An access review is conducted before an AI system inherits users' access rights.
Baseline
Applies to every organization that uses AI, regardless of size or sector.
Why
Most AI systems that can, among other things, search and return organizational data do so under the access rights of the user querying them. Excessive permissions that were previously unexploited become easily discoverable (potentially unintentionally) as the AI system may search within all files the user has access to.
How
Before an AI system that inherits its access rights from a user or existing permission set is connected to organizational data, the access rights on that data are reviewed. This process should be integrated into existing access review processes and be triggered upon the procurement of new inheritance-based AI systems or when such functionality is added to existing systems.
Sources
- No equivalent in NIST AI RMF, ISO/IEC 42001 or the EU AI Act.