Egypt National Guidelines for Trustworthy and Responsible AI (Edition 2.0, March 2026) 2.1c: Adopt procurement and vendor governance, a transparency and user communication policy, an incident response procedure and an audit and assurance procedure

What does 2.1c require?

For third-party AI the organisation sets procurement criteria specific to AI (its safety, its transparency, its sustainability), requires compliance documentation from the vendor such as TEVV results and risk reports, contractual safeguards including audit rights and disclosure of model updates, and ongoing vendor monitoring. A transparency and user communication policy requires that people be told when they are dealing with AI, that content produced by AI be labelled (watermarked, for generative AI), notification of data use and system limitations, and mechanisms for explanation or appeal. A mandatory incident response and AI failure management procedure defines what counts as an AI incident and sets the steps for reporting, escalating and containing it, for investigating it and for corrective action, and notification of regulators where applicable. An audit and assurance procedure provides for high-risk systems to be audited internally, for logs, model changes and risk documents to be reviewed, for an external audit at intervals where required, and coordination with national audit entities such as EGCERT, SECC-ITIDA, the PDPC and ECRAI.