Apply careful consideration to procurement documents and contracts for AI systems or products, which may cover AI ethics principles, clearly established accountabilities, transparency of data, access to relevant information assets and proof of performance testing across the system lifecycle. Keep contracts adaptable to technological change; build internal skills and knowledge transfer from vendors to avoid lock-in; carry out due diligence on new and amplified risks (for example the opacity of foundation models, privacy and security) and check whether standard contract clauses cover them; confirm the vendor can support review, ongoing monitoring and evaluation of outputs after an incident or a stakeholder concern, including evidence for review mechanisms; and weigh a component's benefits against its assurance challenges, prioritising alignment with the ethics principles alongside the desired outcomes.
This control maps to 3 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.