UK AI Cyber Security Code of Practice 7.2: Justify, mitigate and disclose use of poorly documented or unsecured components

What does 7.2 require?

A system operator that chooses to use or adapt models or components that are not well documented or secured must be able to justify the choice in writing (for instance, no other supplier existed). In that case developers and system operators put mitigating controls in place and run a risk assessment tied to those components, and the system operator shares that documentation with its end-users in a form they can use.