UK AI Cyber Security Code of Practice 3.2: Pass unresolved AI threats down the chain to operators and end-users

What does 3.2 require?

When developers identify AI security threats they cannot resolve, they tell the system operators so those operators can model the threat in their own systems; system operators then inform end-users so that users know the threats exist. The communication should describe the risks, their potential impact and recommended actions to address or watch for them.

Maintained by Gerard Blokdyk

Other controls in Secure design (Principles 1 to 4) – UK AI Cyber Security Code of Practice

1.1 AI security content in the cyber security training programme
1.2 Ongoing staff awareness of AI threats, with secure AI coding training for developers
2.1 Assess the need, the risks and the mitigations before building an AI system
2.2 Design for resilience against adversarial attack, unexpected input and failure
2.3 Create an audit trail for the AI system
2.4 AI-specific risk assessment and due diligence for external components
2.5 Match intended use to data sensitivity, and encourage staff to report AI security risks
2.6 Least-privilege, risk-assessed permissions for the AI system on other systems

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All UK AI Cyber Security Code of Practice controls