'3. Contracts & 3rd parties '!G9)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H9),\"\",'3. Contracts & 3rd parties '!H9)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I9),\"\",'3. Contracts & 3rd parties '!I9)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J9),\"\",'3. Contracts & 3rd parties '!J9)","v":""}]
["Contracts and third parties",{"$f":"B106","v":3.2},{"$f":"C106","v":"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. "},"3.2.2","\tSeek guarantees from the provider of the system or dataset on the source of the information, coding or models used to build the AI, to help you determine its accuracy.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E10),\"\",'3. Contracts & 3rd parties '!E10)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F10),\"\",'3. Contracts & 3rd parties '!F10)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G10),\"\",'3. Contracts & 3rd parties '!G10)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H10),\"\",'3. Contracts & 3rd parties '!H10)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I10),\"\",'3. Contracts & 3rd parties '!I10)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J10),\"\",'3. Contracts & 3rd parties '!J10)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.3","\tReview the use of the AI system or information against existing systems, products or services to ensure that it does not impact on the accuracy of outputs in deployment.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E11),\"\",'3. Contracts & 3rd parties '!E11)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F11),\"\",'3. Contracts & 3rd parties '!F11)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G11),\"\",'3. Contracts & 3rd parties '!G11)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H11),\"\",'3. Contracts & 3rd parties '!H11)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I11),\"\",'3. Contracts & 3rd parties '!I11)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J11),\"\",'3. Contracts & 3rd parties '!J11)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.4","\tInclude accuracy-based key performance indicators (KPIs) or SLAs in written contracts with third-party suppliers.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E12),\"\",'3. Contracts & 3rd parties '!E12)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F12),\"\",'3. Contracts & 3rd parties '!F12)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G12),\"\",'3. Contracts & 3rd parties '!G12)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H12),\"\",'3. Contracts & 3rd parties '!H12)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I12),\"\",'3. Contracts & 3rd parties '!I12)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J12),\"\",'3. Contracts & 3rd parties '!J12)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.5","\tComplete due diligence to understand the level of bias and discrimination that can be expected from the AI system and do not procure the services or datasets if bias or discrimination cannot be mitigated.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E13),\"\",'3. Contracts & 3rd parties '!E13)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F13),\"\",'3. Contracts & 3rd parties '!F13)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G13),\"\",'3. Contracts & 3rd parties '!G13)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H13),\"\",'3. Contracts & 3rd parties '!H13)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I13),\"\",'3. Contracts & 3rd parties '!I13)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J13),\"\",'3. Contracts & 3rd parties '!J13)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.6","\tChoose AI models that offer transparency and explainability. This allows all parties to understand how the model makes decisions, making it easier to identify and address potential biases.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E14),\"\",'3. Contracts & 3rd parties '!E14)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F14),\"\",'3. Contracts & 3rd parties '!F14)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G14),\"\",'3. Contracts & 3rd parties '!G14)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H14),\"\",'3. Contracts & 3rd parties '!H14)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I14),\"\",'3. Contracts & 3rd parties '!I14)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J14),\"\",'3. Contracts & 3rd parties '!J14)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.7","\tConduct an independent evaluation of any trade-offs as part of the due diligence process.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E15),\"\",'3. Contracts & 3rd parties '!E15)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F15),\"\",'3. Contracts & 3rd parties '!F15)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G15),\"\",'3. Contracts & 3rd parties '!G15)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H15),\"\",'3. Contracts & 3rd parties '!H15)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I15),\"\",'3. Contracts & 3rd parties '!I15)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J15),\"\",'3. Contracts & 3rd parties '!J15)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.8","\tDetermine what would be the reasonable timeline to re-evaluate the accuracy of the system and ask the third party to re-train the AI models if required (ie AI systems may need updating with new information to maintain their accuracy especially when the trends in information are changing).",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E16),\"\",'3. Contracts & 3rd parties '!E16)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F16),\"\",'3. Contracts & 3rd parties '!F16)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G16),\"\",'3. Contracts & 3rd parties '!G16)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H16),\"\",'3. Contracts & 3rd parties '!H16)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I16),\"\",'3. Contracts & 3rd parties '!I16)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J16),\"\",'3. Contracts & 3rd parties '!J16)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.9","\tEngage independent third-party organisations or experts to conduct audits on your AI system. ",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E17),\"\",'3. Contracts & 3rd parties '!E17)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F17),\"\",'3. Contracts & 3rd parties '!F17)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G17),\"\",'3. Contracts & 3rd parties '!G17)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H17),\"\",'3. Contracts & 3rd parties '!H17)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I17),\"\",'3. Contracts & 3rd parties '!I17)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J17),\"\",'3. Contracts & 3rd parties '!J17)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.10","\tRequest comprehensive documentation from the model developer, including information on the training process, feature selection, hyperparameter tuning, and any constraints imposed on the model",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E18),\"\",'3. Contracts & 3rd parties '!E18)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F18),\"\",'3. Contracts & 3rd parties '!F18)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G18),\"\",'3. Contracts & 3rd parties '!G18)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H18),\"\",'3. Contracts & 3rd parties '!H18)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I18),\"\",'3. Contracts & 3rd parties '!I18)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J18),\"\",'3. Contracts & 3rd parties '!J18)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.11","\tObtain evidence of fairness assessments conducted during the model development. This may include fairness metrics, demographic parity analysis, and other techniques used to evaluate and address biases.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E19),\"\",'3. Contracts & 3rd parties '!E19)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F19),\"\",'3. Contracts & 3rd parties '!F19)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G19),\"\",'3. Contracts & 3rd parties '!G19)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H19),\"\",'3. Contracts & 3rd parties '!H19)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I19),\"\",'3. Contracts & 3rd parties '!I19)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J19),\"\",'3. Contracts & 3rd parties '!J19)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.12","\tEvaluate reports or documentation on model explainability. Understand how the model's decisions can be interpreted and how the system addresses the trade-off between complexity and interpretability. You should receive clear explanations about  complex or black box models from the provider.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E20),\"\",'3. Contracts & 3rd parties '!E20)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F20),\"\",'3. Contracts & 3rd parties '!F20)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G20),\"\",'3. Contracts & 3rd parties '!G20)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H20),\"\",'3. Contracts & 3rd parties '!H20)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I20),\"\",'3. Contracts & 3rd parties '!I20)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J20),\"\",'3. Contracts & 3rd parties '!J20)","v":""}]
["Contracts and third parties",3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.13","\tAsk for evidence of user testing and feedback to understand how different user groups experienced the system, and whether trade-offs had a disparate impact on certain user categories. ",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E21),\"\",'3. Contracts & 3rd parties '!E21)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F21),\"\",'3. Contracts & 3rd parties '!F21)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G21),\"\",'3. Contracts & 3rd parties '!G21)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H21),\"\",'3. Contracts & 3rd parties '!H21)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I21),\"\",'3. Contracts & 3rd parties '!I21)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J21),\"\",'3. Contracts & 3rd parties '!J21)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.1","\tIdentify the distinct sets of processing operations and their purposes in order to understand the relationship.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E22),\"\",'3. Contracts & 3rd parties '!E22)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F22),\"\",'3. Contracts & 3rd parties '!F22)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G22),\"\",'3. Contracts & 3rd parties '!G22)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H22),\"\",'3. Contracts & 3rd parties '!H22)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I22),\"\",'3. Contracts & 3rd parties '!I22)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J22),\"\",'3. Contracts & 3rd parties '!J22)","v":""}]
["Contracts and third parties",{"$f":"B119","v":3.3},{"$f":"C119","v":"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing."},"3.3.2","\tEnsure written contracts clearly identify the controller(s) and processor(s) relationships and their specific responsibilities, including who decides the purposes and means of the processing in practice.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E23),\"\",'3. Contracts & 3rd parties '!E23)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F23),\"\",'3. Contracts & 3rd parties '!F23)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G23),\"\",'3. Contracts & 3rd parties '!G23)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H23),\"\",'3. Contracts & 3rd parties '!H23)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I23),\"\",'3. Contracts & 3rd parties '!I23)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J23),\"\",'3. Contracts & 3rd parties '!J23)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.3","\tInclude clear, specific, and detailed written instructions within contracts that state that the processor must only act on the controller's documented instructions, unless required by law to act without them.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E24),\"\",'3. Contracts & 3rd parties '!E24)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F24),\"\",'3. Contracts & 3rd parties '!F24)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G24),\"\",'3. Contracts & 3rd parties '!G24)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H24),\"\",'3. Contracts & 3rd parties '!H24)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I24),\"\",'3. Contracts & 3rd parties '!I24)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J24),\"\",'3. Contracts & 3rd parties '!J24)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.4","\tObtain senior management approval and ensure contracts are signed and dated by both parties.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E25),\"\",'3. Contracts & 3rd parties '!E25)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F25),\"\",'3. Contracts & 3rd parties '!F25)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G25),\"\",'3. Contracts & 3rd parties '!G25)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H25),\"\",'3. Contracts & 3rd parties '!H25)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I25),\"\",'3. Contracts & 3rd parties '!I25)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J25),\"\",'3. Contracts & 3rd parties '!J25)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.5","\tEnsure there is written authorisation and a contract in place with all sub-processors.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E26),\"\",'3. Contracts & 3rd parties '!E26)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F26),\"\",'3. Contracts & 3rd parties '!F26)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G26),\"\",'3. Contracts & 3rd parties '!G26)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H26),\"\",'3. Contracts & 3rd parties '!H26)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I26),\"\",'3. Contracts & 3rd parties '!I26)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J26),\"\",'3. Contracts & 3rd parties '!J26)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.6","Draft contracts to include comprehensive details of the processing:\n- \tthe subject matter of the processing;\n- \tthe duration of the processing;\n- \tthe nature and purpose of the processing;\n- \tthe type of personal information involved;\n- \tthe categories of people;\n- \tthe controller’s obligations and rights;\n- \tthe decision-making boundaries of each party; and\n- \tthe agreed technical and organisational controls and settings for the AI system.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E27),\"\",'3. Contracts & 3rd parties '!E27)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F27),\"\",'3. Contracts & 3rd parties '!F27)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G27),\"\",'3. Contracts & 3rd parties '!G27)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H27),\"\",'3. Contracts & 3rd parties '!H27)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I27),\"\",'3. Contracts & 3rd parties '!I27)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J27),\"\",'3. Contracts & 3rd parties '!J27)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.7","Include terms or clauses stating that:\n- \tthe processor must only act on the controller’s documented instructions, unless required by law to act without them;\n- \tthe processor must ensure that people processing the information are subject to a duty of confidence;\n- \tthe processor must only engage a sub-processor with the controller’s prior authorisation and under a written contract; and\n- \tthe processor must take appropriate measures to help the controller respond to requests from people to exercise their rights.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E28),\"\",'3. Contracts & 3rd parties '!E28)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F28),\"\",'3. Contracts & 3rd parties '!F28)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G28),\"\",'3. Contracts & 3rd parties '!G28)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H28),\"\",'3. Contracts & 3rd parties '!H28)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I28),\"\",'3. Contracts & 3rd parties '!I28)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J28),\"\",'3. Contracts & 3rd parties '!J28)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.8","Include the technical and organisational security measures the processor will adopt, including: \n- \tencryption; \n- \tminimisation or pseudonymisation; \n- \tresilience of processing systems; and \n- \tbacking up personal information in order to be able to reinstate the system.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E29),\"\",'3. Contracts & 3rd parties '!E29)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F29),\"\",'3. Contracts & 3rd parties '!F29)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G29),\"\",'3. Contracts & 3rd parties '!G29)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H29),\"\",'3. Contracts & 3rd parties '!H29)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I29),\"\",'3. Contracts & 3rd parties '!I29)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J29),\"\",'3. Contracts & 3rd parties '!J29)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.9","\tInclude clauses to instruct processors to delete or return all personal information at the end of the contract, unless the law requires its storage.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E30),\"\",'3. Contracts & 3rd parties '!E30)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F30),\"\",'3. Contracts & 3rd parties '!F30)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G30),\"\",'3. Contracts & 3rd parties '!G30)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H30),\"\",'3. Contracts & 3rd parties '!H30)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I30),\"\",'3. Contracts & 3rd parties '!I30)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J30),\"\",'3. Contracts & 3rd parties '!J30)","v":""}]
["Contracts and third parties",3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.10"," Include clauses to ensure that the processor assists in meeting UK GDPR obligations for the security of processing, the notification of personal data breaches and DPIAs.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E31),\"\",'3. Contracts & 3rd parties '!E31)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F31),\"\",'3. Contracts & 3rd parties '!F31)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G31),\"\",'3. Contracts & 3rd parties '!G31)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H31),\"\",'3. Contracts & 3rd parties '!H31)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I31),\"\",'3. Contracts & 3rd parties '!I31)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J31),\"\",'3. Contracts & 3rd parties '!J31)","v":""}]
["Contracts and third parties",3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.1","\tHave contracts that are timebound and reviewed periodically, and conduct routine in-life compliance checks to ensure they remain up-to-date.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E32),\"\",'3. Contracts & 3rd parties '!E32)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F32),\"\",'3. Contracts & 3rd parties '!F32)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G32),\"\",'3. Contracts & 3rd parties '!G32)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H32),\"\",'3. Contracts & 3rd parties '!H32)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I32),\"\",'3. Contracts & 3rd parties '!I32)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J32),\"\",'3. Contracts & 3rd parties '!J32)","v":""}]
["Contracts and third parties",{"$f":"B129","v":3.4},{"$f":"C129","v":"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements."},"3.4.2","\tDocument a process for managing the ongoing relationship between all parties.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E33),\"\",'3. Contracts & 3rd parties '!E33)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F33),\"\",'3. Contracts & 3rd parties '!F33)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G33),\"\",'3. Contracts & 3rd parties '!G33)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H33),\"\",'3. Contracts & 3rd parties '!H33)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I33),\"\",'3. Contracts & 3rd parties '!I33)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J33),\"\",'3. Contracts & 3rd parties '!J33)","v":""}]
["Contracts and third parties",3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.3","\tReview the practical day-to-day management of the AI system to provide assurance that the agreed roles and responsibilities are fulfilled and there are no discrepancies or role creep.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E34),\"\",'3. Contracts & 3rd parties '!E34)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F34),\"\",'3. Contracts & 3rd parties '!F34)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G34),\"\",'3. Contracts & 3rd parties '!G34)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H34),\"\",'3. Contracts & 3rd parties '!H34)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I34),\"\",'3. Contracts & 3rd parties '!I34)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J34),\"\",'3. Contracts & 3rd parties '!J34)","v":""}]
["Contracts and third parties",3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.4","\tIf role or responsibility creep has occurred, undertake an assessment of existing agreements and implement changes to contracts, as appropriate.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E35),\"\",'3. Contracts & 3rd parties '!E35)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F35),\"\",'3. Contracts & 3rd parties '!F35)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G35),\"\",'3. Contracts & 3rd parties '!G35)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H35),\"\",'3. Contracts & 3rd parties '!H35)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I35),\"\",'3. Contracts & 3rd parties '!I35)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J35),\"\",'3. Contracts & 3rd parties '!J35)","v":""}]
["Contracts and third parties",3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.5","\tInclude clauses within contracts to allow audits or checks to confirm all parties are complying with all contract terms and conditions.",{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!E36),\"\",'3. Contracts & 3rd parties '!E36)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!F36),\"\",'3. Contracts & 3rd parties '!F36)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!G36),\"\",'3. Contracts & 3rd parties '!G36)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!H36),\"\",'3. Contracts & 3rd parties '!H36)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!I36),\"\",'3. Contracts & 3rd parties '!I36)","v":""},{"$f":"IF(ISBLANK('3. Contracts & 3rd parties '!J36),\"\",'3. Contracts & 3rd parties '!J36)","v":""}]
["Data minimisation",4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.1"," Assess the features used to train the AI system are adequate, relevant and limited for the purpose. Ensure the system is designed so that only that information is processed.",{"$f":"IF(ISBLANK('4. Data minimisation'!E2),\"\",'4. Data minimisation'!E2)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F2),\"\",'4. Data minimisation'!F2)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G2),\"\",'4. Data minimisation'!G2)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H2),\"\",'4. Data minimisation'!H2)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I2),\"\",'4. Data minimisation'!I2)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J2),\"\",'4. Data minimisation'!J2)","v":""}]
[{"$f":"A134","v":"Data minimisation"},{"$f":"B134","v":4.0999999999999996},{"$f":"C134","v":"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted."},"4.1.2","Consider applying privacy-preserving techniques, such as differential privacy, homomorphic encryption, or federated learning, where resource allows. These techniques allow the AI model to be trained on decentralised information sources without exposing raw, sensitive information.",{"$f":"IF(ISBLANK('4. Data minimisation'!E3),\"\",'4. Data minimisation'!E3)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F3),\"\",'4. Data minimisation'!F3)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G3),\"\",'4. Data minimisation'!G3)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H3),\"\",'4. Data minimisation'!H3)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I3),\"\",'4. Data minimisation'!I3)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J3),\"\",'4. Data minimisation'!J3)","v":""}]
["Data minimisation",4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.3","Ensure the training data can be modified to reduce the extent it can be traced back to specific people.",{"$f":"IF(ISBLANK('4. Data minimisation'!E4),\"\",'4. Data minimisation'!E4)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F4),\"\",'4. Data minimisation'!F4)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G4),\"\",'4. Data minimisation'!G4)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H4),\"\",'4. Data minimisation'!H4)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I4),\"\",'4. Data minimisation'!I4)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J4),\"\",'4. Data minimisation'!J4)","v":""}]
["Data minimisation",4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.4","Include specific review phases in development plans to check information is minimised and not retained when no longer needed.",{"$f":"IF(ISBLANK('4. Data minimisation'!E5),\"\",'4. Data minimisation'!E5)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F5),\"\",'4. Data minimisation'!F5)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G5),\"\",'4. Data minimisation'!G5)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H5),\"\",'4. Data minimisation'!H5)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I5),\"\",'4. Data minimisation'!I5)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J5),\"\",'4. Data minimisation'!J5)","v":""}]
["Data minimisation",4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.5"," Include a justification in the DPIA for retaining information, where applicable.",{"$f":"IF(ISBLANK('4. Data minimisation'!E6),\"\",'4. Data minimisation'!E6)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F6),\"\",'4. Data minimisation'!F6)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G6),\"\",'4. Data minimisation'!G6)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H6),\"\",'4. Data minimisation'!H6)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I6),\"\",'4. Data minimisation'!I6)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J6),\"\",'4. Data minimisation'!J6)","v":""}]
["Data minimisation",4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.6","Confirm that inadequate and irrelevant information is removed or deleted during the system development phase.",{"$f":"IF(ISBLANK('4. Data minimisation'!E7),\"\",'4. Data minimisation'!E7)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F7),\"\",'4. Data minimisation'!F7)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G7),\"\",'4. Data minimisation'!G7)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H7),\"\",'4. Data minimisation'!H7)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I7),\"\",'4. Data minimisation'!I7)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J7),\"\",'4. Data minimisation'!J7)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.1","Standardise the checks required in a checklist or test plan which includes:\n- \ta check of the current features within the system;\n- \ta review of retention of information; and \n- \tpotential further minimisation of information used.",{"$f":"IF(ISBLANK('4. Data minimisation'!E8),\"\",'4. Data minimisation'!E8)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F8),\"\",'4. Data minimisation'!F8)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G8),\"\",'4. Data minimisation'!G8)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H8),\"\",'4. Data minimisation'!H8)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I8),\"\",'4. Data minimisation'!I8)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J8),\"\",'4. Data minimisation'!J8)","v":""}]
["Data minimisation",{"$f":"B140","v":4.2},{"$f":"C140","v":"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. "},"4.2.2","Assess whether: \n- \tall the information is needed (eg would the whole address or just the postcode produce the same result); and \n- \tthe same volume of information is required (or whether the same results can be achieved with less volume).",{"$f":"IF(ISBLANK('4. Data minimisation'!E9),\"\",'4. Data minimisation'!E9)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F9),\"\",'4. Data minimisation'!F9)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G9),\"\",'4. Data minimisation'!G9)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H9),\"\",'4. Data minimisation'!H9)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I9),\"\",'4. Data minimisation'!I9)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J9),\"\",'4. Data minimisation'!J9)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.3"," Consider document 'cropping' or redaction for both collection and sharing purposes.",{"$f":"IF(ISBLANK('4. Data minimisation'!E10),\"\",'4. Data minimisation'!E10)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F10),\"\",'4. Data minimisation'!F10)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G10),\"\",'4. Data minimisation'!G10)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H10),\"\",'4. Data minimisation'!H10)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I10),\"\",'4. Data minimisation'!I10)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J10),\"\",'4. Data minimisation'!J10)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.4","Map out all the processes in the different phases of your AI system that personal information is used in.",{"$f":"IF(ISBLANK('4. Data minimisation'!E11),\"\",'4. Data minimisation'!E11)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F11),\"\",'4. Data minimisation'!F11)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G11),\"\",'4. Data minimisation'!G11)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H11),\"\",'4. Data minimisation'!H11)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I11),\"\",'4. Data minimisation'!I11)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J11),\"\",'4. Data minimisation'!J11)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.5","Ensure the mapping, and then subsequent assessment for the potential minimisation of information, includes information used in the production of the system. Then retrain the system  as part of ongoing research.",{"$f":"IF(ISBLANK('4. Data minimisation'!E12),\"\",'4. Data minimisation'!E12)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F12),\"\",'4. Data minimisation'!F12)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G12),\"\",'4. Data minimisation'!G12)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H12),\"\",'4. Data minimisation'!H12)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I12),\"\",'4. Data minimisation'!I12)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J12),\"\",'4. Data minimisation'!J12)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.6","Index the personal information used in each phase of the AI system lifecycle.",{"$f":"IF(ISBLANK('4. Data minimisation'!E13),\"\",'4. Data minimisation'!E13)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F13),\"\",'4. Data minimisation'!F13)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G13),\"\",'4. Data minimisation'!G13)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H13),\"\",'4. Data minimisation'!H13)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I13),\"\",'4. Data minimisation'!I13)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J13),\"\",'4. Data minimisation'!J13)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.7","Implement automated data tracing to track the information processed across the whole system.",{"$f":"IF(ISBLANK('4. Data minimisation'!E14),\"\",'4. Data minimisation'!E14)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F14),\"\",'4. Data minimisation'!F14)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G14),\"\",'4. Data minimisation'!G14)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H14),\"\",'4. Data minimisation'!H14)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I14),\"\",'4. Data minimisation'!I14)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J14),\"\",'4. Data minimisation'!J14)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.8","Have measures to detect any duplicated information present in different phases (from production to research) and delete where necessary.",{"$f":"IF(ISBLANK('4. Data minimisation'!E15),\"\",'4. Data minimisation'!E15)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F15),\"\",'4. Data minimisation'!F15)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G15),\"\",'4. Data minimisation'!G15)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H15),\"\",'4. Data minimisation'!H15)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I15),\"\",'4. Data minimisation'!I15)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J15),\"\",'4. Data minimisation'!J15)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.9","Implement audit trails that log and track the usage of information throughout the AI system. This includes recording access, modifications, and processing activities. Regularly review and analyse these logs to identify any unnecessary processing.",{"$f":"IF(ISBLANK('4. Data minimisation'!E16),\"\",'4. Data minimisation'!E16)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F16),\"\",'4. Data minimisation'!F16)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G16),\"\",'4. Data minimisation'!G16)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H16),\"\",'4. Data minimisation'!H16)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I16),\"\",'4. Data minimisation'!I16)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J16),\"\",'4. Data minimisation'!J16)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.10","Implement data masking or anonymisation techniques to replace or obscure personally identifiable information and other sensitive information. This ensures that only necessary information is visible to the AI system while preserving privacy.",{"$f":"IF(ISBLANK('4. Data minimisation'!E17),\"\",'4. Data minimisation'!E17)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F17),\"\",'4. Data minimisation'!F17)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G17),\"\",'4. Data minimisation'!G17)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H17),\"\",'4. Data minimisation'!H17)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I17),\"\",'4. Data minimisation'!I17)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J17),\"\",'4. Data minimisation'!J17)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.11","Integrate automated information validation checks to verify the integrity and quality of incoming information. This helps identify and filter out irrelevant or erroneous information, ensuring that only accurate and relevant information is processed.",{"$f":"IF(ISBLANK('4. Data minimisation'!E18),\"\",'4. Data minimisation'!E18)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F18),\"\",'4. Data minimisation'!F18)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G18),\"\",'4. Data minimisation'!G18)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H18),\"\",'4. Data minimisation'!H18)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I18),\"\",'4. Data minimisation'!I18)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J18),\"\",'4. Data minimisation'!J18)","v":""}]
["Data minimisation",4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.12","Deploy continuous monitoring tools that assess the AI system's compliance with information use policies. These tools can trigger alerts or notifications when deviations from established processing norms are detected.",{"$f":"IF(ISBLANK('4. Data minimisation'!E19),\"\",'4. Data minimisation'!E19)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F19),\"\",'4. Data minimisation'!F19)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G19),\"\",'4. Data minimisation'!G19)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H19),\"\",'4. Data minimisation'!H19)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I19),\"\",'4. Data minimisation'!I19)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J19),\"\",'4. Data minimisation'!J19)","v":""}]
["Data minimisation",4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.1"," Apply classification to personal information based on its sensitivity and set the corresponding retention periods for each category.",{"$f":"IF(ISBLANK('4. Data minimisation'!E20),\"\",'4. Data minimisation'!E20)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F20),\"\",'4. Data minimisation'!F20)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G20),\"\",'4. Data minimisation'!G20)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H20),\"\",'4. Data minimisation'!H20)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I20),\"\",'4. Data minimisation'!I20)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J20),\"\",'4. Data minimisation'!J20)","v":""}]
["Data minimisation",{"$f":"B152","v":4.3},{"$f":"C152","v":"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved)."},"4.3.2","Document the retention schedule based on business need,  statutory requirements and other principles. ",{"$f":"IF(ISBLANK('4. Data minimisation'!E21),\"\",'4. Data minimisation'!E21)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F21),\"\",'4. Data minimisation'!F21)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G21),\"\",'4. Data minimisation'!G21)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H21),\"\",'4. Data minimisation'!H21)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I21),\"\",'4. Data minimisation'!I21)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J21),\"\",'4. Data minimisation'!J21)","v":""}]
["Data minimisation",4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.3"," Provide sufficient information in the schedule to allow you to identify all records and put disposal decisions in to effect.",{"$f":"IF(ISBLANK('4. Data minimisation'!E22),\"\",'4. Data minimisation'!E22)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F22),\"\",'4. Data minimisation'!F22)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G22),\"\",'4. Data minimisation'!G22)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H22),\"\",'4. Data minimisation'!H22)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I22),\"\",'4. Data minimisation'!I22)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J22),\"\",'4. Data minimisation'!J22)","v":""}]
["Data minimisation",4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.4","Standardise and document planned weeding activities and ensure they occur on an ongoing or regular basis (eg a process of rolling deletion of information).",{"$f":"IF(ISBLANK('4. Data minimisation'!E23),\"\",'4. Data minimisation'!E23)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F23),\"\",'4. Data minimisation'!F23)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G23),\"\",'4. Data minimisation'!G23)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H23),\"\",'4. Data minimisation'!H23)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I23),\"\",'4. Data minimisation'!I23)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J23),\"\",'4. Data minimisation'!J23)","v":""}]
["Data minimisation",4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.5","Delete or destroy all personal information held within AI systems in line with the retention schedule. If it is not possible to permanently delete the information (due to system functionality restrictions), store it securely 'out of reach' and lock down access, or anonymise it.",{"$f":"IF(ISBLANK('4. Data minimisation'!E24),\"\",'4. Data minimisation'!E24)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F24),\"\",'4. Data minimisation'!F24)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G24),\"\",'4. Data minimisation'!G24)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H24),\"\",'4. Data minimisation'!H24)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I24),\"\",'4. Data minimisation'!I24)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J24),\"\",'4. Data minimisation'!J24)","v":""}]
["Data minimisation",4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.6","Remove or erase training data that is no longer required (eg because it is out of date and no longer predictively useful).",{"$f":"IF(ISBLANK('4. Data minimisation'!E25),\"\",'4. Data minimisation'!E25)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F25),\"\",'4. Data minimisation'!F25)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G25),\"\",'4. Data minimisation'!G25)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H25),\"\",'4. Data minimisation'!H25)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I25),\"\",'4. Data minimisation'!I25)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J25),\"\",'4. Data minimisation'!J25)","v":""}]
["Data minimisation",4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.7","Document the justification for any decision to keep personal information outside the retention period. ",{"$f":"IF(ISBLANK('4. Data minimisation'!E26),\"\",'4. Data minimisation'!E26)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F26),\"\",'4. Data minimisation'!F26)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G26),\"\",'4. Data minimisation'!G26)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H26),\"\",'4. Data minimisation'!H26)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I26),\"\",'4. Data minimisation'!I26)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J26),\"\",'4. Data minimisation'!J26)","v":""}]
["Data minimisation",4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.8"," Consider reproducibility (ie being able to reproduce the results at a later time, but being unable to do so as the original information has been deleted).",{"$f":"IF(ISBLANK('4. Data minimisation'!E27),\"\",'4. Data minimisation'!E27)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!F27),\"\",'4. Data minimisation'!F27)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!G27),\"\",'4. Data minimisation'!G27)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!H27),\"\",'4. Data minimisation'!H27)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!I27),\"\",'4. Data minimisation'!I27)","v":""},{"$f":"IF(ISBLANK('4. Data minimisation'!J27),\"\",'4. Data minimisation'!J27)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.1","Include a thorough assessment of the security risks in your DPIA and the mitigating controls to reduce the likelihood and impact of an attack or breach.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E2),\"\",'5. Info security & integrity'!E2)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F2),\"\",'5. Info security & integrity'!F2)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G2),\"\",'5. Info security & integrity'!G2)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H2),\"\",'5. Info security & integrity'!H2)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I2),\"\",'5. Info security & integrity'!I2)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J2),\"\",'5. Info security & integrity'!J2)","v":""}]
[{"$f":"A160","v":"Information security and integrity"},{"$f":"B160","v":5.0999999999999996},{"$f":"C160","v":"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach."},"5.1.2","Implement technical controls to mitigate any security risks in the system design and build phases, where appropriate.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E3),\"\",'5. Info security & integrity'!E3)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F3),\"\",'5. Info security & integrity'!F3)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G3),\"\",'5. Info security & integrity'!G3)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H3),\"\",'5. Info security & integrity'!H3)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I3),\"\",'5. Info security & integrity'!I3)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J3),\"\",'5. Info security & integrity'!J3)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.3","Consult with skilled technical experts as part of the risk assessment (eg traditional software engineers, systems administrators, data scientists, statisticians, as well as domain experts).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E4),\"\",'5. Info security & integrity'!E4)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F4),\"\",'5. Info security & integrity'!F4)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G4),\"\",'5. Info security & integrity'!G4)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H4),\"\",'5. Info security & integrity'!H4)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I4),\"\",'5. Info security & integrity'!I4)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J4),\"\",'5. Info security & integrity'!J4)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.4","Commission regular external security audits.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E5),\"\",'5. Info security & integrity'!E5)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F5),\"\",'5. Info security & integrity'!F5)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G5),\"\",'5. Info security & integrity'!G5)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H5),\"\",'5. Info security & integrity'!H5)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I5),\"\",'5. Info security & integrity'!I5)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J5),\"\",'5. Info security & integrity'!J5)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.5","Assess security risks specific to AI models (eg data poisoning, model inversion, data leakage and model theft).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E6),\"\",'5. Info security & integrity'!E6)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F6),\"\",'5. Info security & integrity'!F6)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G6),\"\",'5. Info security & integrity'!G6)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H6),\"\",'5. Info security & integrity'!H6)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I6),\"\",'5. Info security & integrity'!I6)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J6),\"\",'5. Info security & integrity'!J6)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.6","Conduct comprehensive vulnerability assessments of the AI system's architecture, components and dependencies to identify potential security weaknesses and entry points for attackers. This involves scanning for known vulnerabilities, misconfigurations and outdated software versions.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E7),\"\",'5. Info security & integrity'!E7)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F7),\"\",'5. Info security & integrity'!F7)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G7),\"\",'5. Info security & integrity'!G7)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H7),\"\",'5. Info security & integrity'!H7)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I7),\"\",'5. Info security & integrity'!I7)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J7),\"\",'5. Info security & integrity'!J7)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.7"," Perform penetration testing to simulate real-world attacks and assess the system's resilience to various threat scenarios. This includes conducting controlled attacks to identify potential security flaws, vulnerabilities and exploitation vectors that could be leveraged by attackers.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E8),\"\",'5. Info security & integrity'!E8)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F8),\"\",'5. Info security & integrity'!F8)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G8),\"\",'5. Info security & integrity'!G8)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H8),\"\",'5. Info security & integrity'!H8)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I8),\"\",'5. Info security & integrity'!I8)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J8),\"\",'5. Info security & integrity'!J8)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.8","Conduct code reviews and static analysis of the AI system's source code to identify security vulnerabilities, coding errors, and logic flaws that may introduce security risks. This involves reviewing code for common security issues such as injection flaws, authentication bypass and data exposure.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E9),\"\",'5. Info security & integrity'!E9)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F9),\"\",'5. Info security & integrity'!F9)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G9),\"\",'5. Info security & integrity'!G9)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H9),\"\",'5. Info security & integrity'!H9)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I9),\"\",'5. Info security & integrity'!I9)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J9),\"\",'5. Info security & integrity'!J9)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.9"," Review the AI system's security architecture and design to ensure that security controls are appropriately implemented and aligned with security best practices and industry standards. This includes assessing the effectiveness of access controls, encryption mechanisms and authentication mechanisms.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E10),\"\",'5. Info security & integrity'!E10)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F10),\"\",'5. Info security & integrity'!F10)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G10),\"\",'5. Info security & integrity'!G10)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H10),\"\",'5. Info security & integrity'!H10)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I10),\"\",'5. Info security & integrity'!I10)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J10),\"\",'5. Info security & integrity'!J10)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.10"," Implement secure configuration management practices to ensure that the AI system is configured according to security best practices and hardened against potential attacks. This involves applying security configurations, disabling unnecessary services and limiting privileged access.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E11),\"\",'5. Info security & integrity'!E11)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F11),\"\",'5. Info security & integrity'!F11)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G11),\"\",'5. Info security & integrity'!G11)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H11),\"\",'5. Info security & integrity'!H11)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I11),\"\",'5. Info security & integrity'!I11)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J11),\"\",'5. Info security & integrity'!J11)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.11"," Complete threat modelling exercises to identify potential threats and attack vectors that could compromise the security of the AI system. This involves analysing system components, information flows and trust boundaries to identify potential security risks and prioritise mitigation efforts.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E12),\"\",'5. Info security & integrity'!E12)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F12),\"\",'5. Info security & integrity'!F12)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G12),\"\",'5. Info security & integrity'!G12)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H12),\"\",'5. Info security & integrity'!H12)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I12),\"\",'5. Info security & integrity'!I12)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J12),\"\",'5. Info security & integrity'!J12)","v":""}]
["Information security and integrity",5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.12"," Consider the impact on the security of any connected systems if you need to integrate existing systems, and put appropriate controls in place as part of the design and build phases.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E13),\"\",'5. Info security & integrity'!E13)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F13),\"\",'5. Info security & integrity'!F13)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G13),\"\",'5. Info security & integrity'!G13)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H13),\"\",'5. Info security & integrity'!H13)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I13),\"\",'5. Info security & integrity'!I13)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J13),\"\",'5. Info security & integrity'!J13)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.1"," If processing biometric data (eg facial images), consider how easily an attacker could probe the model and reconstruct the image. Also consider whether it is necessary to provide 'confidence' information to the end user (as this could be used to exploit the system).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E14),\"\",'5. Info security & integrity'!E14)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F14),\"\",'5. Info security & integrity'!F14)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G14),\"\",'5. Info security & integrity'!G14)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H14),\"\",'5. Info security & integrity'!H14)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I14),\"\",'5. Info security & integrity'!I14)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J14),\"\",'5. Info security & integrity'!J14)","v":""}]
["Information security and integrity",{"$f":"B172","v":5.2},{"$f":"C172","v":"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples."},"5.2.2","Check the system to identify possible attacks if a large series of inputs, information or queries are entered into the system by a single source with the aim of identifying or extracting personal information (eg through monitoring queries from people through the API).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E15),\"\",'5. Info security & integrity'!E15)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F15),\"\",'5. Info security & integrity'!F15)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G15),\"\",'5. Info security & integrity'!G15)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H15),\"\",'5. Info security & integrity'!H15)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I15),\"\",'5. Info security & integrity'!I15)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J15),\"\",'5. Info security & integrity'!J15)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.3"," Implement measures to prevent the unauthorised extraction of information from either the main system or training datasets.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E16),\"\",'5. Info security & integrity'!E16)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F16),\"\",'5. Info security & integrity'!F16)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G16),\"\",'5. Info security & integrity'!G16)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H16),\"\",'5. Info security & integrity'!H16)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I16),\"\",'5. Info security & integrity'!I16)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J16),\"\",'5. Info security & integrity'!J16)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.4","Implement measures to reduce the number of queries that can be performed by a particular person in a given time limit (rate limiting).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E17),\"\",'5. Info security & integrity'!E17)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F17),\"\",'5. Info security & integrity'!F17)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G17),\"\",'5. Info security & integrity'!G17)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H17),\"\",'5. Info security & integrity'!H17)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I17),\"\",'5. Info security & integrity'!I17)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J17),\"\",'5. Info security & integrity'!J17)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.5","Apply different measures for black box and white box attacks. (Note: white box attacks are when the attacker has complete access to the model itself to inspect underlying code. Whereas in black box attacks, the attacker can only query the model and observe relationships between inputs and outputs.)",{"$f":"IF(ISBLANK('5. Info security & integrity'!E18),\"\",'5. Info security & integrity'!E18)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F18),\"\",'5. Info security & integrity'!F18)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G18),\"\",'5. Info security & integrity'!G18)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H18),\"\",'5. Info security & integrity'!H18)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I18),\"\",'5. Info security & integrity'!I18)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J18),\"\",'5. Info security & integrity'!J18)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.6","Implement measures to ensure that AI models are not vulnerable to privacy attacks through 'overfitting' (ie the model has been designed to pay too much attention to the details of the training data, remembering particular examples rather than just general patterns).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E19),\"\",'5. Info security & integrity'!E19)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F19),\"\",'5. Info security & integrity'!F19)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G19),\"\",'5. Info security & integrity'!G19)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H19),\"\",'5. Info security & integrity'!H19)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I19),\"\",'5. Info security & integrity'!I19)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J19),\"\",'5. Info security & integrity'!J19)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.7","Implement secure model training techniques to protect against privacy attacks during the training phase. ",{"$f":"IF(ISBLANK('5. Info security & integrity'!E20),\"\",'5. Info security & integrity'!E20)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F20),\"\",'5. Info security & integrity'!F20)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G20),\"\",'5. Info security & integrity'!G20)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H20),\"\",'5. Info security & integrity'!H20)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I20),\"\",'5. Info security & integrity'!I20)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J20),\"\",'5. Info security & integrity'!J20)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.8","Ensure secure deployment of AI models in production environments by implementing secure coding practices. This helps prevent the exploitation of vulnerabilities in deployed models and mitigates the risk of privacy attacks in operational settings.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E21),\"\",'5. Info security & integrity'!E21)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F21),\"\",'5. Info security & integrity'!F21)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G21),\"\",'5. Info security & integrity'!G21)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H21),\"\",'5. Info security & integrity'!H21)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I21),\"\",'5. Info security & integrity'!I21)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J21),\"\",'5. Info security & integrity'!J21)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.9","Restrict access to the underlying code and properties of the system or model.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E22),\"\",'5. Info security & integrity'!E22)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F22),\"\",'5. Info security & integrity'!F22)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G22),\"\",'5. Info security & integrity'!G22)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H22),\"\",'5. Info security & integrity'!H22)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I22),\"\",'5. Info security & integrity'!I22)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J22),\"\",'5. Info security & integrity'!J22)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.10","Closely monitor access to the model or training data by third parties and restrict access as necessary.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E23),\"\",'5. Info security & integrity'!E23)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F23),\"\",'5. Info security & integrity'!F23)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G23),\"\",'5. Info security & integrity'!G23)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H23),\"\",'5. Info security & integrity'!H23)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I23),\"\",'5. Info security & integrity'!I23)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J23),\"\",'5. Info security & integrity'!J23)","v":""}]
["Information security and integrity",5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.11","Assess the trade-off between explainability of the model and the risk of a security breach (ie the more explainable the model, the greater the risk of model inversion and membership inference attacks).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E24),\"\",'5. Info security & integrity'!E24)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F24),\"\",'5. Info security & integrity'!F24)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G24),\"\",'5. Info security & integrity'!G24)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H24),\"\",'5. Info security & integrity'!H24)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I24),\"\",'5. Info security & integrity'!I24)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J24),\"\",'5. Info security & integrity'!J24)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.1","If you make changes to a software stack (and possibly hardware), review if there are any new security risks.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E25),\"\",'5. Info security & integrity'!E25)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F25),\"\",'5. Info security & integrity'!F25)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G25),\"\",'5. Info security & integrity'!G25)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H25),\"\",'5. Info security & integrity'!H25)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I25),\"\",'5. Info security & integrity'!I25)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J25),\"\",'5. Info security & integrity'!J25)","v":""}]
["Information security and integrity",{"$f":"B183","v":5.3},{"$f":"C183","v":"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate."},"5.3.2"," Document technical security controls within system operating procedures.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E26),\"\",'5. Info security & integrity'!E26)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F26),\"\",'5. Info security & integrity'!F26)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G26),\"\",'5. Info security & integrity'!G26)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H26),\"\",'5. Info security & integrity'!H26)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I26),\"\",'5. Info security & integrity'!I26)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J26),\"\",'5. Info security & integrity'!J26)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.3","Subject the software to a security review where one or more people view and read parts of its source code. At least one of the reviewers must not be the author of the code.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E27),\"\",'5. Info security & integrity'!E27)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F27),\"\",'5. Info security & integrity'!F27)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G27),\"\",'5. Info security & integrity'!G27)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H27),\"\",'5. Info security & integrity'!H27)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I27),\"\",'5. Info security & integrity'!I27)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J27),\"\",'5. Info security & integrity'!J27)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.4","Implement appropriate system vulnerability monitoring and testing tools or software.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E28),\"\",'5. Info security & integrity'!E28)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F28),\"\",'5. Info security & integrity'!F28)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G28),\"\",'5. Info security & integrity'!G28)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H28),\"\",'5. Info security & integrity'!H28)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I28),\"\",'5. Info security & integrity'!I28)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J28),\"\",'5. Info security & integrity'!J28)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.5","Log the outputs of system vulnerability monitoring and conduct proactive analysis on any anomalies.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E29),\"\",'5. Info security & integrity'!E29)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F29),\"\",'5. Info security & integrity'!F29)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G29),\"\",'5. Info security & integrity'!G29)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H29),\"\",'5. Info security & integrity'!H29)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I29),\"\",'5. Info security & integrity'!I29)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J29),\"\",'5. Info security & integrity'!J29)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.6"," Ensure there is a solid patching and updating process in place so that available security fixes are applied in a timely manner.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E30),\"\",'5. Info security & integrity'!E30)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F30),\"\",'5. Info security & integrity'!F30)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G30),\"\",'5. Info security & integrity'!G30)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H30),\"\",'5. Info security & integrity'!H30)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I30),\"\",'5. Info security & integrity'!I30)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J30),\"\",'5. Info security & integrity'!J30)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.7","Undertake independent internal reviews of the information security management system, including internal audits and internal IT health checks (ITHC). ",{"$f":"IF(ISBLANK('5. Info security & integrity'!E31),\"\",'5. Info security & integrity'!E31)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F31),\"\",'5. Info security & integrity'!F31)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G31),\"\",'5. Info security & integrity'!G31)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H31),\"\",'5. Info security & integrity'!H31)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I31),\"\",'5. Info security & integrity'!I31)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J31),\"\",'5. Info security & integrity'!J31)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.8","  Commission external technical compliance reviews of key systems, including vulnerability assessments, internal health checks and penetration testing.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E32),\"\",'5. Info security & integrity'!E32)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F32),\"\",'5. Info security & integrity'!F32)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G32),\"\",'5. Info security & integrity'!G32)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H32),\"\",'5. Info security & integrity'!H32)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I32),\"\",'5. Info security & integrity'!I32)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J32),\"\",'5. Info security & integrity'!J32)","v":""}]
["Information security and integrity",5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.9","Capture all issues and risks identified as part of any internal or external testing on an action plan and risk register and mitigate or treat, as appropriate.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E33),\"\",'5. Info security & integrity'!E33)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F33),\"\",'5. Info security & integrity'!F33)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G33),\"\",'5. Info security & integrity'!G33)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H33),\"\",'5. Info security & integrity'!H33)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I33),\"\",'5. Info security & integrity'!I33)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J33),\"\",'5. Info security & integrity'!J33)","v":""}]
["Information security and integrity",5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.1","Detail how the AI development system is segregated from the main IT network in policy.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E34),\"\",'5. Info security & integrity'!E34)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F34),\"\",'5. Info security & integrity'!F34)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G34),\"\",'5. Info security & integrity'!G34)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H34),\"\",'5. Info security & integrity'!H34)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I34),\"\",'5. Info security & integrity'!I34)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J34),\"\",'5. Info security & integrity'!J34)","v":""}]
[{"$f":"A192","v":"Information security and integrity"},{"$f":"B192","v":5.4},{"$f":"C192","v":"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to."},"5.4.2","Include separation plans in the system design documents.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E35),\"\",'5. Info security & integrity'!E35)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F35),\"\",'5. Info security & integrity'!F35)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G35),\"\",'5. Info security & integrity'!G35)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H35),\"\",'5. Info security & integrity'!H35)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I35),\"\",'5. Info security & integrity'!I35)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J35),\"\",'5. Info security & integrity'!J35)","v":""}]
["Information security and integrity",5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.3","Keep the AI system in a suitably secure environment.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E36),\"\",'5. Info security & integrity'!E36)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F36),\"\",'5. Info security & integrity'!F36)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G36),\"\",'5. Info security & integrity'!G36)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H36),\"\",'5. Info security & integrity'!H36)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I36),\"\",'5. Info security & integrity'!I36)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J36),\"\",'5. Info security & integrity'!J36)","v":""}]
["Information security and integrity",5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.4","Isolate the AI development environment from the production network and other critical infrastructure by network segmentation, physically or logically. This involves creating separate network zones, subnets, or VLANs for development activities, with restricted access controls and firewall rules to prevent unauthorised communication between environments.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E37),\"\",'5. Info security & integrity'!E37)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F37),\"\",'5. Info security & integrity'!F37)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G37),\"\",'5. Info security & integrity'!G37)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H37),\"\",'5. Info security & integrity'!H37)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I37),\"\",'5. Info security & integrity'!I37)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J37),\"\",'5. Info security & integrity'!J37)","v":""}]
["Information security and integrity",5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.5","Create isolated development environments that are independent of the production infrastructure, using virtualisation or containerisation technologies. ",{"$f":"IF(ISBLANK('5. Info security & integrity'!E38),\"\",'5. Info security & integrity'!E38)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F38),\"\",'5. Info security & integrity'!F38)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G38),\"\",'5. Info security & integrity'!G38)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H38),\"\",'5. Info security & integrity'!H38)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I38),\"\",'5. Info security & integrity'!I38)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J38),\"\",'5. Info security & integrity'!J38)","v":""}]
["Information security and integrity",5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.6","Maintain a back up of the AI system in case the main AI system becomes unavailable. Keep the back up in a separate location.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E39),\"\",'5. Info security & integrity'!E39)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F39),\"\",'5. Info security & integrity'!F39)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G39),\"\",'5. Info security & integrity'!G39)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H39),\"\",'5. Info security & integrity'!H39)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I39),\"\",'5. Info security & integrity'!I39)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J39),\"\",'5. Info security & integrity'!J39)","v":""}]
["Information security and integrity",5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.1","Undertake active monitoring of API requests for suspicious activity.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E40),\"\",'5. Info security & integrity'!E40)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F40),\"\",'5. Info security & integrity'!F40)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G40),\"\",'5. Info security & integrity'!G40)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H40),\"\",'5. Info security & integrity'!H40)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I40),\"\",'5. Info security & integrity'!I40)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J40),\"\",'5. Info security & integrity'!J40)","v":""}]
["Information security and integrity",{"$f":"B198","v":5.5},{"$f":"C198","v":"There is active monitoring of network activity to detect suspicious requests and take action as a result."},"5.5.2","Log, investigate and escalate all issues detected, where necessary.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E41),\"\",'5. Info security & integrity'!E41)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F41),\"\",'5. Info security & integrity'!F41)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G41),\"\",'5. Info security & integrity'!G41)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H41),\"\",'5. Info security & integrity'!H41)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I41),\"\",'5. Info security & integrity'!I41)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J41),\"\",'5. Info security & integrity'!J41)","v":""}]
["Information security and integrity",5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.3","Deploy external and internal firewalls and intrusion detection systems to strengthen the security of information in your networks and systems and prevent unauthorised access or attack (eg denial of service (DOS) attacks).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E42),\"\",'5. Info security & integrity'!E42)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F42),\"\",'5. Info security & integrity'!F42)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G42),\"\",'5. Info security & integrity'!G42)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H42),\"\",'5. Info security & integrity'!H42)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I42),\"\",'5. Info security & integrity'!I42)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J42),\"\",'5. Info security & integrity'!J42)","v":""}]
["Information security and integrity",5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.4","Monitor network traffic for unusual or malicious incoming or outgoing activity.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E43),\"\",'5. Info security & integrity'!E43)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F43),\"\",'5. Info security & integrity'!F43)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G43),\"\",'5. Info security & integrity'!G43)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H43),\"\",'5. Info security & integrity'!H43)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I43),\"\",'5. Info security & integrity'!I43)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J43),\"\",'5. Info security & integrity'!J43)","v":""}]
["Information security and integrity",5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.5","Have a response plan ready to manage an attack, minimising disruption to legitimate service users.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E44),\"\",'5. Info security & integrity'!E44)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F44),\"\",'5. Info security & integrity'!F44)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G44),\"\",'5. Info security & integrity'!G44)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H44),\"\",'5. Info security & integrity'!H44)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I44),\"\",'5. Info security & integrity'!I44)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J44),\"\",'5. Info security & integrity'!J44)","v":""}]
["Information security and integrity",5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.6","Have a robust supply chain risk management programme in place and apply a process for monitoring, managing, and reviewing systems, processes and access throughout your supply chain.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E45),\"\",'5. Info security & integrity'!E45)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F45),\"\",'5. Info security & integrity'!F45)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G45),\"\",'5. Info security & integrity'!G45)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H45),\"\",'5. Info security & integrity'!H45)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I45),\"\",'5. Info security & integrity'!I45)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J45),\"\",'5. Info security & integrity'!J45)","v":""}]
["Information security and integrity",5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.7","Avoid digital supply chain attacks by limiting the use of commonly used libraries to enable a function in the AI application.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E46),\"\",'5. Info security & integrity'!E46)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F46),\"\",'5. Info security & integrity'!F46)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G46),\"\",'5. Info security & integrity'!G46)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H46),\"\",'5. Info security & integrity'!H46)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I46),\"\",'5. Info security & integrity'!I46)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J46),\"\",'5. Info security & integrity'!J46)","v":""}]
["Information security and integrity",5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.8","Maintain an awareness of possible threats and act swiftly to implement corrective measures.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E47),\"\",'5. Info security & integrity'!E47)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F47),\"\",'5. Info security & integrity'!F47)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G47),\"\",'5. Info security & integrity'!G47)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H47),\"\",'5. Info security & integrity'!H47)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I47),\"\",'5. Info security & integrity'!I47)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J47),\"\",'5. Info security & integrity'!J47)","v":""}]
["Information security and integrity",5.6,"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering.","5.6.1","Encrypt information across networks, where required.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E48),\"\",'5. Info security & integrity'!E48)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F48),\"\",'5. Info security & integrity'!F48)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G48),\"\",'5. Info security & integrity'!G48)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H48),\"\",'5. Info security & integrity'!H48)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I48),\"\",'5. Info security & integrity'!I48)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J48),\"\",'5. Info security & integrity'!J48)","v":""}]
["Information security and integrity",{"$f":"B206","v":5.6},{"$f":"C206","v":"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering."},"5.6.2","Encrypt information in storage (at rest) in line with risk.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E49),\"\",'5. Info security & integrity'!E49)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F49),\"\",'5. Info security & integrity'!F49)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G49),\"\",'5. Info security & integrity'!G49)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H49),\"\",'5. Info security & integrity'!H49)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I49),\"\",'5. Info security & integrity'!I49)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J49),\"\",'5. Info security & integrity'!J49)","v":""}]
["Information security and integrity",5.6,"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering.","5.6.3","Implement measures to secure information collection sites or web forms from malicious attacks or corruption (or DOS attacks).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E50),\"\",'5. Info security & integrity'!E50)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F50),\"\",'5. Info security & integrity'!F50)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G50),\"\",'5. Info security & integrity'!G50)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H50),\"\",'5. Info security & integrity'!H50)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I50),\"\",'5. Info security & integrity'!I50)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J50),\"\",'5. Info security & integrity'!J50)","v":""}]
["Information security and integrity",5.6,"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering.","5.6.4","Undertake information accuracy and integrity testing on personal information sourced or collected indirectly from third parties as part of the build and testing phases of the system development.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E51),\"\",'5. Info security & integrity'!E51)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F51),\"\",'5. Info security & integrity'!F51)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G51),\"\",'5. Info security & integrity'!G51)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H51),\"\",'5. Info security & integrity'!H51)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I51),\"\",'5. Info security & integrity'!I51)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J51),\"\",'5. Info security & integrity'!J51)","v":""}]
["Information security and integrity",5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.1","Encrypt information across networks, where required.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E52),\"\",'5. Info security & integrity'!E52)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F52),\"\",'5. Info security & integrity'!F52)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G52),\"\",'5. Info security & integrity'!G52)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H52),\"\",'5. Info security & integrity'!H52)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I52),\"\",'5. Info security & integrity'!I52)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J52),\"\",'5. Info security & integrity'!J52)","v":""}]
["Information security and integrity",{"$f":"B210","v":5.7},{"$f":"C210","v":"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets."},"5.7.2","Grant access to the AI system only if there is a legitimate need. ",{"$f":"IF(ISBLANK('5. Info security & integrity'!E53),\"\",'5. Info security & integrity'!E53)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F53),\"\",'5. Info security & integrity'!F53)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G53),\"\",'5. Info security & integrity'!G53)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H53),\"\",'5. Info security & integrity'!H53)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I53),\"\",'5. Info security & integrity'!I53)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J53),\"\",'5. Info security & integrity'!J53)","v":""}]
["Information security and integrity",5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.3","Limit access to personal information to authorised staff only.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E54),\"\",'5. Info security & integrity'!E54)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F54),\"\",'5. Info security & integrity'!F54)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G54),\"\",'5. Info security & integrity'!G54)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H54),\"\",'5. Info security & integrity'!H54)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I54),\"\",'5. Info security & integrity'!I54)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J54),\"\",'5. Info security & integrity'!J54)","v":""}]
["Information security and integrity",5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.4","Implement a formal access provisioning process to assign access rights to staff.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E55),\"\",'5. Info security & integrity'!E55)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F55),\"\",'5. Info security & integrity'!F55)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G55),\"\",'5. Info security & integrity'!G55)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H55),\"\",'5. Info security & integrity'!H55)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I55),\"\",'5. Info security & integrity'!I55)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J55),\"\",'5. Info security & integrity'!J55)","v":""}]
["Information security and integrity",5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.5","Restrict and control the allocation and use of privileged access rights.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E56),\"\",'5. Info security & integrity'!E56)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F56),\"\",'5. Info security & integrity'!F56)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G56),\"\",'5. Info security & integrity'!G56)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H56),\"\",'5. Info security & integrity'!H56)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I56),\"\",'5. Info security & integrity'!I56)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J56),\"\",'5. Info security & integrity'!J56)","v":""}]
["Information security and integrity",5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.6","Review user access rights at regular intervals.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E57),\"\",'5. Info security & integrity'!E57)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F57),\"\",'5. Info security & integrity'!F57)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G57),\"\",'5. Info security & integrity'!G57)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H57),\"\",'5. Info security & integrity'!H57)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I57),\"\",'5. Info security & integrity'!I57)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J57),\"\",'5. Info security & integrity'!J57)","v":""}]
["Information security and integrity",5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.7","Remove access rights in a timely fashion when staff leave your organisation.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E58),\"\",'5. Info security & integrity'!E58)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F58),\"\",'5. Info security & integrity'!F58)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G58),\"\",'5. Info security & integrity'!G58)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H58),\"\",'5. Info security & integrity'!H58)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I58),\"\",'5. Info security & integrity'!I58)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J58),\"\",'5. Info security & integrity'!J58)","v":""}]
["Information security and integrity",5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.8","Adjust access rights when there is a change of assignment or role. ",{"$f":"IF(ISBLANK('5. Info security & integrity'!E59),\"\",'5. Info security & integrity'!E59)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F59),\"\",'5. Info security & integrity'!F59)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G59),\"\",'5. Info security & integrity'!G59)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H59),\"\",'5. Info security & integrity'!H59)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I59),\"\",'5. Info security & integrity'!I59)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J59),\"\",'5. Info security & integrity'!J59)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.1","Allocate responsibility for assessing, managing and reporting on business continuity (BC) and disaster recovery (DR) risks in a structured hierarchy.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E60),\"\",'5. Info security & integrity'!E60)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F60),\"\",'5. Info security & integrity'!F60)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G60),\"\",'5. Info security & integrity'!G60)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H60),\"\",'5. Info security & integrity'!H60)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I60),\"\",'5. Info security & integrity'!I60)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J60),\"\",'5. Info security & integrity'!J60)","v":""}]
["Information security and integrity",{"$f":"B218","v":5.8},{"$f":"C218","v":"There are business continuity and disaster recovery plans in place."},"5.8.2","Take proactive steps to identify, record and manage risks to BC and DR.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E61),\"\",'5. Info security & integrity'!E61)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F61),\"\",'5. Info security & integrity'!F61)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G61),\"\",'5. Info security & integrity'!G61)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H61),\"\",'5. Info security & integrity'!H61)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I61),\"\",'5. Info security & integrity'!I61)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J61),\"\",'5. Info security & integrity'!J61)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.3","Put measures in place to safeguard against physical and environmental disruption.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E62),\"\",'5. Info security & integrity'!E62)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F62),\"\",'5. Info security & integrity'!F62)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G62),\"\",'5. Info security & integrity'!G62)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H62),\"\",'5. Info security & integrity'!H62)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I62),\"\",'5. Info security & integrity'!I62)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J62),\"\",'5. Info security & integrity'!J62)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.4","Determine the requirements for information security (IS) and IS management in the event of a disaster (ie information continues to remain secure, by default if necessary).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E63),\"\",'5. Info security & integrity'!E63)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F63),\"\",'5. Info security & integrity'!F63)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G63),\"\",'5. Info security & integrity'!G63)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H63),\"\",'5. Info security & integrity'!H63)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I63),\"\",'5. Info security & integrity'!I63)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J63),\"\",'5. Info security & integrity'!J63)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.5","Put in place a documented BC and DR policy and procedures to manage high impact incidents.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E64),\"\",'5. Info security & integrity'!E64)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F64),\"\",'5. Info security & integrity'!F64)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G64),\"\",'5. Info security & integrity'!G64)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H64),\"\",'5. Info security & integrity'!H64)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I64),\"\",'5. Info security & integrity'!I64)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J64),\"\",'5. Info security & integrity'!J64)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.6","Deliver specialised training for the Incident and Emergency Response team(s).",{"$f":"IF(ISBLANK('5. Info security & integrity'!E65),\"\",'5. Info security & integrity'!E65)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F65),\"\",'5. Info security & integrity'!F65)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G65),\"\",'5. Info security & integrity'!G65)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H65),\"\",'5. Info security & integrity'!H65)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I65),\"\",'5. Info security & integrity'!I65)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J65),\"\",'5. Info security & integrity'!J65)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.7","Put in place provisions for a temporary physical space in the event of loss of access to the primary site. ",{"$f":"IF(ISBLANK('5. Info security & integrity'!E66),\"\",'5. Info security & integrity'!E66)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F66),\"\",'5. Info security & integrity'!F66)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G66),\"\",'5. Info security & integrity'!G66)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H66),\"\",'5. Info security & integrity'!H66)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I66),\"\",'5. Info security & integrity'!I66)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J66),\"\",'5. Info security & integrity'!J66)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.8","Implement a pre-determined restoration strategy appropriate to the importance of the system and information.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E67),\"\",'5. Info security & integrity'!E67)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F67),\"\",'5. Info security & integrity'!F67)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G67),\"\",'5. Info security & integrity'!G67)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H67),\"\",'5. Info security & integrity'!H67)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I67),\"\",'5. Info security & integrity'!I67)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J67),\"\",'5. Info security & integrity'!J67)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.9","Back up key systems, applications and information to protect against loss of personal information.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E68),\"\",'5. Info security & integrity'!E68)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F68),\"\",'5. Info security & integrity'!F68)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G68),\"\",'5. Info security & integrity'!G68)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H68),\"\",'5. Info security & integrity'!H68)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I68),\"\",'5. Info security & integrity'!I68)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J68),\"\",'5. Info security & integrity'!J68)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.10","Build BC and DR arrangements into all third-party relationships.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E69),\"\",'5. Info security & integrity'!E69)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F69),\"\",'5. Info security & integrity'!F69)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G69),\"\",'5. Info security & integrity'!G69)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H69),\"\",'5. Info security & integrity'!H69)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I69),\"\",'5. Info security & integrity'!I69)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J69),\"\",'5. Info security & integrity'!J69)","v":""}]
["Information security and integrity",5.8,"There are business continuity and disaster recovery plans in place.","5.8.11","Analyse and report on BC and DR level events and near misses and their resolutions.",{"$f":"IF(ISBLANK('5. Info security & integrity'!E70),\"\",'5. Info security & integrity'!E70)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!F70),\"\",'5. Info security & integrity'!F70)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!G70),\"\",'5. Info security & integrity'!G70)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!H70),\"\",'5. Info security & integrity'!H70)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!I70),\"\",'5. Info security & integrity'!I70)","v":""},{"$f":"IF(ISBLANK('5. Info security & integrity'!J70),\"\",'5. Info security & integrity'!J70)","v":""}]
["Data Protection by design",6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.1","Bake in’ data protection to your processing activities and business practices, throughout the lifecycle from the design stage . ",{"$f":"IF(ISBLANK('6. DP by design'!E2),\"\",'6. DP by design'!E2)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F2),\"\",'6. DP by design'!F2)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G2),\"\",'6. DP by design'!G2)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H2),\"\",'6. DP by design'!H2)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I2),\"\",'6. DP by design'!I2)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J2),\"\",'6. DP by design'!J2)","v":""}]
[{"$f":"A229","v":"Data Protection by design"},{"$f":"B229","v":6.1},{"$f":"C229","v":"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other."},"6.1.2"," Document the approach and methodology for identifying and assessing AI trade-offs, including the reasons for adopting or rejecting particular technical approaches.",{"$f":"IF(ISBLANK('6. DP by design'!E3),\"\",'6. DP by design'!E3)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F3),\"\",'6. DP by design'!F3)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G3),\"\",'6. DP by design'!G3)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H3),\"\",'6. DP by design'!H3)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I3),\"\",'6. DP by design'!I3)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J3),\"\",'6. DP by design'!J3)","v":""}]
["Data Protection by design",6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.3","Use available technical approaches to minimise the need for any trade-offs and evaluate the potential impact on people.",{"$f":"IF(ISBLANK('6. DP by design'!E4),\"\",'6. DP by design'!E4)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F4),\"\",'6. DP by design'!F4)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G4),\"\",'6. DP by design'!G4)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H4),\"\",'6. DP by design'!H4)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I4),\"\",'6. DP by design'!I4)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J4),\"\",'6. DP by design'!J4)","v":""}]
["Data Protection by design",6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.4","Review trade-offs regularly by applying a robust, independent, and risk-based process.",{"$f":"IF(ISBLANK('6. DP by design'!E5),\"\",'6. DP by design'!E5)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F5),\"\",'6. DP by design'!F5)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G5),\"\",'6. DP by design'!G5)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H5),\"\",'6. DP by design'!H5)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I5),\"\",'6. DP by design'!I5)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J5),\"\",'6. DP by design'!J5)","v":""}]
["Data Protection by design",6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.5","Review emerging or new trade-offs that could arise if new considerations come to light during ongoing system performance monitoring and quality assurance checks.",{"$f":"IF(ISBLANK('6. DP by design'!E6),\"\",'6. DP by design'!E6)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F6),\"\",'6. DP by design'!F6)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G6),\"\",'6. DP by design'!G6)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H6),\"\",'6. DP by design'!H6)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I6),\"\",'6. DP by design'!I6)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J6),\"\",'6. DP by design'!J6)","v":""}]
["Data Protection by design",6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.6","Consider the following when designing your AI system:\n- \tAI algorithm accuracy vs explainability (increasing data points means more accurate algorithms but are more difficult to work with and for people to understand).\n- \tAI accuracy vs speed (increasing data points may improve accuracy but reduce speed of decisions).\n- \tAI transparency vs understandability (too much technical detail might prevent people from understanding).\n- \tAI transparency vs security risk (explaining the system fully to people may highlight security vulnerabilities).",{"$f":"IF(ISBLANK('6. DP by design'!E7),\"\",'6. DP by design'!E7)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F7),\"\",'6. DP by design'!F7)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G7),\"\",'6. DP by design'!G7)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H7),\"\",'6. DP by design'!H7)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I7),\"\",'6. DP by design'!I7)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J7),\"\",'6. DP by design'!J7)","v":""}]
["Data Protection by design",6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.7","\tEnsure decisions made during the trade-off analysis are signed off at an appropriately senior level.",{"$f":"IF(ISBLANK('6. DP by design'!E8),\"\",'6. DP by design'!E8)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F8),\"\",'6. DP by design'!F8)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G8),\"\",'6. DP by design'!G8)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H8),\"\",'6. DP by design'!H8)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I8),\"\",'6. DP by design'!I8)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J8),\"\",'6. DP by design'!J8)","v":""}]
["Data Protection by design",6.2,"As part of model and system development, there is a documented assessment to balance the trade-off between the level of human work and automation (where the level of human involvement reduces over time as the AI model moves to full automation).","6.2.1","Include a development timeline with set milestones and review dates in the product and technical specification documents.",{"$f":"IF(ISBLANK('6. DP by design'!E9),\"\",'6. DP by design'!E9)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F9),\"\",'6. DP by design'!F9)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G9),\"\",'6. DP by design'!G9)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H9),\"\",'6. DP by design'!H9)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I9),\"\",'6. DP by design'!I9)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J9),\"\",'6. DP by design'!J9)","v":""}]
["Data Protection by design",{"$f":"B236","v":6.2},{"$f":"C236","v":"As part of model and system development, there is a documented assessment to balance the trade-off between the level of human work and automation (where the level of human involvement reduces over time as the AI model moves to full automation)."},"6.2.2","Document the analysis and decisions of trade-offs about human involvement vs automation in a DPIA. This helps to ensure compliance with UK GDPR articles 5(2) and 22.",{"$f":"IF(ISBLANK('6. DP by design'!E10),\"\",'6. DP by design'!E10)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F10),\"\",'6. DP by design'!F10)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G10),\"\",'6. DP by design'!G10)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H10),\"\",'6. DP by design'!H10)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I10),\"\",'6. DP by design'!I10)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J10),\"\",'6. DP by design'!J10)","v":""}]
["Data Protection by design",6.2,"As part of model and system development, there is a documented assessment to balance the trade-off between the level of human work and automation (where the level of human involvement reduces over time as the AI model moves to full automation).","6.2.3","Test each move to further automation for accuracy and ensure this is signed off at a senior level.",{"$f":"IF(ISBLANK('6. DP by design'!E11),\"\",'6. DP by design'!E11)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!F11),\"\",'6. DP by design'!F11)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!G11),\"\",'6. DP by design'!G11)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!H11),\"\",'6. DP by design'!H11)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!I11),\"\",'6. DP by design'!I11)","v":""},{"$f":"IF(ISBLANK('6. DP by design'!J11),\"\",'6. DP by design'!J11)","v":""}]
["Statistical accuracy",7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.1","Document and implement information management processes that detail the data labelling requirements and steps.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E2),\"\",'7. Statistical accuracy'!E2)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F2),\"\",'7. Statistical accuracy'!F2)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G2),\"\",'7. Statistical accuracy'!G2)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H2),\"\",'7. Statistical accuracy'!H2)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I2),\"\",'7. Statistical accuracy'!I2)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J2),\"\",'7. Statistical accuracy'!J2)","v":""}]
[{"$f":"A239","v":"Statistical accuracy"},{"$f":"B239","v":7.1},{"$f":"C239","v":"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people."},"7.1.2","Train staff who are responsible for determining the labelling of datasets appropriately to ensure the quality and accuracy of labels set.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E3),\"\",'7. Statistical accuracy'!E3)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F3),\"\",'7. Statistical accuracy'!F3)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G3),\"\",'7. Statistical accuracy'!G3)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H3),\"\",'7. Statistical accuracy'!H3)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I3),\"\",'7. Statistical accuracy'!I3)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J3),\"\",'7. Statistical accuracy'!J3)","v":""}]
["Statistical accuracy",7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.3","Include quality assurance (QA) procedures into the labelling process, including:\n- \t'human in the loop' QA processes for any automated labelling processes; and\n- \tsecurity and QA measures, if you use a third-party data labelling service.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E4),\"\",'7. Statistical accuracy'!E4)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F4),\"\",'7. Statistical accuracy'!F4)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G4),\"\",'7. Statistical accuracy'!G4)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H4),\"\",'7. Statistical accuracy'!H4)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I4),\"\",'7. Statistical accuracy'!I4)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J4),\"\",'7. Statistical accuracy'!J4)","v":""}]
["Statistical accuracy",7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.4","Include labelling for blind spots and biases and ensure all labelling testing includes an analysis of 'edge cases' (rare and unusual situations which do not happen often). This is so these are not excluded, missed or misinterpreted.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E5),\"\",'7. Statistical accuracy'!E5)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F5),\"\",'7. Statistical accuracy'!F5)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G5),\"\",'7. Statistical accuracy'!G5)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H5),\"\",'7. Statistical accuracy'!H5)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I5),\"\",'7. Statistical accuracy'!I5)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J5),\"\",'7. Statistical accuracy'!J5)","v":""}]
["Statistical accuracy",7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.5"," Ensure the least amount of information is used in the process (eg adding data incrementally into the data labelled sets).",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E6),\"\",'7. Statistical accuracy'!E6)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F6),\"\",'7. Statistical accuracy'!F6)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G6),\"\",'7. Statistical accuracy'!G6)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H6),\"\",'7. Statistical accuracy'!H6)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I6),\"\",'7. Statistical accuracy'!I6)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J6),\"\",'7. Statistical accuracy'!J6)","v":""}]
["Statistical accuracy",7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.6","Ensure that a resolution process is in place if disagreements on labelling for edge cases occur.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E7),\"\",'7. Statistical accuracy'!E7)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F7),\"\",'7. Statistical accuracy'!F7)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G7),\"\",'7. Statistical accuracy'!G7)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H7),\"\",'7. Statistical accuracy'!H7)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I7),\"\",'7. Statistical accuracy'!I7)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J7),\"\",'7. Statistical accuracy'!J7)","v":""}]
["Statistical accuracy",7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.7","Document all decisions about features that won't be labelled.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E8),\"\",'7. Statistical accuracy'!E8)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F8),\"\",'7. Statistical accuracy'!F8)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G8),\"\",'7. Statistical accuracy'!G8)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H8),\"\",'7. Statistical accuracy'!H8)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I8),\"\",'7. Statistical accuracy'!I8)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J8),\"\",'7. Statistical accuracy'!J8)","v":""}]
["Statistical accuracy",7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.8","Keep data labels under review.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E9),\"\",'7. Statistical accuracy'!E9)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F9),\"\",'7. Statistical accuracy'!F9)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G9),\"\",'7. Statistical accuracy'!G9)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H9),\"\",'7. Statistical accuracy'!H9)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I9),\"\",'7. Statistical accuracy'!I9)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J9),\"\",'7. Statistical accuracy'!J9)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.1","Establish a model evaluation framework to systematically assess the performance of the AI system against predefined accuracy metrics before implementation. This involves designing experiments, conducting tests, and analysing results to quantify the system's predictive performance and identify areas for improvement.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E10),\"\",'7. Statistical accuracy'!E10)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F10),\"\",'7. Statistical accuracy'!F10)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G10),\"\",'7. Statistical accuracy'!G10)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H10),\"\",'7. Statistical accuracy'!H10)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I10),\"\",'7. Statistical accuracy'!I10)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J10),\"\",'7. Statistical accuracy'!J10)","v":""}]
["Statistical accuracy",{"$f":"B247","v":7.2},{"$f":"C247","v":"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved."},"7.2.2","Ensure the test plan includes all the relevant checks to provide assurance that there are no errors in data outputs or statistical errors.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E11),\"\",'7. Statistical accuracy'!E11)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F11),\"\",'7. Statistical accuracy'!F11)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G11),\"\",'7. Statistical accuracy'!G11)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H11),\"\",'7. Statistical accuracy'!H11)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I11),\"\",'7. Statistical accuracy'!I11)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J11),\"\",'7. Statistical accuracy'!J11)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.3","Document target accuracy rates and tolerances for errors in the test plan.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E12),\"\",'7. Statistical accuracy'!E12)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F12),\"\",'7. Statistical accuracy'!F12)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G12),\"\",'7. Statistical accuracy'!G12)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H12),\"\",'7. Statistical accuracy'!H12)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I12),\"\",'7. Statistical accuracy'!I12)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J12),\"\",'7. Statistical accuracy'!J12)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.4","Include minimum success criteria for current performance in the test plan, and monitor false acceptance and rejection rates.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E13),\"\",'7. Statistical accuracy'!E13)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F13),\"\",'7. Statistical accuracy'!F13)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G13),\"\",'7. Statistical accuracy'!G13)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H13),\"\",'7. Statistical accuracy'!H13)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I13),\"\",'7. Statistical accuracy'!I13)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J13),\"\",'7. Statistical accuracy'!J13)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.5","Run and test the system in 'ghost mode' or in a testing environment to understand accuracy levels.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E14),\"\",'7. Statistical accuracy'!E14)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F14),\"\",'7. Statistical accuracy'!F14)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G14),\"\",'7. Statistical accuracy'!G14)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H14),\"\",'7. Statistical accuracy'!H14)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I14),\"\",'7. Statistical accuracy'!I14)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J14),\"\",'7. Statistical accuracy'!J14)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.6","Retrain the AI system following accuracy testing.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E15),\"\",'7. Statistical accuracy'!E15)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F15),\"\",'7. Statistical accuracy'!F15)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G15),\"\",'7. Statistical accuracy'!G15)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H15),\"\",'7. Statistical accuracy'!H15)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I15),\"\",'7. Statistical accuracy'!I15)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J15),\"\",'7. Statistical accuracy'!J15)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.7","Test the AI system on new data set(s) to confirm the same outcome is reached.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E16),\"\",'7. Statistical accuracy'!E16)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F16),\"\",'7. Statistical accuracy'!F16)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G16),\"\",'7. Statistical accuracy'!G16)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H16),\"\",'7. Statistical accuracy'!H16)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I16),\"\",'7. Statistical accuracy'!I16)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J16),\"\",'7. Statistical accuracy'!J16)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.8","Conduct ‘decision gate’ reviews as part of the go live process to evaluate the results of statistical accuracy testing and make informed decisions about system readiness.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E17),\"\",'7. Statistical accuracy'!E17)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F17),\"\",'7. Statistical accuracy'!F17)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G17),\"\",'7. Statistical accuracy'!G17)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H17),\"\",'7. Statistical accuracy'!H17)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I17),\"\",'7. Statistical accuracy'!I17)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J17),\"\",'7. Statistical accuracy'!J17)","v":""}]
["Statistical accuracy",7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.9","Ask senior management to sign off acceptance of the test results. ",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E18),\"\",'7. Statistical accuracy'!E18)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F18),\"\",'7. Statistical accuracy'!F18)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G18),\"\",'7. Statistical accuracy'!G18)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H18),\"\",'7. Statistical accuracy'!H18)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I18),\"\",'7. Statistical accuracy'!I18)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J18),\"\",'7. Statistical accuracy'!J18)","v":""}]
["Statistical accuracy",7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.1","Detail the methodology the human reviewer will use when testing the system for statistical accuracy. The test plan should outline the criteria, requirements and sampling method and size. ",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E19),\"\",'7. Statistical accuracy'!E19)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F19),\"\",'7. Statistical accuracy'!F19)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G19),\"\",'7. Statistical accuracy'!G19)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H19),\"\",'7. Statistical accuracy'!H19)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I19),\"\",'7. Statistical accuracy'!I19)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J19),\"\",'7. Statistical accuracy'!J19)","v":""}]
["Statistical accuracy",{"$f":"B256","v":7.3},{"$f":"C256","v":"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system."},"7.3.2","Check that the rate of error in data outputs or statistical errors is within acceptable and documented tolerances.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E20),\"\",'7. Statistical accuracy'!E20)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F20),\"\",'7. Statistical accuracy'!F20)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G20),\"\",'7. Statistical accuracy'!G20)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H20),\"\",'7. Statistical accuracy'!H20)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I20),\"\",'7. Statistical accuracy'!I20)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J20),\"\",'7. Statistical accuracy'!J20)","v":""}]
["Statistical accuracy",7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.3","Retrain the AI system following testing (eg by improving input data, different balance of false positives and negatives, or using different learning algorithms).",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E21),\"\",'7. Statistical accuracy'!E21)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F21),\"\",'7. Statistical accuracy'!F21)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G21),\"\",'7. Statistical accuracy'!G21)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H21),\"\",'7. Statistical accuracy'!H21)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I21),\"\",'7. Statistical accuracy'!I21)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J21),\"\",'7. Statistical accuracy'!J21)","v":""}]
["Statistical accuracy",7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.4","Test the AI system on new data set(s) to confirm consistency in statistical accuracy rates. ",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E22),\"\",'7. Statistical accuracy'!E22)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F22),\"\",'7. Statistical accuracy'!F22)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G22),\"\",'7. Statistical accuracy'!G22)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H22),\"\",'7. Statistical accuracy'!H22)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I22),\"\",'7. Statistical accuracy'!I22)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J22),\"\",'7. Statistical accuracy'!J22)","v":""}]
["Statistical accuracy",7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.5","Ask senior management to sign off acceptance of the test results.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E23),\"\",'7. Statistical accuracy'!E23)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F23),\"\",'7. Statistical accuracy'!F23)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G23),\"\",'7. Statistical accuracy'!G23)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H23),\"\",'7. Statistical accuracy'!H23)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I23),\"\",'7. Statistical accuracy'!I23)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J23),\"\",'7. Statistical accuracy'!J23)","v":""}]
["Statistical accuracy",7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.1","Implement a regular testing regime to monitor the AI system and introduce metrics or thresholds that trigger tests for statistical accuracy on an ongoing basis. Include relevant checks to identify errors in data outputs, tolerances for errors, and document the results.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E24),\"\",'7. Statistical accuracy'!E24)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F24),\"\",'7. Statistical accuracy'!F24)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G24),\"\",'7. Statistical accuracy'!G24)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H24),\"\",'7. Statistical accuracy'!H24)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I24),\"\",'7. Statistical accuracy'!I24)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J24),\"\",'7. Statistical accuracy'!J24)","v":""}]
["Statistical accuracy",{"$f":"B261","v":7.4},{"$f":"C261","v":"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made."},"7.4.2","Monitor AI for overfitting (ie when a learning algorithm pays too much attention to the specific features in the training datasets, which can impact a person who isn’t similar to the people in the training datasets). For example, by monitoring precision and recall to identify possible overfitting.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E25),\"\",'7. Statistical accuracy'!E25)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F25),\"\",'7. Statistical accuracy'!F25)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G25),\"\",'7. Statistical accuracy'!G25)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H25),\"\",'7. Statistical accuracy'!H25)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I25),\"\",'7. Statistical accuracy'!I25)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J25),\"\",'7. Statistical accuracy'!J25)","v":""}]
["Statistical accuracy",7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.3","Test the AI system using new data set(s) to confirm the same statistical accuracy rates are reached, and change the learning process, if required.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E26),\"\",'7. Statistical accuracy'!E26)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F26),\"\",'7. Statistical accuracy'!F26)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G26),\"\",'7. Statistical accuracy'!G26)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H26),\"\",'7. Statistical accuracy'!H26)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I26),\"\",'7. Statistical accuracy'!I26)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J26),\"\",'7. Statistical accuracy'!J26)","v":""}]
["Statistical accuracy",7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.4","Consider retraining the AI systems as necessary (eg by implementing algorithmic fairness measures, fairness constraints, improving input data, using a different balance of false positives and negatives, or using different learning algorithms).",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E27),\"\",'7. Statistical accuracy'!E27)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F27),\"\",'7. Statistical accuracy'!F27)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G27),\"\",'7. Statistical accuracy'!G27)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H27),\"\",'7. Statistical accuracy'!H27)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I27),\"\",'7. Statistical accuracy'!I27)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J27),\"\",'7. Statistical accuracy'!J27)","v":""}]
["Statistical accuracy",7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.5","Undertake regular compliance checks to provide assurance for AI systems or components managed by third parties.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E28),\"\",'7. Statistical accuracy'!E28)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F28),\"\",'7. Statistical accuracy'!F28)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G28),\"\",'7. Statistical accuracy'!G28)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H28),\"\",'7. Statistical accuracy'!H28)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I28),\"\",'7. Statistical accuracy'!I28)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J28),\"\",'7. Statistical accuracy'!J28)","v":""}]
["Statistical accuracy",7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.6","Modify or delete information that reflects past inaccuracy from the system if no longer relevant to the current decision.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E29),\"\",'7. Statistical accuracy'!E29)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F29),\"\",'7. Statistical accuracy'!F29)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G29),\"\",'7. Statistical accuracy'!G29)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H29),\"\",'7. Statistical accuracy'!H29)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I29),\"\",'7. Statistical accuracy'!I29)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J29),\"\",'7. Statistical accuracy'!J29)","v":""}]
["Statistical accuracy",7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.7"," Carry out tests which include running a traditional decision-making system and an AI system concurrently and investigate any significant difference in the type of decisions.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E30),\"\",'7. Statistical accuracy'!E30)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F30),\"\",'7. Statistical accuracy'!F30)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G30),\"\",'7. Statistical accuracy'!G30)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H30),\"\",'7. Statistical accuracy'!H30)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I30),\"\",'7. Statistical accuracy'!I30)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J30),\"\",'7. Statistical accuracy'!J30)","v":""}]
["Statistical accuracy",7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.8"," Save AI models separately so models can revert back to a previous version if significant drift occurs.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E31),\"\",'7. Statistical accuracy'!E31)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F31),\"\",'7. Statistical accuracy'!F31)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G31),\"\",'7. Statistical accuracy'!G31)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H31),\"\",'7. Statistical accuracy'!H31)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I31),\"\",'7. Statistical accuracy'!I31)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J31),\"\",'7. Statistical accuracy'!J31)","v":""}]
["Statistical accuracy",7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.1"," Log all complaints about your AI and track the issue, the response, and the response date.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E32),\"\",'7. Statistical accuracy'!E32)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F32),\"\",'7. Statistical accuracy'!F32)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G32),\"\",'7. Statistical accuracy'!G32)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H32),\"\",'7. Statistical accuracy'!H32)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I32),\"\",'7. Statistical accuracy'!I32)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J32),\"\",'7. Statistical accuracy'!J32)","v":""}]
["Statistical accuracy",{"$f":"B269","v":7.5},{"$f":"C269","v":"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken."},"7.5.2","Analyse the complaints to determine trends, issues, and risks, and share this with senior management.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E33),\"\",'7. Statistical accuracy'!E33)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F33),\"\",'7. Statistical accuracy'!F33)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G33),\"\",'7. Statistical accuracy'!G33)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H33),\"\",'7. Statistical accuracy'!H33)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I33),\"\",'7. Statistical accuracy'!I33)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J33),\"\",'7. Statistical accuracy'!J33)","v":""}]
["Statistical accuracy",7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.3","Develop incident response procedures to handle and address any issues or failures identified during post-implementation testing. This includes defining escalation paths, assigning responsibility for resolution, and implementing corrective actions to mitigate the impact of incidents on system performance.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E34),\"\",'7. Statistical accuracy'!E34)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F34),\"\",'7. Statistical accuracy'!F34)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G34),\"\",'7. Statistical accuracy'!G34)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H34),\"\",'7. Statistical accuracy'!H34)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I34),\"\",'7. Statistical accuracy'!I34)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J34),\"\",'7. Statistical accuracy'!J34)","v":""}]
["Statistical accuracy",7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.4","Establish a continuous improvement process to iteratively enhance the AI system based on insights gained from complaints in accuracy.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E35),\"\",'7. Statistical accuracy'!E35)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F35),\"\",'7. Statistical accuracy'!F35)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G35),\"\",'7. Statistical accuracy'!G35)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H35),\"\",'7. Statistical accuracy'!H35)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I35),\"\",'7. Statistical accuracy'!I35)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J35),\"\",'7. Statistical accuracy'!J35)","v":""}]
["Statistical accuracy",7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.5","Educate staff on how to respond to people challenging AI decisions or outputs.  If the challenge is upheld, review and amend practices, where necessary.",{"$f":"IF(ISBLANK('7. Statistical accuracy'!E36),\"\",'7. Statistical accuracy'!E36)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!F36),\"\",'7. Statistical accuracy'!F36)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!G36),\"\",'7. Statistical accuracy'!G36)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!H36),\"\",'7. Statistical accuracy'!H36)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!I36),\"\",'7. Statistical accuracy'!I36)","v":""},{"$f":"IF(ISBLANK('7. Statistical accuracy'!J36),\"\",'7. Statistical accuracy'!J36)","v":""}]
["Discrimination and bias",8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.1","Consider implementing measures to avoid discrimination against people because of protected characteristics at all stages of the AI system life cycle.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E2),\"\",'8. Discrimination & bias'!E2)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F2),\"\",'8. Discrimination & bias'!F2)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G2),\"\",'8. Discrimination & bias'!G2)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H2),\"\",'8. Discrimination & bias'!H2)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I2),\"\",'8. Discrimination & bias'!I2)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J2),\"\",'8. Discrimination & bias'!J2)","v":""}]
[{"$f":"A274","v":"Discrimination and bias"},{"$f":"B274","v":8.1},{"$f":"C274","v":"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing."},"8.1.2","Implement algorithmic fairness techniques such as: \n- \tpre-processing (adjusting training datasets);\n- \tin-processing (applying factors or constraints in model training); and \n- \tpost-processing (interventions and outputs). ",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E3),\"\",'8. Discrimination & bias'!E3)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F3),\"\",'8. Discrimination & bias'!F3)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G3),\"\",'8. Discrimination & bias'!G3)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H3),\"\",'8. Discrimination & bias'!H3)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I3),\"\",'8. Discrimination & bias'!I3)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J3),\"\",'8. Discrimination & bias'!J3)","v":""}]
["Discrimination and bias",8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.3","Conduct analysis of algorithmic fairness limitations, such as: \n- \tunequal distribution of protected characteristics; \n- \tintersectional discrimination if a person fits multiple protected characteristics; and \n- \treliance on false positives and true negatives.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E4),\"\",'8. Discrimination & bias'!E4)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F4),\"\",'8. Discrimination & bias'!F4)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G4),\"\",'8. Discrimination & bias'!G4)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H4),\"\",'8. Discrimination & bias'!H4)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I4),\"\",'8. Discrimination & bias'!I4)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J4),\"\",'8. Discrimination & bias'!J4)","v":""}]
["Discrimination and bias",8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.4","Maintain evidence that could assist with fairness compliance obligations as the controller throughout the AI system supply chain.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E5),\"\",'8. Discrimination & bias'!E5)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F5),\"\",'8. Discrimination & bias'!F5)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G5),\"\",'8. Discrimination & bias'!G5)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H5),\"\",'8. Discrimination & bias'!H5)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I5),\"\",'8. Discrimination & bias'!I5)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J5),\"\",'8. Discrimination & bias'!J5)","v":""}]
["Discrimination and bias",8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.5","Ensure fairness is considered at different stages of the AI system:\n- \tproject design (eg by mapping of objectives, examining decision scope, reviewing bias measurability, consulting stakeholders, and adopting participatory design);\n- \tbefore processing personal information;\n- \tduring information collection and procurement;\n- \tduring data analysis, labelling and pre-processing;\n- \tin AI model evaluation and monitoring; and\n- \twhen retiring or decommissioning.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E6),\"\",'8. Discrimination & bias'!E6)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F6),\"\",'8. Discrimination & bias'!F6)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G6),\"\",'8. Discrimination & bias'!G6)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H6),\"\",'8. Discrimination & bias'!H6)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I6),\"\",'8. Discrimination & bias'!I6)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J6),\"\",'8. Discrimination & bias'!J6)","v":""}]
["Discrimination and bias",8.1999999999999993,"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. ","8.2.1"," Include protected characteristics in the AI model, where appropriate or necessary, to ensure the system does not discriminate against these characteristics.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E7),\"\",'8. Discrimination & bias'!E7)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F7),\"\",'8. Discrimination & bias'!F7)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G7),\"\",'8. Discrimination & bias'!G7)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H7),\"\",'8. Discrimination & bias'!H7)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I7),\"\",'8. Discrimination & bias'!I7)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J7),\"\",'8. Discrimination & bias'!J7)","v":""}]
["Discrimination and bias",{"$f":"B279","v":8.1999999999999993},{"$f":"C279","v":"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. "},"8.2.2"," Test these characteristics thoroughly to ensure they produce the right outputs consistently.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E8),\"\",'8. Discrimination & bias'!E8)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F8),\"\",'8. Discrimination & bias'!F8)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G8),\"\",'8. Discrimination & bias'!G8)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H8),\"\",'8. Discrimination & bias'!H8)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I8),\"\",'8. Discrimination & bias'!I8)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J8),\"\",'8. Discrimination & bias'!J8)","v":""}]
["Discrimination and bias",8.1999999999999993,"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. ","8.2.3","Assess and document in a DPIA the risks associated with including protected characteristics and how the risks have been mitigated.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E9),\"\",'8. Discrimination & bias'!E9)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F9),\"\",'8. Discrimination & bias'!F9)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G9),\"\",'8. Discrimination & bias'!G9)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H9),\"\",'8. Discrimination & bias'!H9)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I9),\"\",'8. Discrimination & bias'!I9)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J9),\"\",'8. Discrimination & bias'!J9)","v":""}]
["Discrimination and bias",8.1999999999999993,"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. ","8.2.4","Assess whether it would be a disproportionate effort to ask for additional information from people in order to proactively include protected characteristics (bearing in mind data minimisation principles).",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E10),\"\",'8. Discrimination & bias'!E10)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F10),\"\",'8. Discrimination & bias'!F10)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G10),\"\",'8. Discrimination & bias'!G10)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H10),\"\",'8. Discrimination & bias'!H10)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I10),\"\",'8. Discrimination & bias'!I10)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J10),\"\",'8. Discrimination & bias'!J10)","v":""}]
["Discrimination and bias",8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.1","Document and implement a testing process for discriminatory outputs and bias and monitor it before implementation.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E11),\"\",'8. Discrimination & bias'!E11)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F11),\"\",'8. Discrimination & bias'!F11)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G11),\"\",'8. Discrimination & bias'!G11)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H11),\"\",'8. Discrimination & bias'!H11)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I11),\"\",'8. Discrimination & bias'!I11)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J11),\"\",'8. Discrimination & bias'!J11)","v":""}]
["Discrimination and bias",{"$f":"B283","v":8.3000000000000007},{"$f":"C283","v":"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision."},"8.3.2","Include in your DPIA an assessment of the potential discriminatory risks associated with processing personal information, particularly concerning people who need extra support to protect themselves.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E12),\"\",'8. Discrimination & bias'!E12)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F12),\"\",'8. Discrimination & bias'!F12)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G12),\"\",'8. Discrimination & bias'!G12)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H12),\"\",'8. Discrimination & bias'!H12)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I12),\"\",'8. Discrimination & bias'!I12)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J12),\"\",'8. Discrimination & bias'!J12)","v":""}]
["Discrimination and bias",8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.3","Use existing policy, technical, user research and design expertise to help determine sector-wide risks.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E13),\"\",'8. Discrimination & bias'!E13)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F13),\"\",'8. Discrimination & bias'!F13)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G13),\"\",'8. Discrimination & bias'!G13)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H13),\"\",'8. Discrimination & bias'!H13)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I13),\"\",'8. Discrimination & bias'!I13)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J13),\"\",'8. Discrimination & bias'!J13)","v":""}]
["Discrimination and bias",8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.4"," Consider discrimination and bias right from the start of the design phase, including AI potentially processing special category and biometric data.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E14),\"\",'8. Discrimination & bias'!E14)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F14),\"\",'8. Discrimination & bias'!F14)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G14),\"\",'8. Discrimination & bias'!G14)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H14),\"\",'8. Discrimination & bias'!H14)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I14),\"\",'8. Discrimination & bias'!I14)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J14),\"\",'8. Discrimination & bias'!J14)","v":""}]
["Discrimination and bias",8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.5","Conduct appropriate assessments before deploying AI as a service to ensure there isn't potential for discriminatory outputs or decisions to be made.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E15),\"\",'8. Discrimination & bias'!E15)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F15),\"\",'8. Discrimination & bias'!F15)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G15),\"\",'8. Discrimination & bias'!G15)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H15),\"\",'8. Discrimination & bias'!H15)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I15),\"\",'8. Discrimination & bias'!I15)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J15),\"\",'8. Discrimination & bias'!J15)","v":""}]
["Discrimination and bias",8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.6","Integrate human-in-the-loop validation processes to review and validate the AI system's outputs for fairness and equity before go-live. This includes involving appropriate experts in the validation process to provide feedback and identify potential biases or discriminatory patterns.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E16),\"\",'8. Discrimination & bias'!E16)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F16),\"\",'8. Discrimination & bias'!F16)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G16),\"\",'8. Discrimination & bias'!G16)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H16),\"\",'8. Discrimination & bias'!H16)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I16),\"\",'8. Discrimination & bias'!I16)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J16),\"\",'8. Discrimination & bias'!J16)","v":""}]
["Discrimination and bias",8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.7","Test using new data sets to confirm the same outcome is reached.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E17),\"\",'8. Discrimination & bias'!E17)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F17),\"\",'8. Discrimination & bias'!F17)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G17),\"\",'8. Discrimination & bias'!G17)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H17),\"\",'8. Discrimination & bias'!H17)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I17),\"\",'8. Discrimination & bias'!I17)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J17),\"\",'8. Discrimination & bias'!J17)","v":""}]
["Discrimination and bias",8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.8","Adapt, change or retrain the AI following the review if necessary before go live.",{"$f":"IF(ISBLANK('8. Discrimination & bias'!E18),\"\",'8. Discrimination & bias'!E18)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!F18),\"\",'8. Discrimination & bias'!F18)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!G18),\"\",'8. Discrimination & bias'!G18)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!H18),\"\",'8. Discrimination & bias'!H18)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!I18),\"\",'8. Discrimination & bias'!I18)","v":""},{"$f":"IF(ISBLANK('8. Discrimination & bias'!J18),\"\",'8. Discrimination & bias'!J18)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.1"," Undertake regular assessments to determine where a human review is most appropriate and beneficial. ",{"$f":"IF(ISBLANK('9. Human review'!E2),\"\",'9. Human review'!E2)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F2),\"\",'9. Human review'!F2)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G2),\"\",'9. Human review'!G2)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H2),\"\",'9. Human review'!H2)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I2),\"\",'9. Human review'!I2)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J2),\"\",'9. Human review'!J2)","v":""}]
[{"$f":"A291","v":"Human review"},{"$f":"B291","v":9.1},{"$f":"C291","v":"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions."},"9.1.2","Document details of the methodology a human review will use when testing the system for statistical accuracy and bias.",{"$f":"IF(ISBLANK('9. Human review'!E3),\"\",'9. Human review'!E3)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F3),\"\",'9. Human review'!F3)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G3),\"\",'9. Human review'!G3)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H3),\"\",'9. Human review'!H3)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I3),\"\",'9. Human review'!I3)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J3),\"\",'9. Human review'!J3)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.3","Document the testing process or test plan to outline: \n- \tthe criteria and requirements for testing; \n- \tthe sampling method and size;\n- \tthe target accuracy rates and acceptable tolerance; and\n- \tthe checks required to ensure that the rate of error in data outputs or statistical errors is within acceptable and documented tolerances.",{"$f":"IF(ISBLANK('9. Human review'!E4),\"\",'9. Human review'!E4)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F4),\"\",'9. Human review'!F4)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G4),\"\",'9. Human review'!G4)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H4),\"\",'9. Human review'!H4)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I4),\"\",'9. Human review'!I4)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J4),\"\",'9. Human review'!J4)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.4","Maintain a log of when AI decisions are overridden by a human reviewer, including the reasons why.",{"$f":"IF(ISBLANK('9. Human review'!E5),\"\",'9. Human review'!E5)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F5),\"\",'9. Human review'!F5)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G5),\"\",'9. Human review'!G5)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H5),\"\",'9. Human review'!H5)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I5),\"\",'9. Human review'!I5)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J5),\"\",'9. Human review'!J5)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.5","Report the results of the testing to senior management and key stakeholders.",{"$f":"IF(ISBLANK('9. Human review'!E6),\"\",'9. Human review'!E6)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F6),\"\",'9. Human review'!F6)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G6),\"\",'9. Human review'!G6)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H6),\"\",'9. Human review'!H6)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I6),\"\",'9. Human review'!I6)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J6),\"\",'9. Human review'!J6)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.6","Check that the reviews are done at appropriate stages and as directed, if the human review is outsourced to a third party.",{"$f":"IF(ISBLANK('9. Human review'!E7),\"\",'9. Human review'!E7)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F7),\"\",'9. Human review'!F7)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G7),\"\",'9. Human review'!G7)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H7),\"\",'9. Human review'!H7)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I7),\"\",'9. Human review'!I7)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J7),\"\",'9. Human review'!J7)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.7","Ensure that human reviewers have appropriate qualifications. ",{"$f":"IF(ISBLANK('9. Human review'!E8),\"\",'9. Human review'!E8)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F8),\"\",'9. Human review'!F8)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G8),\"\",'9. Human review'!G8)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H8),\"\",'9. Human review'!H8)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I8),\"\",'9. Human review'!I8)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J8),\"\",'9. Human review'!J8)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.8","Assign human reviewers a manageable caseload and ensure there is sufficient resource in place for them to give appropriate time to their tasks.  ",{"$f":"IF(ISBLANK('9. Human review'!E9),\"\",'9. Human review'!E9)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F9),\"\",'9. Human review'!F9)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G9),\"\",'9. Human review'!G9)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H9),\"\",'9. Human review'!H9)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I9),\"\",'9. Human review'!I9)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J9),\"\",'9. Human review'!J9)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.9","Provide human reviewers with adequate training. ",{"$f":"IF(ISBLANK('9. Human review'!E10),\"\",'9. Human review'!E10)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F10),\"\",'9. Human review'!F10)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G10),\"\",'9. Human review'!G10)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H10),\"\",'9. Human review'!H10)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I10),\"\",'9. Human review'!I10)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J10),\"\",'9. Human review'!J10)","v":""}]
["Human review",9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.10","Ensure human reviewers are independent and are able to influence senior-level decision making. Reflect the reporting lines both in job descriptions and in the overall organisational framework.",{"$f":"IF(ISBLANK('9. Human review'!E11),\"\",'9. Human review'!E11)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F11),\"\",'9. Human review'!F11)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G11),\"\",'9. Human review'!G11)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H11),\"\",'9. Human review'!H11)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I11),\"\",'9. Human review'!I11)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J11),\"\",'9. Human review'!J11)","v":""}]
["Human review",9.1999999999999993,"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system.","9.2.1","Maintain separate provider and deployer human review processes.",{"$f":"IF(ISBLANK('9. Human review'!E12),\"\",'9. Human review'!E12)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F12),\"\",'9. Human review'!F12)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G12),\"\",'9. Human review'!G12)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H12),\"\",'9. Human review'!H12)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I12),\"\",'9. Human review'!I12)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J12),\"\",'9. Human review'!J12)","v":""}]
["Human review",{"$f":"B301","v":9.1999999999999993},{"$f":"C301","v":"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system."},"9.2.2","Log human review decisions, including actions taken by a human reviewer to challenge or override automated decision making and the considerations they made when making their final decision. ",{"$f":"IF(ISBLANK('9. Human review'!E13),\"\",'9. Human review'!E13)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F13),\"\",'9. Human review'!F13)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G13),\"\",'9. Human review'!G13)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H13),\"\",'9. Human review'!H13)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I13),\"\",'9. Human review'!I13)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J13),\"\",'9. Human review'!J13)","v":""}]
["Human review",9.1999999999999993,"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system.","9.2.3","Ensure the process is appropriately designed, such as by testing on a sample of decisions.",{"$f":"IF(ISBLANK('9. Human review'!E14),\"\",'9. Human review'!E14)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F14),\"\",'9. Human review'!F14)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G14),\"\",'9. Human review'!G14)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H14),\"\",'9. Human review'!H14)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I14),\"\",'9. Human review'!I14)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J14),\"\",'9. Human review'!J14)","v":""}]
["Human review",9.1999999999999993,"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system.","9.2.4","Implement processes to support a re-review or overturning of decisions (eg if there is one rogue human reviewer).",{"$f":"IF(ISBLANK('9. Human review'!E15),\"\",'9. Human review'!E15)","v":""},{"$f":"IF(ISBLANK('9. Human review'!F15),\"\",'9. Human review'!F15)","v":""},{"$f":"IF(ISBLANK('9. Human review'!G15),\"\",'9. Human review'!G15)","v":""},{"$f":"IF(ISBLANK('9. Human review'!H15),\"\",'9. Human review'!H15)","v":""},{"$f":"IF(ISBLANK('9. Human review'!I15),\"\",'9. Human review'!I15)","v":""},{"$f":"IF(ISBLANK('9. Human review'!J15),\"\",'9. Human review'!J15)","v":""}]

{"sheet":"Tables & graphs","index":3,"n_rows":27,"n_cols":11,"rows_kept":27,"cut":false,"hidden":true,"merged":[]}
[null,"1. Governance & accountability","2. Transparency","3. Contracts & 3rd parties","4. Data minimisation","5. Info security & integrity","6. DP by design","7. Statistical accuracy","8. Discrimination & bias","9. Human review","Total"]
["Fully meeting our expectation",{"$f":"COUNTIF('1. Governance & accountability'!E:E,A2)","v":0},{"$f":"COUNTIF('2. Transparency'!E:E,A2)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!E:E,A2)","v":0},{"$f":"COUNTIF('4. Data minimisation'!E:E,A2)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!E:E,A2)","v":0},{"$f":"COUNTIF('6. DP by design'!E:E,A2)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!E:E,A2)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!E:E,A2)","v":0},{"$f":"COUNTIF('9. Human review'!E:E,A2)","v":0},{"$f":"SUM(B2:J2)","v":0}]
["Partially meeting our expectation",{"$f":"COUNTIF('1. Governance & accountability'!E:E,A3)","v":0},{"$f":"COUNTIF('2. Transparency'!E:E,A3)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!E:E,A3)","v":0},{"$f":"COUNTIF('4. Data minimisation'!E:E,A3)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!E:E,A3)","v":0},{"$f":"COUNTIF('6. DP by design'!E:E,A3)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!E:E,A3)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!E:E,A3)","v":0},{"$f":"COUNTIF('9. Human review'!E:E,A3)","v":0},{"$f":"SUM(B3:J3)","v":0}]
["Not meeting our expectation",{"$f":"COUNTIF('1. Governance & accountability'!E:E,A4)","v":0},{"$f":"COUNTIF('2. Transparency'!E:E,A4)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!E:E,A4)","v":0},{"$f":"COUNTIF('4. Data minimisation'!E:E,A4)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!E:E,A4)","v":0},{"$f":"COUNTIF('6. DP by design'!E:E,A4)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!E:E,A4)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!E:E,A4)","v":0},{"$f":"COUNTIF('9. Human review'!E:E,A4)","v":0},{"$f":"SUM(B4:J4)","v":0}]
["Not Applicable",{"$f":"COUNTIF('1. Governance & accountability'!E:E,A5)","v":0},{"$f":"COUNTIF('2. Transparency'!E:E,A5)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!E:E,A5)","v":0},{"$f":"COUNTIF('4. Data minimisation'!E:E,A5)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!E:E,A5)","v":0},{"$f":"COUNTIF('6. DP by design'!E:E,A5)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!E:E,A5)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!E:E,A5)","v":0},{"$f":"COUNTIF('9. Human review'!E:E,A5)","v":0},{"$f":"SUM(B5:J5)","v":0}]
["Blank",{"$f":"COUNTBLANK('1. Governance & accountability'!E2:E76)","v":75},{"$f":"COUNTBLANK('2. Transparency'!E2:E22)","v":21},{"$f":"COUNTBLANK('3. Contracts & 3rd parties '!E2:E36)","v":35},{"$f":"COUNTBLANK('4. Data minimisation'!E2:E27)","v":26},{"$f":"COUNTBLANK('5. Info security & integrity'!E2:E70)","v":69},{"$f":"COUNTBLANK('6. DP by design'!E2:E11)","v":10},{"$f":"COUNTBLANK('7. Statistical accuracy'!E2:E36)","v":35},{"$f":"COUNTBLANK('8. Discrimination & bias'!E2:E18)","v":17},{"$f":"COUNTBLANK('9. Human review'!E2:E15)","v":14},{"$f":"SUM(B6:J6)","v":302}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"1. Governance & accountability","2. Transparency","3. Contracts & 3rd parties","4. Data minimisation","5. Info security & integrity","6. DP by design","7. Statistical accuracy","8. Discrimination & bias","9. Human review","Total"]
["Not started",{"$f":"COUNTIF('1. Governance & accountability'!I:I,A18)","v":0},{"$f":"COUNTIF('2. Transparency'!I:I,A18)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!I:I,A18)","v":0},{"$f":"COUNTIF('4. Data minimisation'!I:I,A18)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!I:I,A18)","v":0},{"$f":"COUNTIF('6. DP by design'!I:I,A18)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!I:I,A18)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!I:I,A18)","v":0},{"$f":"COUNTIF('9. Human review'!I:I,A18)","v":0},{"$f":"SUM(B18:J18)","v":0}]
["Action rejected",{"$f":"COUNTIF('1. Governance & accountability'!I:I,A19)","v":0},{"$f":"COUNTIF('2. Transparency'!I:I,A19)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!I:I,A19)","v":0},{"$f":"COUNTIF('4. Data minimisation'!I:I,A19)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!I:I,A19)","v":0},{"$f":"COUNTIF('6. DP by design'!I:I,A19)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!I:I,A19)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!I:I,A19)","v":0},{"$f":"COUNTIF('9. Human review'!I:I,A19)","v":0},0]
["On track",{"$f":"COUNTIF('1. Governance & accountability'!I:I,A20)","v":0},{"$f":"COUNTIF('2. Transparency'!I:I,A20)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!I:I,A20)","v":0},{"$f":"COUNTIF('4. Data minimisation'!I:I,A20)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!I:I,A20)","v":0},{"$f":"COUNTIF('6. DP by design'!I:I,A20)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!I:I,A20)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!I:I,A20)","v":0},{"$f":"COUNTIF('9. Human review'!I:I,A20)","v":0},0]
["Overdue",{"$f":"COUNTIF('1. Governance & accountability'!I:I,A21)","v":0},{"$f":"COUNTIF('2. Transparency'!I:I,A21)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!I:I,A21)","v":0},{"$f":"COUNTIF('4. Data minimisation'!I:I,A21)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!I:I,A21)","v":0},{"$f":"COUNTIF('6. DP by design'!I:I,A21)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!I:I,A21)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!I:I,A21)","v":0},{"$f":"COUNTIF('9. Human review'!I:I,A21)","v":0},0]
["Completed",{"$f":"COUNTIF('1. Governance & accountability'!I:I,A22)","v":0},{"$f":"COUNTIF('2. Transparency'!I:I,A22)","v":0},{"$f":"COUNTIF('3. Contracts & 3rd parties '!I:I,A22)","v":0},{"$f":"COUNTIF('4. Data minimisation'!I:I,A22)","v":0},{"$f":"COUNTIF('5. Info security & integrity'!I:I,A22)","v":0},{"$f":"COUNTIF('6. DP by design'!I:I,A22)","v":0},{"$f":"COUNTIF('7. Statistical accuracy'!I:I,A22)","v":0},{"$f":"COUNTIF('8. Discrimination & bias'!I:I,A22)","v":0},{"$f":"COUNTIF('9. Human review'!I:I,A22)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Governance & accountability'!I2:I76)","v":75},{"$f":"COUNTBLANK('2. Transparency'!I2:I22)","v":21},{"$f":"COUNTBLANK('3. Contracts & 3rd parties '!I2:I36)","v":35},{"$f":"COUNTBLANK('4. Data minimisation'!I2:I27)","v":26},{"$f":"COUNTBLANK('5. Info security & integrity'!I2:I70)","v":69},{"$f":"COUNTBLANK('6. DP by design'!I2:I11)","v":10},{"$f":"COUNTBLANK('7. Statistical accuracy'!I2:I36)","v":35},{"$f":"COUNTBLANK('8. Discrimination & bias'!I2:I18)","v":17},{"$f":"COUNTBLANK('9. Human review'!I2:I15)","v":14},302]
[]
[]
[null,"Not started","Action rejected","On track","Overdue","Completed","Blank"]
[null,{"$f":"SUM(B18:J18)","v":0},{"$f":"SUM(B19:J19)","v":0},{"$f":"SUM(B20:J20)","v":0},{"$f":"SUM(B21:J21)","v":0},{"$f":"SUM(B22:J22)","v":0},{"$f":"SUM(B23:J23)","v":302}]

{"sheet":"Lookup","index":4,"n_rows":9,"n_cols":7,"rows_kept":9,"cut":false,"hidden":true,"merged":[]}
["Fully meeting our expectation",null,null,null,"Not started",null,"Not started"]
["Partially meeting our expectation",null,null,null,"Action rejected",null,"In progress"]
["Not meeting our expectation",null,null,null,"On track",null,"Overdue"]
["Not Applicable",null,null,null,"Overdue",null,"Completed"]
[null,null,null,null,"Completed"]
[]
[]
["2000-01-01"]
[{"$f":"TODAY()","v":"2024-09-17"}]

{"sheet":"1. Governance & accountability","index":5,"n_rows":76,"n_cols":10,"rows_kept":76,"cut":false,"hidden":false,"merged":[[69,0,75,0],[69,1,75,1],[52,1,61,1],[52,0,61,0],[62,1,68,1],[62,0,68,0],[44,1,51,1],[44,0,51,0],[27,0,30,0],[27,1,30,1],[1,0,7,0],[1,1,7,1],[8,0,16,0],[8,1,16,1],[17,0,20,0],[17,1,20,1],[31,1,39,1],[31,0,39,0],[21,1,26,1],[21,0,26,0],[40,1,43,1],[40,0,43,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.1","\tEnsure the overall governance and privacy management framework supports the compliant use of AI systems."]
[{"$f":"A2","v":1.1000000000000001},"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.2","\tInclude appropriate technical and organisational measures into the framework that are designed to implement the data protection principles in an effective manner."]
[1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.3","\tEvidence that senior management have seen and signed off the risks associated with using AI. "]
[1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.4","\tAppoint a DPO, or a nominated data protection lead, with designated responsibility for overseeing AI systems."]
[1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.5","\tAssign technical and operational roles and responsibilities to ensure the effective management and security of AI systems and personal information they hold."]
[1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.6","\tDocument in policy the privacy measures in place for information processing and for ongoing training, testing or evaluation of an AI system or service. "]
[1.1000000000000001,"There is a documented and embedded privacy management framework endorsed by senior management that supports the AI system’s development, use and oversight.","1.1.7","\tSupport policies with operational procedures, guidance or manuals to direct operational staff on using AI systems and applying data protection law."]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.1","\tDocument the DPIA policy or process, with supporting templates and guidance to help staff complete an effective DPIA that meets the UK GDPR requirements (article 35)."]
[{"$f":"A9","v":1.2},"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.2","\tComplete the DPIA before starting the processing."]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.3","\tConsult internal stakeholders, technical specialists within AI product teams and the public, as part of the DPIA assessment, as appropriate."]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.4","\tShare completed DPIAs with senior management and get sign off on the outcome of the assessment."]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.5","\tAct on the outputs of the DPIA to effectively mitigate or manage any risks it identified."]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.6","\tReview DPIAs, particularly when there is a change to processing, to ensure they remain accurate and up-to-date"]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.7","\tImplement an effective risk management strategy to help to formally document the risks of using AI systems. Ensure they are tracked and managed at a corporate level through an appropriate risk register."]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.8","\tMitigate privacy risks effectively and in a timely manner through ongoing AI system development and enhancements."]
[1.2,"The purpose of the AI system and the most important criteria in the system specification and testing is considered and documented within a data protection impact assessment (DPIA).","1.2.9","\tEnsure there is proactive engagement between all parties as part of the procurement process to appropriately assess the risk of the AI system."]
[1.3,"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies.","1.3.1","\tEmploy an external auditor to provide independent assurance (or certification) on your compliance with data protection law and information security."]
[{"$f":"A18","v":1.3},"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies.","1.3.2","\tMaintain a central audit plan."]
[1.3,"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies.","1.3.3","\tIntroduce a programme of internal audits to periodically assess AI systems compliance with data protection law."]
[1.3,"There is a programme of risk-based audits in place to periodically assess AI systems compliance with data protection law and internal privacy policies.","1.3.4","\tProduce audit reports to document the findings from audits and share with senior management."]
[1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.1","\tImplement measures to control the release of any changes or new versions of your system, software reconfiguration, or security patch applications."]
[{"$f":"A22","v":1.4},"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.2","\tDesign and document an agreed communication plan so that all parties understand the impacts of the change(s) and are able to reassess any potential privacy implications."]
[1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.3","\tLog all changes made, patches applied or new versions released (when and who to) and ensure historical information on these changes is easy to locate, if required."]
[1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.4","\tInvestigate when overly-frequent updates or releases are happening, as this could suggest a lack of internal checks or sign-off before each one."]
[1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.5","\tReview contracts and contract service level agreements (SLAs), following any significant changes."]
[1.4,"Change management processes are documented to ensure that new versions or change releases to AI systems are managed effectively by all parties.","1.4.6","\tPlan version releases or changes in advance (including software reconfiguration, or security patch applications) to allow time to educate and train the deployer or client on what they mean in practice."]
[1.5,"Information flows across the entire supply chain have been comprehensively mapped.","1.5.1","\tImplement a process to ensure all processing activities are documented accurately and effectively."]
[{"$f":"A28","v":1.5},"Information flows across the entire supply chain have been comprehensively mapped.","1.5.2","\tConduct information audits (or information mapping exercises) to find out how information moves across the supply chain and where it originates from."]
[1.5,"Information flows across the entire supply chain have been comprehensively mapped.","1.5.3","\tMaintain an internal record of all processing activities (ROPA)."]
[1.5,"Information flows across the entire supply chain have been comprehensively mapped.","1.5.4","\tHighlight information flow processes within the privacy management framework and encourage maintaining an updated version of this document. "]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.1","\tReview your processing activities to determine the most appropriate lawful basis (or bases) for each activity."]
[{"$f":"A32","v":1.6},"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.2","\tDocument each lawful basis and the justification as part of a DPIA, before processing. Assess whether the processing is a targeted and proportionate way of achieving a specific purpose and whether you could achieve the purpose by some other less intrusive means, or by processing less information."]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.3","\tDetermine an appropriate lawful basis, if you use personal information to train or develop any aspect of the AI before deployment. Follow the principles of data minimisation for these activities and do not repurpose this information for another use."]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.4","\tIdentify and document an additional article 9 or 10 condition, if processing special category or criminal offence information."]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.5","\tAssess whether any special category information is accidentally created or collected. If so, delete it."]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.6","\tCease processing and delete any information if you are unable to identify an article 6 lawful basis and article 9 condition."]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.7","\tDocument the lawful basis you are relying on for processing children's information. Apply additional safeguards and security measures before processing."]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.8","If you rely on the outputs of an AI system to support marketing activities, ensure that you:\n- \tappropriately obtain the personal information (in line with your privacy notice); and \n- \tuse an appropriate lawful basis to process the personal information."]
[1.6,"The most appropriate article 6 lawful basis (and article 9 or 10 condition where required) are identified and justified for each information processing activity within the AI system.","1.6.9","\tReview documented lawful bases to check that the relationship, the processing and the purposes have not changed."]
[1.7,"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis.","1.7.1","Ensure the LIA considers the following:\n- \tNot using people’s information in ways they would find intrusive or which could cause them harm, unless there is a very good reason.\n- \tWhat extra steps to take when processing children’s information to make sure their interests are protected.\n- \tWhat safeguards to introduce to reduce the impact where possible.\n- \tWhether you can offer an opt out.\n- \tWhether a DPIA is required."]
[{"$f":"A41","v":1.7},"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis.","1.7.2","\tConsult with key technical staff such as system developers when completing the LIA."]
[1.7,"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis.","1.7.3","\tComplete the LIA before starting the processing and document the decision and the assessment."]
[1.7,"A legitimate interests assessment (LIA) is undertaken where there is a reliance on legitimate interests as a lawful basis.","1.7.4","\tPeriodically assess the model usage to ensure the purpose remains the same and necessity and legitimate interests are still valid."]
[1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.1","\tInform people about processing in the AI system before asking them to give consent (or consent may not be valid)."]
[{"$f":"A45","v":1.8},"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.2","\tEnsure consent mechanisms are specific, granular, and separate from other terms and conditions or acceptances."]
[1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.3","\tProvide clear, prominent, positive opt-ins that are freely given and not a pre-condition of signing up to a service or pre-ticked boxes."]
[1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.4","\tEnsure you actively provide information to people when you seek consent about how they can withdraw that consent."]
[1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.5","\tKeep records or a log of when and how you obtained consent."]
[1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.6","\tReview consent regularly to check that the relationship, the processing, and the purposes have not changed."]
[1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.7","\tImplement processes to refresh consent at appropriate intervals."]
[1.8,"Where consent is used as a lawful basis, consent mechanisms comply with article 7 requirements.","1.8.8","\tImplement dynamic consent mechanisms that allow people to control and revise their consent preferences over time. "]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.1","\tCheck the purposes and lawful basis when information was collected and ensure they have not changed when developing the AI system."]
[{"$f":"A53","v":1.9},{"$f":"B53","v":"There is a comprehensive and effective approach in place to ensure: "},"1.9.2","Undertake due diligence when sourcing information indirectly to train your AI system to check:\n- \tunder which lawful basis the information was originally collected;\n- \twhat privacy information was provided to support its repurpose; and \n- \tthere is not a change in lawful basis when using the information to train the system."]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.3","\tEnsure due diligence checks include the entire information supply chain."]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.4","\tCheck that if the information was originally collected under consent, the consent statement was clear and granular enough to permit you to use it to train the AI system (and that people are aware that their information will be used in this way)."]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.5","\tConduct a fairness and lawfulness assessment as part of the DPIA."]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.6","\tEstablish comprehensive audit trails to log and monitor access to datasets. This includes tracking who accessed the information, when, and for what purpose."]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.7","\tUse role-based access control (RBAC) mechanisms to assign permissions based on staff roles and responsibilities. "]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.8","\tEnsure only authorised staff or systems have access to the specific datasets they need. This reduces the opportunity for repurposing the information. "]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.9","\tEmploy encryption techniques to protect information both in transit and at rest. This ensures that even if unauthorised access occurs, the information remains unintelligible without the appropriate decryption keys."]
[1.9,"There is a comprehensive and effective approach in place to ensure: ","1.9.10","\tApply anonymisation and pseudonymisation techniques to remove personal information in the datasets."]
[1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.1","\tAssess whether the processing is solely automated."]
[{"$f":"A63","v":1.1000000000000001},"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.2","\tAnalyse the impact of decision making on people and detail all potential legal or similar effects."]
[1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.3","\tAsses the likelihood that you will accidentally create special category information and use it to make a decision."]
[1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.4","\tEnsure that any AI models you use do not unintentionally infer special category or criminal conviction information and use those inferences to make decisions about people. "]
[1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.5","\tDelete any special category or criminal conviction information created as a result of automated decision making, if there is no appropriate article 6 lawful basis or article 9 condition. "]
[1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.6","\tEnsure people have provided their explicit consent or assess whether the processing is necessary for substantial public interest reasons."]
[1.1000000000000001,"Analysis has been completed to determine if the results of solely automated decision making within AI systems could cause legal or other similar effects on a person and appropriate safeguards have been put in place. In addition, there is explicit consent in place where special category information is used to carry out solely automated decision making within AI systems.","1.10.7","\tApply additional safeguards to enhance the security of the information if you are using special category information (such as biometric data). "]
[1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.1","\tPublish guidance for people so they know how to make a request. "]
[{"$f":"A70","v":1.1100000000000001},"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.2","\tEstablish a well-organised model management system and deployment pipeline to make it easier and cheaper to accommodate requests."]
[1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.3","\tConsider data indexing or tracing and making systems searchable as part of the system design to effectively respond to requests within statutory timeframes."]
[1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.4","\tMonitor the time taken to respond to requests in order to identify systems which are potentially more complex."]
[1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.5","\tEnsure AI systems have the technical capability to action any requests by people asking you to stop processing their personal information."]
[1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.6","\tEnsure AI systems have the technical capability to action any requests by people asking you to erase their personal information from the system permanently."]
[1.1100000000000001,"There is a policy or process for dealing with people’s rights requests in the information processing pipeline.","1.11.7","\tRegularly and proactively evaluate the possibility of personal information being inferred from models in light of the state-of-the-art technology. This minimises the risk of accidental disclosure."]

{"sheet":"2. Transparency","index":6,"n_rows":22,"n_cols":10,"rows_kept":22,"cut":false,"hidden":false,"merged":[[1,1,15,1],[1,0,15,0],[16,1,21,1],[16,0,21,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.1","\tProvide information about AI systems that is clear and meaningful, explains the processing in everyday language, and does not use overly complex explanations of the AI or confusing and technical terminology, jargon or legalistic language."]
[{"$f":"A2","v":2.1},{"$f":"B2","v":"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. "},"2.1.2","\tAvoid hiding information within lengthy terms and conditions."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.3","\tBe proactive when making people aware of the information and provide an easy way to access it. "]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.4","\tUse a combination of appropriate techniques, such as a layered approach, dashboards, just-in-time notices, icons and mobile and smart device functionalities."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.5","\tAssess whether privacy information is easy to understand (eg by assessing how well people understand processing, or conducting user testing to gain feedback on the content). "]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.6","\tProvide evidence that the underlying processing is within the reasonable expectations of people and does not have an unjustified adverse effect on them."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.7","If decisions are made by AI without human intervention, provide extra details on: \n- \tthe logic of decision making involved; \n- \tthe significance of the processing; and \n- \tthe envisaged consequences of it. "]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.8","\tInform people within one month when AI creates new information about them (which you intend to keep and use)."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.9","\tUse explainable AI techniques to understand and interpret the decision-making processes of machine learning models. This enhances transparency and helps identify which features contribute significantly to the model's predictions."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.10","\tInclude details to enable people to challenge the outcome if they think it is flawed (eg if some of the input information was incorrect or irrelevant, or additional information wasn't taken into account that the person thinks is relevant)."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.11","\tTake steps to explain any trade-offs to people or any human tasked with reviewing AI output."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.12","\tProvide privacy information if you collect special category information in order to monitor and prevent discrimination or unfair bias. Include the processing purpose and lawful basis and condition in the privacy information."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.13","\tRegularly review existing AI privacy information and, where necessary, update it appropriately."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.14","\tUpdate privacy information and communicate the changes to people before starting any new processing, particularly if there are plans to use personal information for a new purpose within AI processing."]
[2.1,"Appropriate and timely privacy information is provided to people to ensure they are sufficiently informed how their personal information is processed by AI systems. ","2.1.15","\tTrain staff so they understand what privacy information to provide to people and how best to do so."]
[2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.1","\tInform people if the purpose for using their personal information is different to what it was originally obtained for."]
[{"$f":"A17","v":2.2000000000000002},"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.2","\tInclude meaningful information about the logic involved, as well as the significance and the envisaged consequences of the processing"]
[2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.3","\tProvide privacy information within a reasonable period of obtaining the information, and no later than one month."]
[2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.4","\tCheck and confirm what privacy information is provided across the supply chain and that it informs people about their information being shared with others. "]
[2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.5","\tBe very clear with people about any unexpected or intrusive uses of their personal information, such as combining information about them from a number of different sources."]
[2.2000000000000002,"Where personal information is obtained from or processed by other sources, all necessary parties can demonstrate compliance with the transparency requirements set out under UK GDPR articles 13 and 14 (unless a relevant exemption applies). \n\nDue diligence checks are completed by all parties to provide assurance that at each stage of the supply chain, people have been informed how their information will be used and that it will be passed throughout the chain.","2.2.6","\tCarry out a DPIA to determine whether providing privacy information would involve a disproportionate effort when balanced against people's rights and freedoms.\n"]

{"sheet":"3. Contracts & 3rd parties ","index":7,"n_rows":36,"n_cols":10,"rows_kept":36,"cut":false,"hidden":false,"merged":[[31,1,35,1],[31,0,35,0],[1,1,7,1],[1,0,7,0],[8,0,20,0],[8,1,20,1],[21,0,30,0],[21,1,30,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.1","\tIdentify the distinct sets of processing operations and their purposes in order to understand the relationship."]
[{"$f":"A2","v":3.1},"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.2","\tConsider the whole supply chain within the assessment."]
[3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.3","\tEvidence the consideration of the relationship between all parties (eg in emails, meeting minutes, model design or specification documents)."]
[3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.4","\tInclude a requirement within DPIA templates to assess the relationship."]
[3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.5","\tEnsure considerations and conclusions are in line with ICO and sectoral or EU guidance on the role of controllers and processors."]
[3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.6","\tFormally document and agree the relationship within contracts or agreements."]
[3.1,"There has been full consideration of the controller, processor or joint controller relationship throughout the supply chain in the use of AI systems. The decision reached on the controller and processor relationship across all proposed processing activities is documented.","3.1.7","\tCommunicate the relationship in privacy information."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.1","\tDecide the acceptable level of accuracy before procurement and complete due diligence to understand and confirm this."]
[{"$f":"A9","v":3.2},{"$f":"B9","v":"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. "},"3.2.2","\tSeek guarantees from the provider of the system or dataset on the source of the information, coding or models used to build the AI, to help you determine its accuracy."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.3","\tReview the use of the AI system or information against existing systems, products or services to ensure that it does not impact on the accuracy of outputs in deployment."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.4","\tInclude accuracy-based key performance indicators (KPIs) or SLAs in written contracts with third-party suppliers."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.5","\tComplete due diligence to understand the level of bias and discrimination that can be expected from the AI system and do not procure the services or datasets if bias or discrimination cannot be mitigated."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.6","\tChoose AI models that offer transparency and explainability. This allows all parties to understand how the model makes decisions, making it easier to identify and address potential biases."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.7","\tConduct an independent evaluation of any trade-offs as part of the due diligence process."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.8","\tDetermine what would be the reasonable timeline to re-evaluate the accuracy of the system and ask the third party to re-train the AI models if required (ie AI systems may need updating with new information to maintain their accuracy especially when the trends in information are changing)."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.9","\tEngage independent third-party organisations or experts to conduct audits on your AI system. "]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.10","\tRequest comprehensive documentation from the model developer, including information on the training process, feature selection, hyperparameter tuning, and any constraints imposed on the model"]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.11","\tObtain evidence of fairness assessments conducted during the model development. This may include fairness metrics, demographic parity analysis, and other techniques used to evaluate and address biases."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.12","\tEvaluate reports or documentation on model explainability. Understand how the model's decisions can be interpreted and how the system addresses the trade-off between complexity and interpretability. You should receive clear explanations about  complex or black box models from the provider."]
[3.2,"Before procuring AI systems, datasets or coding, there has been appropriate due diligence undertaken on accuracy, bias and the trade-offs that have been considered in the design. ","3.2.13","\tAsk for evidence of user testing and feedback to understand how different user groups experienced the system, and whether trade-offs had a disparate impact on certain user categories. "]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.1","\tIdentify the distinct sets of processing operations and their purposes in order to understand the relationship."]
[{"$f":"A22","v":3.3},{"$f":"B22","v":"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing."},"3.3.2","\tEnsure written contracts clearly identify the controller(s) and processor(s) relationships and their specific responsibilities, including who decides the purposes and means of the processing in practice."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.3","\tInclude clear, specific, and detailed written instructions within contracts that state that the processor must only act on the controller's documented instructions, unless required by law to act without them."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.4","\tObtain senior management approval and ensure contracts are signed and dated by both parties."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.5","\tEnsure there is written authorisation and a contract in place with all sub-processors."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.6","Draft contracts to include comprehensive details of the processing:\n- \tthe subject matter of the processing;\n- \tthe duration of the processing;\n- \tthe nature and purpose of the processing;\n- \tthe type of personal information involved;\n- \tthe categories of people;\n- \tthe controller’s obligations and rights;\n- \tthe decision-making boundaries of each party; and\n- \tthe agreed technical and organisational controls and settings for the AI system."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.7","Include terms or clauses stating that:\n- \tthe processor must only act on the controller’s documented instructions, unless required by law to act without them;\n- \tthe processor must ensure that people processing the information are subject to a duty of confidence;\n- \tthe processor must only engage a sub-processor with the controller’s prior authorisation and under a written contract; and\n- \tthe processor must take appropriate measures to help the controller respond to requests from people to exercise their rights."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.8","Include the technical and organisational security measures the processor will adopt, including: \n- \tencryption; \n- \tminimisation or pseudonymisation; \n- \tresilience of processing systems; and \n- \tbacking up personal information in order to be able to reinstate the system."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.9","\tInclude clauses to instruct processors to delete or return all personal information at the end of the contract, unless the law requires its storage."]
[3.3,"There are written contracts in place with third parties that clearly identify the controller and processor roles and responsibilities of each party, and include details of information processing.","3.3.10"," Include clauses to ensure that the processor assists in meeting UK GDPR obligations for the security of processing, the notification of personal data breaches and DPIAs."]
[3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.1","\tHave contracts that are timebound and reviewed periodically, and conduct routine in-life compliance checks to ensure they remain up-to-date."]
[{"$f":"A32","v":3.4},"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.2","\tDocument a process for managing the ongoing relationship between all parties."]
[3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.3","\tReview the practical day-to-day management of the AI system to provide assurance that the agreed roles and responsibilities are fulfilled and there are no discrepancies or role creep."]
[3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.4","\tIf role or responsibility creep has occurred, undertake an assessment of existing agreements and implement changes to contracts, as appropriate."]
[3.4,"There are in-life contract monitoring or one-off arrangement reviews to ensure partners abide by agreements.","3.4.5","\tInclude clauses within contracts to allow audits or checks to confirm all parties are complying with all contract terms and conditions."]

{"sheet":"4. Data minimisation","index":8,"n_rows":27,"n_cols":10,"rows_kept":27,"cut":false,"hidden":false,"merged":[[19,1,26,1],[19,0,26,0],[1,0,6,0],[1,1,6,1],[7,1,18,1],[7,0,18,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYY)"]
[4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.1"," Assess the features used to train the AI system are adequate, relevant and limited for the purpose. Ensure the system is designed so that only that information is processed."]
[{"$f":"A2","v":4.0999999999999996},"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.2","Consider applying privacy-preserving techniques, such as differential privacy, homomorphic encryption, or federated learning, where resource allows. These techniques allow the AI model to be trained on decentralised information sources without exposing raw, sensitive information."]
[4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.3","Ensure the training data can be modified to reduce the extent it can be traced back to specific people."]
[4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.4","Include specific review phases in development plans to check information is minimised and not retained when no longer needed."]
[4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.5"," Include a justification in the DPIA for retaining information, where applicable."]
[4.0999999999999996,"There is a review of the relevance of personal information at each stage of system development and training before go live, including detailed justification for the retention of the information and confirmation that irrelevant information has been removed or deleted.","4.1.6","Confirm that inadequate and irrelevant information is removed or deleted during the system development phase."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.1","Standardise the checks required in a checklist or test plan which includes:\n- \ta check of the current features within the system;\n- \ta review of retention of information; and \n- \tpotential further minimisation of information used."]
[{"$f":"A8","v":4.2},{"$f":"B8","v":"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. "},"4.2.2","Assess whether: \n- \tall the information is needed (eg would the whole address or just the postcode produce the same result); and \n- \tthe same volume of information is required (or whether the same results can be achieved with less volume)."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.3"," Consider document 'cropping' or redaction for both collection and sharing purposes."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.4","Map out all the processes in the different phases of your AI system that personal information is used in."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.5","Ensure the mapping, and then subsequent assessment for the potential minimisation of information, includes information used in the production of the system. Then retrain the system  as part of ongoing research."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.6","Index the personal information used in each phase of the AI system lifecycle."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.7","Implement automated data tracing to track the information processed across the whole system."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.8","Have measures to detect any duplicated information present in different phases (from production to research) and delete where necessary."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.9","Implement audit trails that log and track the usage of information throughout the AI system. This includes recording access, modifications, and processing activities. Regularly review and analyse these logs to identify any unnecessary processing."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.10","Implement data masking or anonymisation techniques to replace or obscure personally identifiable information and other sensitive information. This ensures that only necessary information is visible to the AI system while preserving privacy."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.11","Integrate automated information validation checks to verify the integrity and quality of incoming information. This helps identify and filter out irrelevant or erroneous information, ensuring that only accurate and relevant information is processed."]
[4.2,"There is ongoing monitoring and testing of the use of information to ensure: \n\n- \tonly the minimum information required is being processed by the AI system;\n- \tany unnecessary duplicated information is identified and tracked (eg through automated data tracing); and \n- \tany unnecessary duplicated information is then deleted, where necessary. ","4.2.12","Deploy continuous monitoring tools that assess the AI system's compliance with information use policies. These tools can trigger alerts or notifications when deviations from established processing norms are detected."]
[4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.1"," Apply classification to personal information based on its sensitivity and set the corresponding retention periods for each category."]
[{"$f":"A20","v":4.3},"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.2","Document the retention schedule based on business need,  statutory requirements and other principles. "]
[4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.3"," Provide sufficient information in the schedule to allow you to identify all records and put disposal decisions in to effect."]
[4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.4","Standardise and document planned weeding activities and ensure they occur on an ongoing or regular basis (eg a process of rolling deletion of information)."]
[4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.5","Delete or destroy all personal information held within AI systems in line with the retention schedule. If it is not possible to permanently delete the information (due to system functionality restrictions), store it securely 'out of reach' and lock down access, or anonymise it."]
[4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.6","Remove or erase training data that is no longer required (eg because it is out of date and no longer predictively useful)."]
[4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.7","Document the justification for any decision to keep personal information outside the retention period. "]
[4.3,"There is a documented retention policy and schedule in place and evidence that the schedule is adhered to (ie personal information is deleted in line with the schedule, or retention outside the schedule is justified and approved).","4.3.8"," Consider reproducibility (ie being able to reproduce the results at a later time, but being unable to do so as the original information has been deleted)."]

{"sheet":"5. Info security & integrity","index":9,"n_rows":70,"n_cols":10,"rows_kept":70,"cut":false,"hidden":false,"merged":[[51,0,58,0],[51,1,58,1],[59,0,69,0],[59,1,69,1],[33,1,38,1],[33,0,38,0],[39,0,46,0],[39,1,46,1],[47,1,50,1],[47,0,50,0],[1,1,12,1],[1,0,12,0],[13,0,23,0],[13,1,23,1],[24,1,32,1],[24,0,32,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYYY)"]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.1","Include a thorough assessment of the security risks in your DPIA and the mitigating controls to reduce the likelihood and impact of an attack or breach."]
[{"$f":"A2","v":5.0999999999999996},{"$f":"B2","v":"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach."},"5.1.2","Implement technical controls to mitigate any security risks in the system design and build phases, where appropriate."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.3","Consult with skilled technical experts as part of the risk assessment (eg traditional software engineers, systems administrators, data scientists, statisticians, as well as domain experts)."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.4","Commission regular external security audits."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.5","Assess security risks specific to AI models (eg data poisoning, model inversion, data leakage and model theft)."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.6","Conduct comprehensive vulnerability assessments of the AI system's architecture, components and dependencies to identify potential security weaknesses and entry points for attackers. This involves scanning for known vulnerabilities, misconfigurations and outdated software versions."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.7"," Perform penetration testing to simulate real-world attacks and assess the system's resilience to various threat scenarios. This includes conducting controlled attacks to identify potential security flaws, vulnerabilities and exploitation vectors that could be leveraged by attackers."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.8","Conduct code reviews and static analysis of the AI system's source code to identify security vulnerabilities, coding errors, and logic flaws that may introduce security risks. This involves reviewing code for common security issues such as injection flaws, authentication bypass and data exposure."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.9"," Review the AI system's security architecture and design to ensure that security controls are appropriately implemented and aligned with security best practices and industry standards. This includes assessing the effectiveness of access controls, encryption mechanisms and authentication mechanisms."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.10"," Implement secure configuration management practices to ensure that the AI system is configured according to security best practices and hardened against potential attacks. This involves applying security configurations, disabling unnecessary services and limiting privileged access."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.11"," Complete threat modelling exercises to identify potential threats and attack vectors that could compromise the security of the AI system. This involves analysing system components, information flows and trust boundaries to identify potential security risks and prioritise mitigation efforts."]
[5.0999999999999996,"There has been a thorough assessment of security risks to or in the AI system before its implementation to reduce the likelihood of an attack or breach.","5.1.12"," Consider the impact on the security of any connected systems if you need to integrate existing systems, and put appropriate controls in place as part of the design and build phases."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.1"," If processing biometric data (eg facial images), consider how easily an attacker could probe the model and reconstruct the image. Also consider whether it is necessary to provide 'confidence' information to the end user (as this could be used to exploit the system)."]
[{"$f":"A14","v":5.2},{"$f":"B14","v":"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples."},"5.2.2","Check the system to identify possible attacks if a large series of inputs, information or queries are entered into the system by a single source with the aim of identifying or extracting personal information (eg through monitoring queries from people through the API)."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.3"," Implement measures to prevent the unauthorised extraction of information from either the main system or training datasets."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.4","Implement measures to reduce the number of queries that can be performed by a particular person in a given time limit (rate limiting)."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.5","Apply different measures for black box and white box attacks. (Note: white box attacks are when the attacker has complete access to the model itself to inspect underlying code. Whereas in black box attacks, the attacker can only query the model and observe relationships between inputs and outputs.)"]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.6","Implement measures to ensure that AI models are not vulnerable to privacy attacks through 'overfitting' (ie the model has been designed to pay too much attention to the details of the training data, remembering particular examples rather than just general patterns)."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.7","Implement secure model training techniques to protect against privacy attacks during the training phase. "]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.8","Ensure secure deployment of AI models in production environments by implementing secure coding practices. This helps prevent the exploitation of vulnerabilities in deployed models and mitigates the risk of privacy attacks in operational settings."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.9","Restrict access to the underlying code and properties of the system or model."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.10","Closely monitor access to the model or training data by third parties and restrict access as necessary."]
[5.2,"Security measures are in place to prevent privacy attacks on AI models through model inversion, membership inference or adversarial examples.","5.2.11","Assess the trade-off between explainability of the model and the risk of a security breach (ie the more explainable the model, the greater the risk of model inversion and membership inference attacks)."]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.1","If you make changes to a software stack (and possibly hardware), review if there are any new security risks."]
[{"$f":"A25","v":5.3},"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.2"," Document technical security controls within system operating procedures."]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.3","Subject the software to a security review where one or more people view and read parts of its source code. At least one of the reviewers must not be the author of the code."]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.4","Implement appropriate system vulnerability monitoring and testing tools or software."]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.5","Log the outputs of system vulnerability monitoring and conduct proactive analysis on any anomalies."]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.6"," Ensure there is a solid patching and updating process in place so that available security fixes are applied in a timely manner."]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.7","Undertake independent internal reviews of the information security management system, including internal audits and internal IT health checks (ITHC). "]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.8","  Commission external technical compliance reviews of key systems, including vulnerability assessments, internal health checks and penetration testing."]
[5.3,"There is ongoing monitoring of the AI system for vulnerabilities and regular testing, assessment and evaluation of information security measures (eg through techniques such as penetration testing). Security fixes are applied where appropriate.","5.3.9","Capture all issues and risks identified as part of any internal or external testing on an action plan and risk register and mitigate or treat, as appropriate."]
[5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.1","Detail how the AI development system is segregated from the main IT network in policy."]
[{"$f":"A34","v":5.4},"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.2","Include separation plans in the system design documents."]
[5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.3","Keep the AI system in a suitably secure environment."]
[5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.4","Isolate the AI development environment from the production network and other critical infrastructure by network segmentation, physically or logically. This involves creating separate network zones, subnets, or VLANs for development activities, with restricted access controls and firewall rules to prevent unauthorised communication between environments."]
[5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.5","Create isolated development environments that are independent of the production infrastructure, using virtualisation or containerisation technologies. "]
[5.4,"The AI development environment is separated from the rest of the IT network and infrastructure. There is evidence that the separation is adhered to.","5.4.6","Maintain a back up of the AI system in case the main AI system becomes unavailable. Keep the back up in a separate location."]
[5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.1","Undertake active monitoring of API requests for suspicious activity."]
[{"$f":"A40","v":5.5},"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.2","Log, investigate and escalate all issues detected, where necessary."]
[5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.3","Deploy external and internal firewalls and intrusion detection systems to strengthen the security of information in your networks and systems and prevent unauthorised access or attack (eg denial of service (DOS) attacks)."]
[5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.4","Monitor network traffic for unusual or malicious incoming or outgoing activity."]
[5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.5","Have a response plan ready to manage an attack, minimising disruption to legitimate service users."]
[5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.6","Have a robust supply chain risk management programme in place and apply a process for monitoring, managing, and reviewing systems, processes and access throughout your supply chain."]
[5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.7","Avoid digital supply chain attacks by limiting the use of commonly used libraries to enable a function in the AI application."]
[5.5,"There is active monitoring of network activity to detect suspicious requests and take action as a result.","5.5.8","Maintain an awareness of possible threats and act swiftly to implement corrective measures."]
[5.6,"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering.","5.6.1","Encrypt information across networks, where required."]
[{"$f":"A48","v":5.6},"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering.","5.6.2","Encrypt information in storage (at rest) in line with risk."]
[5.6,"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering.","5.6.3","Implement measures to secure information collection sites or web forms from malicious attacks or corruption (or DOS attacks)."]
[5.6,"When collecting personal information, there are effective measures in place to ensure the information gathered is secured at the point of collection and in transit and to mitigate any security and integrity risks associated with the information gathering.","5.6.4","Undertake information accuracy and integrity testing on personal information sourced or collected indirectly from third parties as part of the build and testing phases of the system development."]
[5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.1","Encrypt information across networks, where required."]
[{"$f":"A52","v":5.7},"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.2","Grant access to the AI system only if there is a legitimate need. "]
[5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.3","Limit access to personal information to authorised staff only."]
[5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.4","Implement a formal access provisioning process to assign access rights to staff."]
[5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.5","Restrict and control the allocation and use of privileged access rights."]
[5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.6","Review user access rights at regular intervals."]
[5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.7","Remove access rights in a timely fashion when staff leave your organisation."]
[5.7,"There are effective mechanisms in place to prevent unauthorised access (read or write), or inappropriate changes being made to datasets.","5.7.8","Adjust access rights when there is a change of assignment or role. "]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.1","Allocate responsibility for assessing, managing and reporting on business continuity (BC) and disaster recovery (DR) risks in a structured hierarchy."]
[{"$f":"A60","v":5.8},{"$f":"B60","v":"There are business continuity and disaster recovery plans in place."},"5.8.2","Take proactive steps to identify, record and manage risks to BC and DR."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.3","Put measures in place to safeguard against physical and environmental disruption."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.4","Determine the requirements for information security (IS) and IS management in the event of a disaster (ie information continues to remain secure, by default if necessary)."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.5","Put in place a documented BC and DR policy and procedures to manage high impact incidents."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.6","Deliver specialised training for the Incident and Emergency Response team(s)."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.7","Put in place provisions for a temporary physical space in the event of loss of access to the primary site. "]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.8","Implement a pre-determined restoration strategy appropriate to the importance of the system and information."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.9","Back up key systems, applications and information to protect against loss of personal information."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.10","Build BC and DR arrangements into all third-party relationships."]
[5.8,"There are business continuity and disaster recovery plans in place.","5.8.11","Analyse and report on BC and DR level events and near misses and their resolutions."]

{"sheet":"6. DP by design","index":10,"n_rows":11,"n_cols":10,"rows_kept":11,"cut":false,"hidden":false,"merged":[[1,1,7,1],[1,0,7,0],[8,0,10,0],[8,1,10,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.1","Bake in’ data protection to your processing activities and business practices, throughout the lifecycle from the design stage . "]
[{"$f":"A2","v":6.1},"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.2"," Document the approach and methodology for identifying and assessing AI trade-offs, including the reasons for adopting or rejecting particular technical approaches."]
[6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.3","Use available technical approaches to minimise the need for any trade-offs and evaluate the potential impact on people."]
[6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.4","Review trade-offs regularly by applying a robust, independent, and risk-based process."]
[6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.5","Review emerging or new trade-offs that could arise if new considerations come to light during ongoing system performance monitoring and quality assurance checks."]
[6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.6","Consider the following when designing your AI system:\n- \tAI algorithm accuracy vs explainability (increasing data points means more accurate algorithms but are more difficult to work with and for people to understand).\n- \tAI accuracy vs speed (increasing data points may improve accuracy but reduce speed of decisions).\n- \tAI transparency vs understandability (too much technical detail might prevent people from understanding).\n- \tAI transparency vs security risk (explaining the system fully to people may highlight security vulnerabilities)."]
[6.1,"A risk-based approach has been taken to analysing and navigating potential and existing trade-offs between data protection considerations and people’s rights on one hand and other competing values and interests on the other.","6.1.7","\tEnsure decisions made during the trade-off analysis are signed off at an appropriately senior level."]
[6.2,"As part of model and system development, there is a documented assessment to balance the trade-off between the level of human work and automation (where the level of human involvement reduces over time as the AI model moves to full automation).","6.2.1","Include a development timeline with set milestones and review dates in the product and technical specification documents."]
[{"$f":"A9","v":6.2},"As part of model and system development, there is a documented assessment to balance the trade-off between the level of human work and automation (where the level of human involvement reduces over time as the AI model moves to full automation).","6.2.2","Document the analysis and decisions of trade-offs about human involvement vs automation in a DPIA. This helps to ensure compliance with UK GDPR articles 5(2) and 22."]
[6.2,"As part of model and system development, there is a documented assessment to balance the trade-off between the level of human work and automation (where the level of human involvement reduces over time as the AI model moves to full automation).","6.2.3","Test each move to further automation for accuracy and ensure this is signed off at a senior level."]

{"sheet":"7. Statistical accuracy","index":11,"n_rows":36,"n_cols":10,"rows_kept":36,"cut":false,"hidden":false,"merged":[[23,0,30,0],[23,1,30,1],[31,0,35,0],[31,1,35,1],[1,1,8,1],[1,0,8,0],[9,1,17,1],[9,0,17,0],[18,1,22,1],[18,0,22,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.1","Document and implement information management processes that detail the data labelling requirements and steps."]
[{"$f":"A2","v":7.1},"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.2","Train staff who are responsible for determining the labelling of datasets appropriately to ensure the quality and accuracy of labels set."]
[7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.3","Include quality assurance (QA) procedures into the labelling process, including:\n- \t'human in the loop' QA processes for any automated labelling processes; and\n- \tsecurity and QA measures, if you use a third-party data labelling service."]
[7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.4","Include labelling for blind spots and biases and ensure all labelling testing includes an analysis of 'edge cases' (rare and unusual situations which do not happen often). This is so these are not excluded, missed or misinterpreted."]
[7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.5"," Ensure the least amount of information is used in the process (eg adding data incrementally into the data labelled sets)."]
[7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.6","Ensure that a resolution process is in place if disagreements on labelling for edge cases occur."]
[7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.7","Document all decisions about features that won't be labelled."]
[7.1,"There are appropriate and effective measures in place to ensure that where appropriate datasets are relied on for determining statistical accuracy, they are accurately and fairly labelled, and do not cause detriment to people.","7.1.8","Keep data labels under review."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.1","Establish a model evaluation framework to systematically assess the performance of the AI system against predefined accuracy metrics before implementation. This involves designing experiments, conducting tests, and analysing results to quantify the system's predictive performance and identify areas for improvement."]
[{"$f":"A10","v":7.2},"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.2","Ensure the test plan includes all the relevant checks to provide assurance that there are no errors in data outputs or statistical errors."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.3","Document target accuracy rates and tolerances for errors in the test plan."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.4","Include minimum success criteria for current performance in the test plan, and monitor false acceptance and rejection rates."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.5","Run and test the system in 'ghost mode' or in a testing environment to understand accuracy levels."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.6","Retrain the AI system following accuracy testing."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.7","Test the AI system on new data set(s) to confirm the same outcome is reached."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.8","Conduct ‘decision gate’ reviews as part of the go live process to evaluate the results of statistical accuracy testing and make informed decisions about system readiness."]
[7.2,"The statistical accuracy of new AI systems or changes to existing AI systems is tested, documented, and consistently achieves the required accuracy level before the go live decision. The decision making process to go live is documented and includes confirmation that the organisation's required statistical accuracy level is achieved.","7.2.9","Ask senior management to sign off acceptance of the test results. "]
[7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.1","Detail the methodology the human reviewer will use when testing the system for statistical accuracy. The test plan should outline the criteria, requirements and sampling method and size. "]
[{"$f":"A19","v":7.3},"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.2","Check that the rate of error in data outputs or statistical errors is within acceptable and documented tolerances."]
[7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.3","Retrain the AI system following testing (eg by improving input data, different balance of false positives and negatives, or using different learning algorithms)."]
[7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.4","Test the AI system on new data set(s) to confirm consistency in statistical accuracy rates. "]
[7.3,"There are processes in place to ensure there is a human review of the statistical accuracy of the AI system.","7.3.5","Ask senior management to sign off acceptance of the test results."]
[7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.1","Implement a regular testing regime to monitor the AI system and introduce metrics or thresholds that trigger tests for statistical accuracy on an ongoing basis. Include relevant checks to identify errors in data outputs, tolerances for errors, and document the results."]
[{"$f":"A24","v":7.4},"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.2","Monitor AI for overfitting (ie when a learning algorithm pays too much attention to the specific features in the training datasets, which can impact a person who isn’t similar to the people in the training datasets). For example, by monitoring precision and recall to identify possible overfitting."]
[7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.3","Test the AI system using new data set(s) to confirm the same statistical accuracy rates are reached, and change the learning process, if required."]
[7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.4","Consider retraining the AI systems as necessary (eg by implementing algorithmic fairness measures, fairness constraints, improving input data, using a different balance of false positives and negatives, or using different learning algorithms)."]
[7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.5","Undertake regular compliance checks to provide assurance for AI systems or components managed by third parties."]
[7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.6","Modify or delete information that reflects past inaccuracy from the system if no longer relevant to the current decision."]
[7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.7"," Carry out tests which include running a traditional decision-making system and an AI system concurrently and investigate any significant difference in the type of decisions."]
[7.4,"AI systems are regularly monitored or tested to ensure outputs are fair and within statistical accuracy tolerance rates, and there are no discriminatory outputs or decisions made.","7.4.8"," Save AI models separately so models can revert back to a previous version if significant drift occurs."]
[7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.1"," Log all complaints about your AI and track the issue, the response, and the response date."]
[{"$f":"A32","v":7.5},"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.2","Analyse the complaints to determine trends, issues, and risks, and share this with senior management."]
[7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.3","Develop incident response procedures to handle and address any issues or failures identified during post-implementation testing. This includes defining escalation paths, assigning responsibility for resolution, and implementing corrective actions to mitigate the impact of incidents on system performance."]
[7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.4","Establish a continuous improvement process to iteratively enhance the AI system based on insights gained from complaints in accuracy."]
[7.5,"Any complaints about inaccurate or discriminatory and biased outputs from AI systems are documented and appropriate timely action is taken.","7.5.5","Educate staff on how to respond to people challenging AI decisions or outputs.  If the challenge is upheld, review and amend practices, where necessary."]

{"sheet":"8. Discrimination & bias","index":12,"n_rows":18,"n_cols":10,"rows_kept":18,"cut":false,"hidden":false,"merged":[[1,1,5,1],[6,1,9,1],[10,1,17,1],[10,0,17,0],[6,0,9,0],[1,0,5,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.1","Consider implementing measures to avoid discrimination against people because of protected characteristics at all stages of the AI system life cycle."]
[{"$f":"A2","v":8.1},"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.2","Implement algorithmic fairness techniques such as: \n- \tpre-processing (adjusting training datasets);\n- \tin-processing (applying factors or constraints in model training); and \n- \tpost-processing (interventions and outputs). "]
[8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.3","Conduct analysis of algorithmic fairness limitations, such as: \n- \tunequal distribution of protected characteristics; \n- \tintersectional discrimination if a person fits multiple protected characteristics; and \n- \treliance on false positives and true negatives."]
[8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.4","Maintain evidence that could assist with fairness compliance obligations as the controller throughout the AI system supply chain."]
[8.1,"Fairness has been a primary consideration throughout the design, development, and deployment of AI systems or components and associated personal information processing.","8.1.5","Ensure fairness is considered at different stages of the AI system:;\n- \tproject design (eg by mapping of objectives, examining decision scope, reviewing bias measurability, consulting stakeholders, and adopting participatory design);\n- \tbefore processing personal information;\n- \tduring information collection and procurement;\n- \tduring data analysis, labelling and pre-processing;\n- \tin AI model evaluation and monitoring; and\n- \twhen retiring or decommissioning."]
[8.1999999999999993,"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. ","8.2.1"," Include protected characteristics in the AI model, where appropriate or necessary, to ensure the system does not discriminate against these characteristics."]
[{"$f":"A7","v":8.1999999999999993},"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. ","8.2.2"," Test these characteristics thoroughly to ensure they produce the right outputs consistently."]
[8.1999999999999993,"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. ","8.2.3","Assess and document in a DPIA the risks associated with including protected characteristics and how the risks have been mitigated."]
[8.1999999999999993,"Consideration is given to protected characteristics in the system design, if applicable, to ensure fairness, positive action and equity of outcome. ","8.2.4","Assess whether it would be a disproportionate effort to ask for additional information from people in order to proactively include protected characteristics (bearing in mind data minimisation principles)."]
[8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.1","Document and implement a testing process for discriminatory outputs and bias and monitor it before implementation."]
[{"$f":"A11","v":8.3000000000000007},"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.2","Include in your DPIA an assessment of the potential discriminatory risks associated with processing personal information, particularly concerning people who need extra support to protect themselves."]
[8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.3","Use existing policy, technical, user research and design expertise to help determine sector-wide risks."]
[8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.4"," Consider discrimination and bias right from the start of the design phase, including AI potentially processing special category and biometric data."]
[8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.5","Conduct appropriate assessments before deploying AI as a service to ensure there isn't potential for discriminatory outputs or decisions to be made."]
[8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.6","Integrate human-in-the-loop validation processes to review and validate the AI system's outputs for fairness and equity before go-live. This includes involving appropriate experts in the validation process to provide feedback and identify potential biases or discriminatory patterns."]
[8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.7","Test using new data sets to confirm the same outcome is reached."]
[8.3000000000000007,"The potential for discriminatory outputs and bias within or by using the AI system is tested, documented, and mitigated before the go live decision.","8.3.8","Adapt, change or retrain the AI following the review if necessary before go live."]

{"sheet":"9. Human review","index":13,"n_rows":15,"n_cols":10,"rows_kept":15,"cut":false,"hidden":false,"merged":[[1,1,10,1],[1,0,10,0],[11,1,14,1],[11,0,14,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.1"," Undertake regular assessments to determine where a human review is most appropriate and beneficial. "]
[{"$f":"A2","v":9.1},{"$f":"B2","v":"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions."},"9.1.2","Document details of the methodology a human review will use when testing the system for statistical accuracy and bias."]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.3","Document the testing process or test plan to outline: \n- \tthe criteria and requirements for testing; \n- \tthe sampling method and size;\n- \tthe target accuracy rates and acceptable tolerance; and\n- \tthe checks required to ensure that the rate of error in data outputs or statistical errors is within acceptable and documented tolerances."]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.4","Maintain a log of when AI decisions are overridden by a human reviewer, including the reasons why."]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.5","Report the results of the testing to senior management and key stakeholders."]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.6","Check that the reviews are done at appropriate stages and as directed, if the human review is outsourced to a third party."]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.7","Ensure that human reviewers have appropriate qualifications. "]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.8","Assign human reviewers a manageable caseload and ensure there is sufficient resource in place for them to give appropriate time to their tasks.  "]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.9","Provide human reviewers with adequate training. "]
[9.1,"AI decisions involve meaningful human review and checks, where appropriate, to mitigate eroding of privacy through selection bias and attempts to spoof controls or circumvent privacy measures. Human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions.","9.1.10","Ensure human reviewers are independent and are able to influence senior-level decision making. Reflect the reporting lines both in job descriptions and in the overall organisational framework."]
[9.1999999999999993,"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system.","9.2.1","Maintain separate provider and deployer human review processes."]
[{"$f":"A12","v":9.1999999999999993},"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system.","9.2.2","Log human review decisions, including actions taken by a human reviewer to challenge or override automated decision making and the considerations they made when making their final decision. "]
[9.1999999999999993,"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system.","9.2.3","Ensure the process is appropriately designed, such as by testing on a sample of decisions."]
[9.1999999999999993,"There are documented controls in place to prevent human review practices from introducing deficiencies or errors into the future decision making by the AI system.","9.2.4","Implement processes to support a re-review or overturning of decisions (eg if there is one rogue human reviewer)."]