2_use_case_name: Grammarly
3_agency: Department of Commerce
3_abr: DOC
4_bureau: NIST - National Institute of Science and Technology
8_topic_area: Education & Workforce
10_commercial_ai: Improving the quality of written communications using AI tools.
11_purpose_benefits: Improving the quality of written communications, idea generation, refine tone and style. 
12_outputs: Grammar, punctuation, style improvements, content generation
16_dev_stage: Operation and Maintenance
17_impact_type: Neither
18_date_initiated: 2/3/2023
19_date_acq_dev_began: 6/16/2023
20_date_implemented: 1/17/2024
22_dev_method: Developed with contracting resources.
23_contract_piids: NNG15SC82B
24_hisp_support: No
27_public_info: No
29_contains_pii: No
30_saop_review: Yes
31_data_catalog: No
34_data_docs: Documentation is missing or not available: No documentation exists regarding maintenance, composition, quality, or intended use of the training and evaluation data.
35_demo_features: Other
35_question_type: Does not use any demographic variables.
37_custom_code: No
38_code_access: No – agency does not have access to source code.
40_has_ato: Yes
41_system_name: GrammarlyGo
43_infra_provisioned: No
45_compute_request: Other
45_question_type: There is a process in place to request a Grammarly account. GrammarlyGo does not use our data for training.
47_timely_resources: Other
47_question_type: Grammarly is a cloud app that we support and provision accounts for those that request a license
49_existing_reuse: None: This use case does not re-use any internally developed tooling or managed infrastructure from any other AI development efforts within the agency.
50_internal_review: No documentation is available: No documentation detailing model performance metrics, model architecture, features and intended use of the models have been created or are currently accessible to other data science teams within the agency.
51_extension_request: No – Agency did not request an extension for this use case.
52_impact_assessment: Yes
53_real_world_testing: No testing: No testing of the model to simulate performance in an operational environment has been conducted thus far.
54_key_risks: Risks to NIST were determined through Assessment and Authorization process by NIST Security Control Assessors. They documented that the most significant risk to NIST is moderate-level data going to a cloud vendor that does not have a FedRAMP authorized package and is not currently in process to become FedRAMP. Grammarly does not meet Department of Commerce Security and Privacy Assessment and Authorization Handbook requirements. There are deficiencies restricting staff to US only personnel, specific documentation about use of FIPS 140-2 validated encryption, TIC 2.0 architecture implementation, and Grammarly is unable to send logs to DOC SIEM tools.

This is mitigated in multiple ways:
•	Grammarly has multiple independent assessments, including a SOC 2 Type II assessment.
•	Grammarly provided other internal security documentation for review.
•	NIST data is only used by Grammarly to perform grammar recommendations. All data is purged from Grammarly servers within 3 hours.
•	NIST data is not used for training purposes.
•	Grammarly uses Amazon Web services for its infrastructure, which has FedRAMP Moderate authorization.
•	Grammarly uses Microsoft Azure AI for AI recommendations, which has FedRAMP High authorization.

Other key risks are as follows: 

•	Logins to Grammarly are logged and viewable by administrators, but the actual usage of Grammarly by the user is not logged. This is mitigated by Grammarly’s limited built-in data loss prevention (DLP) that is enabled. This prevents the following data types from going up to Grammarly for analysis: email addresses, URLs, phone numbers, credit card numbers, and Social Security numbers.

55_independent_eval: Yes – by another appropriate agency office that was not directly involved in the system’s development
56_monitor_postdeploy: Automated and Regularly Scheduled Updates: Some aspects of the plan to monitor the AI system post-deployment are automated including re-training of models after detecting drift; however, data science teams are still significantly involved in the monitoring and re-deployment process.
57_autonomous_impact: Yes - All individual decisions or actions are automated and may be rendered without direct human interaction.
59_ai_notice: Other 
59_question_type: Training was provided to end users on how to use the Grammarly application. If users have any questions, they submit a ticket through ServiceNow.
61_adverse_impact: No
62_disparity_mitigation: The model provides grammar and phrasing recommendations. All staff are presumed to be English subject matter experts and do not need to accept any proposed response from Grammarly. Staff are advised that they are ultimately responsible for the content of their responses.
63_stakeholder_consult: None of the above
65_appeal_process: Yes
67_opt_out: Yes