A.1 Factors that government believes regulators may wish to consider when providing guidance/implementing each principle
PrincipleImplementation considerations Safety, security and robustnessWe anticipate that regulators will need to: 1. Provide guidance about this principle including: (i) considerations of good cybersecurity practices, such as the NCSC principles for the security of machine learning,[footnote 177] as a secured system should be capable of maintaining the integrity of information. (ii) considerations of privacy practices such as accessibility only to authorised users and safeguards against bad actors. 2. Refer to a risk management framework that AI life cycle actors should apply. Models should be regularly reviewed over time as a mitigation strategy. 3. Consider the role of available technical standards, for example addressing AI safety, security, testing, data quality, and robustness (including, ISO/IEC 24029-2, ISO/IEC 5259-1, ISO/IEC 5259-3* , ISO/IEC 5259-4* , and ISO/IEC TR 5469*) to clarify regulatory guidance and support the implementation of risk treatment measures. Appropriate transparency and explainabilityWe anticipate that regulators will need to: 1. Set expectations for AI life cycle actors to proactively or retrospectively provide information relating to: (i) the nature and purpose of the AI in question including information relating to any specific outcome, (ii) the data being used and information relating to training data, (iii) the logic and process used and where relevant information to support explainability of decision-making and outcomes, (iiii) accountability for the AI and any specific outcomes. 2. Set explainability requirements, particularly of higher risk systems, to ensure appropriate balance between information needs for regulatory enforcement (for example, around safety) and technical tradeoffs with system robustness. 3. Consider the role of available technical standards addressing AI transparency and explainability (such as IEEE 7001, ISO/IEC TS 6254, ISO/IEC 12792)[footnote 178] to clarify regulatory guidance and support the implementation of risk treatment measures. FairnessWe anticipate that regulators will need to: 1. Interpret and articulate ‘fairness’ as relevant to their sector or domain, 2. Decide in which contexts and specific instances fairness is important and relevant (which it may not always be). 3. Design, implement and enforce appropriate governance requirements for ‘fairness’ as applicable to the entities that they regulate. 4. Where a decision involving use of an AI system has a legal or similarly significant effect on an individual, regulators will need to consider the suitability of requiring AI system operators to provide an appropriate justification for that decision to affected parties. 5. AI systems should comply with regulatory requirements relating to vulnerability of individuals within specific regulatory domains. Regulators will need to consider how use of AI systems may alter individuals’ vulnerability, pursuant to their existing powers and remits. 6. Consider the role of available technical standards addressing AI fairness, bias mitigation and ethical considerations (for example, ISO/IEC TR 24027:2021, ISO/IEC 12791*, ISO/IEC TR 24368:2022) to clarify regulatory guidance and support the implementation of risk treatment measures. Accountability and governanceWe anticipate that regulators will need to: 1. Determine who is accountable for compliance with existing regulation and the principles. In the initial stages of implementation, regulators might provide guidance on how to demonstrate accountability. In the medium to long term, government may issue additional guidance on how accountability applies to specific actors within the ecosystem. 2. Provide guidance on governance mechanisms including, potentially, activities in scope of appropriate risk management and governance processes (including reporting duties). 3. Consider how available technical standards addressing AI governance, risk management, transparency and other issues can support responsible behaviour and maintain accountability within an organisation (for example, ISO/IEC 23894, ISO/IEC 42001, ISO/IEC TS 6254, ISO/IEC 5469 , ISO/IEC 25059*). Contestability and redressWe anticipate that regulators will need to: 1. Create or update guidance with relevant information on where to direct a complaint or dispute for those affected by AI harms. Guidance should clarify existing ‘formal’ routes of redress offered by regulators in certain scenarios. 2. Clarify interactions with requirements of appropriate transparency and explainability, acting as pre-conditions of effective redress and contestability.