AIG-03 · AI and Automated Decisions
Human oversight and disclosure
People affected by automated decisions are told, and a competent person can intervene.
3frameworks fully address it
0partially
5leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2Absent No AI-specific criteria.
- ISO 27001Absent Not addressed.
- NIST CSFAbsent Not addressed.
- PCI DSSAbsent Out of scope.
- HIPAAAbsent Out of scope.
- GDPRFullArt. 22(3)
- EU AI ActFullArt. 14, 50
- NIST AI RMFFullGOVERN 3.2
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Disclosure text, oversight procedure, intervention records.
?Why it exists
Automation without a human path becomes a wall.
For a smaller organizationSay when a model was used and who to ask.