For each AI use, its purpose is registered. Where AI acts autonomously (agents, scripts or automations), what it does is described.
Tier II
Optional extra depth on top of the baseline. Organizations with more mature AI governance, or more exposure, may choose to adopt these for more thorough control over AI than the baseline alone provides.
Why
AI systems that are embedded in processes (scripts, workflows, agents) often operate independently of their creator, and may continue to do so after that person leaves. If the provider and logic are not logged, this important information may be lost and the AI system cannot properly be assessed on compliance with security/privacy controls and (changed) regulations.
How
For each listed AI use (as understood here: an AI system set up for a specific task, such as an agent, script, workflow or dedicated tool), its purpose should be included in the register (see RG.1), along with what the system does, what it connects to and what data it sends where.
Sources
- NIST AI RMF MAP 1.1
- NIST AI RMF MAP 2.1
- ISO/IEC 42001 A.9.4
- ISO/IEC 42001 A.4.4
- ISO/IEC 42001 A.9.4