GRC-12AI-Specific

Ethics Committee

Specification

Establish an ethics committee to review AI applications, ensuring alignment with ethical standards and organizational values.

Threat coverage

Model manipulation

Data poisoning

Sensitive data disclosure

Model theft

Model/Service Failure

Insecure supply chain

Insecure apps/plugins

Denial of Service

Loss of governance

Architectural relevance

Physical infrastructure

Network

Compute

Storage

Application

Data

Lifecycle

Preparation

Team and expertise

Development

Guardrails

Evaluation

Evaluation, Validation/Red Teaming

Deployment

Orchestration, AI Services supply chain

Delivery

Operations, Maintenance, Continuous monitoring, Continuous improvement

Retirement

Archiving, Data deletion, Model disposal

Ownership / SSRM

Owned by the Customer (AIC)

The Customer (AIC) is responsible and accountable for the design, development, implementation, and enforcement of the control to mitigate security, privacy, or compliance risks associated with Large Language Model (LLM)/GenAI technologies services or products they consume.

Model

Owned by the Model Provider (MP)

The model provider (MP) designs, develops, and implements the control as part of their services or products to mitigate security, privacy, or compliance risks associated with the Large Language Model (LLM). Model Providers are entities that develop, train, and distribute foundational and fine-tuned AI models for various applications. They create the underlying AI capabilities that other actors build upon. Model Providers are responsible for model architecture, training methodologies, performance characteristics, and documentation of capabilities and limitations. They operate at the foundation layer of the AI stack and may provide direct API access to their models. Examples: OpenAI (GPT, DALL-E, Whisper), Anthropic(Claude), Google(Gemini), Meta(Llama), as well as any customized model.

Orchestrated

Owned by the Orchestrated Service Provider (OSP)

The Orchestrated Service Provider (OSP) is responsible for the design, development, implementation, and enforcement of the control to mitigate security, privacy, or compliance risks associated with Large Language Model (LLM)/GenAI technologies in the context of the services or products they develop and offer. The OSP is responsible and accountable for the implementation of the control within its own infrastructure/environment. If the control has downstream implications on the users/customers, the OSP is responsible for enabling the customer and/or upstream partner in the implementation/configuration of the control within their risk management approach. The OSP is accountable for ensuring that its providers upstream (e.g MPs) implement the control as it relates to the service/product the develop and offered by the OSP. This refers to entities that create the technical building blocks and management tools that enable AI implementation. This can include platforms, frameworks, and tools that facilitate the integration, deployment, and management of AI models within enterprise workflows. These providers focus on model orchestration and offer services like API access, automated scaling, prompt management, workflow automation, monitoring, and governance rather than end-user functionality or raw infrastructure. They help businesses implement AI in a structured and efficient manner. Examples: AWS, Azure, GCP, OpenAI, Anthropic, LangChain (for AI workflow orchestration), Anyscale (Ray for distributed AI workloads), Databricks (MLflow), IBM Watson Orchestrate, and developer platforms like Google AI Studio.

Application

Owned by the Customer (AIC)

Implementation guidelines

[All Actors]
1. Form a cross-functional AI Ethics Committee responsible for oversight of high-risk, controversial, or novel AI use cases.

2. Define the committee’s mandate, including authority to approve, reject, or demand modifications of AI systems.

3. Include representation from technical, legal, business, compliance, and diversity/equity/inclusion functions.

4. Establish a formal intake and escalation process for ethics-related AI concerns.

5. Document decisions, rationales, and meeting minutes for accountability and transparency.

Auditing guidelines

1. Verify that CSP has a ethics committee consists of a diverse set of stakeholders needs to be involved AI application lifecycle.

2. Verify the CSP roles and responsibilities are clearly defined and documented.

3. Verify that CSP has clear understanding of their role and have knowledge to contribute/guide towards Ethical AI Applications.

4. Verify that there established standards for decision making and approving AI applications

Standards mappings

ISO 42001Partial Gap

42001: B.6.1.2 (Objectives for responsible development of AI system)

Addendum

Even if both frameworks are looking for system integrity & assurances on ethical development: they use committee to part of risk management process and one focuses on the design of controls and how it enforces those standards.

EU AI ActPartial Gap

Article 14
Article 47
Article 63

Addendum

Establish an ethics committee, Review AI applications, Organizational values.

NIST AI 600-1Partial Gap

GV-2.1-002
MP-3.4-006

Addendum

Establish an ethics committee to review AI applications.

BSI AIC4Partial Gap

BI-01
BI-02

Addendum

No ethical topics in AIC4 or C5. But several Aspects can be found in DQ and BI.

AI-CAIQ questions (1)

GRC-12.1

Is an ethics committee established to review AI applications, ensuring alignment with ethical standards and organizational values?