AIG-02 · AI and Automated Decisions
AI risk assessed before deployment
AI systems are assessed for harm, bias, robustness and transparency before use, and the assessment is revisited on change.
2frameworks fully address it
2partially
4leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2Absent No AI-specific criteria.
- ISO 27001Absent Not addressed in Annex A.
- NIST CSFPartialID.RA-01 Through risk identification.
- PCI DSSAbsent Out of scope.
- HIPAAAbsent Out of scope.
- GDPRPartialArt. 35 DPIA where processing is high risk.
- EU AI ActFullArt. 9, 27
- NIST AI RMFFullMEASURE 2.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Assessment records, bias testing, sign-off before deployment.
?Why it exists
The cost of a bad model is paid by people outside the room.
For a smaller organizationOne assessment page per model, honestly completed.