When assessing an AI system, evaluate the likelihood and consequence of each risk and the consequence of not deploying the system, by: (a) identifying the severity and likelihood of harms to stakeholders from the stakeholder impact assessment; (b) identifying legal, commercial and reputational risks such as failing legal obligations or commitments on ESG, diversity, inclusion, accessibility or fairness programmes; (c) considering amplified and emerging data governance risks in each lifecycle phase, before and after training; (d) analysing risks systemically with risk models that trace sources and pathways; (e) comparing risk levels with the organisation's criteria or those set by regulators or stakeholders; (f) documenting use cases or qualities that are an unacceptable risk; and (g) communicating assessments in clear formats to relevant stakeholders.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.