{ "meta": { "name": { "fr": "Atlas réglementaire IA TrustFlow", "en": "TrustFlow AI regulatory atlas" }, "version": "0.1.0", "releaseDate": "2026-09-28", "asOf": "2026-09-25", "url": "https://atlas.trustflow.ai", "publisher": "TrustFlow", "copyright": "© 2026 LATEAM AI SAS (TrustFlow)", "license": "All rights reserved. No reuse, redistribution or derivative work without written permission." }, "vocab": { "kinds": { "regulation": { "fr": "Règlement", "en": "Regulation" }, "directive": { "fr": "Directive", "en": "Directive" }, "law": { "fr": "Loi", "en": "Statute" }, "rule": { "fr": "Règlement d'application", "en": "Implementing rules" }, "bill": { "fr": "Projet de loi", "en": "Bill" }, "executive": { "fr": "Politique exécutive", "en": "Executive policy" }, "standard": { "fr": "Norme certifiable", "en": "Certifiable standard" }, "framework": { "fr": "Cadre volontaire", "en": "Voluntary framework" }, "principles": { "fr": "Principes", "en": "Principles" }, "convention": { "fr": "Traité", "en": "Treaty" }, "rai": { "fr": "Cadre IA responsable", "en": "Responsible AI framework" } }, "statuses": { "in_force": { "label": { "fr": "En application", "en": "In force" }, "tone": "teal" }, "phased": { "label": { "fr": "Application progressive", "en": "Phasing in" }, "tone": "teal-soft" }, "pending": { "label": { "fr": "Adopté, pas encore applicable", "en": "Adopted, not yet applicable" }, "tone": "amber" }, "draft": { "label": { "fr": "En discussion", "en": "Under discussion" }, "tone": "indigo" }, "voluntary": { "label": { "fr": "Volontaire", "en": "Voluntary" }, "tone": "slate" }, "withdrawn": { "label": { "fr": "Abandonné", "en": "Withdrawn" }, "tone": "coral" } }, "objects": { "system": { "fr": "Système d'IA", "en": "AI system" }, "model": { "fr": "Modèle d'IA", "en": "AI model" }, "org": { "fr": "Organisation", "en": "Organisation" }, "processing": { "fr": "Traitement de données", "en": "Data processing" }, "product": { "fr": "Produit numérique", "en": "Digital product" }, "decision": { "fr": "Décision automatisée", "en": "Automated decision" } }, "certainty": { "done": { "fr": "Passé", "en": "Past" }, "scheduled": { "fr": "Prévu par le texte", "en": "Set in the text" }, "potential": { "fr": "Potentiel", "en": "Potential" }, "verify": { "fr": "À vérifier", "en": "To verify" } } }, "regions": [ { "key": "europe", "label": { "fr": "Europe", "en": "Europe" }, "color": "teal" }, { "key": "north_america", "label": { "fr": "Amérique du Nord", "en": "North America" }, "color": "coral" }, { "key": "latam", "label": { "fr": "Amérique latine", "en": "Latin America" }, "color": "pink" }, { "key": "asia", "label": { "fr": "Asie-Pacifique", "en": "Asia-Pacific" }, "color": "violet" }, { "key": "intl", "label": { "fr": "International", "en": "International" }, "color": "slate" } ], "jurisdictions": [ { "key": "EU", "label": { "fr": "Union européenne", "en": "European Union" }, "region": "europe", "flag": "EU" }, { "key": "COE", "label": { "fr": "Conseil de l'Europe", "en": "Council of Europe" }, "region": "europe", "flag": "CoE" }, { "key": "UK", "label": { "fr": "Royaume-Uni", "en": "United Kingdom" }, "region": "europe", "flag": "UK" }, { "key": "US", "label": { "fr": "États-Unis (fédéral)", "en": "United States (federal)" }, "region": "north_america", "flag": "US" }, { "key": "US-CO", "label": { "fr": "Colorado", "en": "Colorado" }, "region": "north_america", "flag": "CO" }, { "key": "US-TX", "label": { "fr": "Texas", "en": "Texas" }, "region": "north_america", "flag": "TX" }, { "key": "US-CA", "label": { "fr": "Californie", "en": "California" }, "region": "north_america", "flag": "CA" }, { "key": "US-NY", "label": { "fr": "New York (ville)", "en": "New York City" }, "region": "north_america", "flag": "NYC" }, { "key": "US-IL", "label": { "fr": "Illinois", "en": "Illinois" }, "region": "north_america", "flag": "IL" }, { "key": "CAN", "label": { "fr": "Canada", "en": "Canada" }, "region": "north_america", "flag": "CAN" }, { "key": "BR", "label": { "fr": "Brésil", "en": "Brazil" }, "region": "latam", "flag": "BR" }, { "key": "KR", "label": { "fr": "Corée du Sud", "en": "South Korea" }, "region": "asia", "flag": "KR" }, { "key": "JP", "label": { "fr": "Japon", "en": "Japan" }, "region": "asia", "flag": "JP" }, { "key": "CN", "label": { "fr": "Chine", "en": "China" }, "region": "asia", "flag": "CN" }, { "key": "INTL", "label": { "fr": "International", "en": "International" }, "region": "intl", "flag": "INTL" } ], "families": [ { "key": "govern", "label": { "fr": "Gouvernance", "en": "Governance" } }, { "key": "assess", "label": { "fr": "Évaluation", "en": "Assessment" } }, { "key": "build", "label": { "fr": "Conception", "en": "Build" } }, { "key": "people", "label": { "fr": "Personnes & usage", "en": "People & use" } }, { "key": "lifecycle", "label": { "fr": "Cycle de vie & tiers", "en": "Lifecycle & third parties" } } ], "themes": [ { "key": "GOV", "family": "govern", "label": { "fr": "Gouvernance & responsabilités", "en": "Governance & accountability" }, "desc": { "fr": "Politique IA, rôles, instance dirigeante responsable, veille réglementaire.", "en": "AI policy, roles, accountable leadership, regulatory watch." } }, { "key": "INV", "family": "govern", "label": { "fr": "Inventaire & catégorisation", "en": "Inventory & categorisation" }, "desc": { "fr": "Registre des systèmes d'IA, catégorisation, registre des traitements.", "en": "Register of AI systems, categorisation, record of processing." } }, { "key": "LIT", "family": "govern", "label": { "fr": "Maîtrise & compétences", "en": "Literacy & competence" }, "desc": { "fr": "Formation, sensibilisation et compétence des personnes qui opèrent ou supervisent.", "en": "Training, awareness and competence of operators and overseers." } }, { "key": "RISK", "family": "govern", "label": { "fr": "Gestion des risques", "en": "Risk management" }, "desc": { "fr": "Tolérance au risque, registre, traitement et risques résiduels.", "en": "Risk tolerance, register, treatment and residual risk." } }, { "key": "QMS", "family": "govern", "label": { "fr": "Qualité & conformité", "en": "Quality & conformity" }, "desc": { "fr": "Système de management, évaluation de conformité, déclaration, marquage, audit interne.", "en": "Management system, conformity assessment, declaration, marking, internal audit." } }, { "key": "PROHIB", "family": "assess", "label": { "fr": "Pratiques interdites", "en": "Prohibited practices" }, "desc": { "fr": "Filtrage des usages interdits ou à risque excessif.", "en": "Screening of prohibited or excessive-risk uses." } }, { "key": "IMPACT", "family": "assess", "label": { "fr": "Analyses d'impact", "en": "Impact assessments" }, "desc": { "fr": "AIPD, FRIA, évaluation d'impact algorithmique, HUDERIA.", "en": "DPIA, FRIA, algorithmic impact assessment, HUDERIA." } }, { "key": "FAIR", "family": "assess", "label": { "fr": "Équité & non-discrimination", "en": "Fairness & non-discrimination" }, "desc": { "fr": "Biais, discrimination algorithmique, audits d'équité.", "en": "Bias, algorithmic discrimination, fairness audits." } }, { "key": "PRIV", "family": "assess", "label": { "fr": "Données personnelles", "en": "Personal data" }, "desc": { "fr": "Base légale, minimisation, protection dès la conception.", "en": "Lawful basis, minimisation, privacy by design." } }, { "key": "DATA", "family": "build", "label": { "fr": "Gouvernance des données", "en": "Data governance" }, "desc": { "fr": "Qualité, représentativité et provenance des données d'entraînement et d'entrée.", "en": "Quality, representativeness and provenance of training and input data." } }, { "key": "DOC", "family": "build", "label": { "fr": "Documentation technique", "en": "Technical documentation" }, "desc": { "fr": "Documentation, notice d'utilisation, fiche modèle, conservation.", "en": "Documentation, instructions for use, model card, retention." } }, { "key": "LOG", "family": "build", "label": { "fr": "Journalisation & traçabilité", "en": "Logging & traceability" }, "desc": { "fr": "Journaux automatiques, conservation, accès.", "en": "Automatic logs, retention, access." } }, { "key": "ROBUST", "family": "build", "label": { "fr": "Exactitude & robustesse", "en": "Accuracy & robustness" }, "desc": { "fr": "Tests, TEVV, red teaming, sûreté de fonctionnement.", "en": "Testing, TEVV, red teaming, safe failure." } }, { "key": "SEC", "family": "build", "label": { "fr": "Cybersécurité", "en": "Cybersecurity" }, "desc": { "fr": "Sécurité de l'hébergement, du modèle et de la chaîne logicielle.", "en": "Security of hosting, model and software supply chain." } }, { "key": "ENV", "family": "build", "label": { "fr": "Impact environnemental", "en": "Environmental impact" }, "desc": { "fr": "Énergie et ressources consommées par l'entraînement et l'usage.", "en": "Energy and resources used by training and inference." } }, { "key": "TRANS", "family": "people", "label": { "fr": "Transparence & information", "en": "Transparency & notice" }, "desc": { "fr": "Informer utilisateurs, personnes concernées et représentants.", "en": "Inform users, affected persons and representatives." } }, { "key": "CONTENT", "family": "people", "label": { "fr": "Contenus synthétiques", "en": "Synthetic content" }, "desc": { "fr": "Marquage et étiquetage des contenus générés, deepfakes.", "en": "Marking and labelling of generated content, deepfakes." } }, { "key": "HUMAN", "family": "people", "label": { "fr": "Supervision humaine", "en": "Human oversight" }, "desc": { "fr": "Contrôle humain, arrêt, intervention sur les décisions automatisées.", "en": "Human control, stop, intervention on automated decisions." } }, { "key": "CONTEST", "family": "people", "label": { "fr": "Explication & recours", "en": "Explanation & redress" }, "desc": { "fr": "Droit à l'explication, contestation, réexamen humain, retours.", "en": "Right to explanation, contestation, human review, feedback." } }, { "key": "MONIT", "family": "lifecycle", "label": { "fr": "Surveillance après déploiement", "en": "Post-deployment monitoring" }, "desc": { "fr": "Suivi en production, dérive, amélioration continue, retrait.", "en": "Production monitoring, drift, continual improvement, decommissioning." } }, { "key": "INCID", "family": "lifecycle", "label": { "fr": "Incidents & mesures correctives", "en": "Incidents & corrective action" }, "desc": { "fr": "Détection, notification aux autorités, actions correctives.", "en": "Detection, notification to authorities, corrective action." } }, { "key": "REG", "family": "lifecycle", "label": { "fr": "Autorités & enregistrement", "en": "Authorities & registration" }, "desc": { "fr": "Enregistrement, dépôt, mandataire, coopération avec les autorités.", "en": "Registration, filing, representative, cooperation with authorities." } }, { "key": "TPR", "family": "lifecycle", "label": { "fr": "Tiers & chaîne de valeur", "en": "Third parties & value chain" }, "desc": { "fr": "Contrats fournisseurs, responsabilités partagées, sous-traitants.", "en": "Supplier contracts, shared responsibilities, processors." } }, { "key": "IP", "family": "lifecycle", "label": { "fr": "Propriété intellectuelle", "en": "Intellectual property" }, "desc": { "fr": "Droit d'auteur, résumé des données d'entraînement, opt-out, rémunération.", "en": "Copyright, training-data summary, opt-out, remuneration." } } ], "checks": [ { "code": "VER-AUTO-01", "name": { "en": "Suspension procedure in the event of risk", "fr": "Procédure de suspension en cas de risque" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT", "DORA" ] }, { "code": "VER-AUTO-02", "name": { "en": "Cooperation procedure with authorities", "fr": "Procédure de coopération avec les autorités" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "REG" ], "isNew": false, "usedBy": [ "AIACT", "US-TX" ] }, { "code": "VER-AUTO-03", "name": { "en": "EU declaration of conformity drafted", "fr": "Déclaration de conformité UE rédigée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "QMS" ], "isNew": false, "usedBy": [ "AIACT", "CRA" ] }, { "code": "VER-001-F-01", "name": { "en": "Documented and implemented AI training programme", "fr": "Programme de formation IA documenté et mis en œuvre" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "AIACT", "themes": [ "LIT" ], "isNew": false, "usedBy": [ "AIACT", "ISO42001" ] }, { "code": "VER-AUTO-04", "name": { "en": "Effective oversight", "fr": "Supervision effective" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "HUMAN" ], "isNew": false, "usedBy": [] }, { "code": "VER-AUTO-05", "name": { "en": "Accuracy monitoring in operation", "fr": "Surveillance de la précision en opération" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "ROBUST", "MONIT" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "NISTRMF" ] }, { "code": "VER-AUTO-06", "name": { "en": "DPIA completed", "fr": "DPIA réalisée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "IMPACT", "PRIV" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-011-01", "name": { "en": "10-year document retention policy documented and implemented", "fr": "Politique de rétention documentaire de 10 ans documentée et mise en œuvre" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "AIACT", "PLD" ] }, { "code": "VER-004-01", "name": { "en": "Documented data governance (collection process, bias, quality)", "fr": "Gouvernance des données documentée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "DATA", "FAIR" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CN", "GDPR", "ISO42001", "US-CO" ] }, { "code": "VER-001-F-02", "name": { "en": "Staff assigned to the system trained and competent", "fr": "Personnel affecté au système formé et compétent" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "LIT" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-002-01", "name": { "en": "Documented process for detecting drift towards prohibited practices", "fr": "Processus de détection des dérives vers des pratiques interdites documenté" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "PROHIB" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "US-TX" ] }, { "code": "VER-003-01", "name": { "en": "Documented and up-to-date risk register", "fr": "Registre des risques documenté et à jour" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "AIACT", "COE", "ISO42001", "KR", "NISTRMF", "US-CO" ] }, { "code": "VER-005-01", "name": { "en": "Complete technical documentation compliant with Annex IV", "fr": "Documentation technique complète conforme à l'annexe IV" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CRA", "ISO42001", "KR", "PLD", "US-TX" ] }, { "code": "VER-006-01", "name": { "en": "Documented log retention policy", "fr": "Politique de conservation des logs documentée" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "LOG" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "PLD" ] }, { "code": "VER-007-01", "name": { "en": "Instructions for use complete and compliant with Art. 13", "fr": "Instructions d'utilisation complètes et conformes à l'art. 13" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "DOC", "TRANS" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CRA", "ISO42001", "US-CO" ] }, { "code": "VER-008-01", "name": { "en": "Documented escalation and emergency stop procedure", "fr": "Procédure d'escalade et d'arrêt d'urgence documentée" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "HUMAN" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "NISTRMF" ] }, { "code": "VER-009-01", "name": { "en": "Cybersecurity of the hosting environment", "fr": "Cybersécurité de l'environnement d'hébergement" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "SEC" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "GDPR", "NIS2" ] }, { "code": "VER-010-01", "name": { "en": "QMS documented and implemented in accordance with Art. 17", "fr": "QMS documenté et mis en œuvre conformément à l'art. 17" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "QMS" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-001-F-03", "name": { "en": "Training register kept up to date", "fr": "Registre des formations tenu à jour" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "AIACT", "themes": [ "LIT" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-002-02", "name": { "en": "System free of prohibited practices (provider assessment)", "fr": "Système exempt de pratiques interdites (évaluation fournisseur)" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "PROHIB" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "US-TX" ] }, { "code": "VER-003-02", "name": { "en": "Residual risks communicated to deployers", "fr": "Risques résiduels communiqués au déployeur" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "US-CO" ] }, { "code": "VER-004-02", "name": { "en": "Input data relevant and representative in view of the intended purpose", "fr": "Données d'entrée pertinentes et représentatives au regard de la destination" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "DATA" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "ISO42001" ] }, { "code": "VER-005-02", "name": { "en": "Instructions for use obtained and read by the deployer", "fr": "Instructions d'utilisation obtenues et lues par le déployeur" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338" ] }, { "code": "VER-006-02", "name": { "en": "Automatic logging operational and compliant", "fr": "Journalisation automatique opérationnelle et conforme" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "LOG" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "ISO42001" ] }, { "code": "VER-008-02", "name": { "en": "System designed to allow human oversight (stop button, override)", "fr": "Système conçu pour permettre la supervision humaine (bouton arrêt, override)" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "HUMAN" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CAN", "GDPR", "KR", "NISTRMF", "UK", "US-FED" ] }, { "code": "VER-009-02", "name": { "en": "Accuracy and robustness verified and documented", "fr": "Précision et robustesse vérifiées et documentées" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "ROBUST" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CN", "NISTRMF", "PLD", "UK" ] }, { "code": "VER-001-D-01", "name": { "en": "AI awareness programme for users", "fr": "Programme de sensibilisation IA pour les utilisateurs" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "AIACT", "themes": [ "LIT" ], "isNew": false, "usedBy": [] }, { "code": "VER-002-03", "name": { "en": "System use free of prohibited practices (deployer assessment)", "fr": "Usage du système exempt de pratiques interdites (évaluation déployeur)" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "PROHIB" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338" ] }, { "code": "VER-003-03", "name": { "en": "Residual risks read and understood by the deployer", "fr": "Risques résiduels lus et compris" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-005-03", "name": { "en": "Use consistent with the intended purpose documented", "fr": "Usage conforme à la finalité prévue documentée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338" ] }, { "code": "VER-006-03", "name": { "en": "Logs accessible and usable by the deployer", "fr": "Logs accessibles et exploitables par le déployeur" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "LOG" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338" ] }, { "code": "VER-008-03", "name": { "en": "Competent overseers assigned to the system", "fr": "Superviseurs compétents affectés au système" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "HUMAN" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "ISO42001", "NISTRMF" ] }, { "code": "VER-009-03", "name": { "en": "Cybersecurity of the AI system verified", "fr": "Cybersécurité du système d'IA vérifiée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "SEC" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CRA", "GDPR", "PLD", "UK" ] }, { "code": "VER-001-D-02", "name": { "en": "System users trained in its use", "fr": "Utilisateurs du système formés à son usage" }, "scope": "system", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "LIT" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-003-04", "name": { "en": "Complementary mitigation measures in place", "fr": "Mesures complémentaires d'atténuation en place" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-009-F-04", "name": { "en": "Resilience to adversarial attacks tested", "fr": "Résistance aux attaques adversariales testée" }, "scope": "model", "evidenceType": "document", "recurring": true, "origin": "AIACT", "themes": [ "SEC", "ROBUST" ], "isNew": false, "usedBy": [ "AIACT", "CRA", "DORA" ] }, { "code": "VER-013-F-01", "name": { "en": "Documented non-conformity management procedure", "fr": "Procédure de gestion des non-conformités documentée" }, "scope": "organization", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT", "ISO42001" ] }, { "code": "VER-013-F-02", "name": { "en": "Immediate notification of stakeholders in the event of non-conformity", "fr": "Information immédiate des parties prenantes en cas de non-conformité" }, "scope": "organization", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-013-F-03", "name": { "en": "Corrective actions traced and documented", "fr": "Actions correctives tracées et documentées" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-013-F-04", "name": { "en": "Communication to market surveillance authorities in the event of risk", "fr": "Communication aux autorités de surveillance du marché en cas de risque" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "US-CO" ] }, { "code": "VER-016-F-01", "name": { "en": "CE marking affixed in accordance with Art. 48", "fr": "Marquage CE apposé conformément à l'art. 48" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "QMS" ], "isNew": false, "usedBy": [ "AIACT", "CRA" ] }, { "code": "VER-017-F-01", "name": { "en": "System registered in the EU database (Art. 71) by the provider", "fr": "Système enregistré dans la base de données de l'UE (art. 71) par le fournisseur" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "REG" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-017-D-02", "name": { "en": "Use registered in the EU database by the deployer (if public authority)", "fr": "Utilisation enregistrée dans la base de données de l'UE par le déployeur (si autorité publique)" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "REG" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-018-D-01", "name": { "en": "Persons informed of the interaction with an AI system", "fr": "Personnes informées de l'interaction avec un système d'IA" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "TRANS" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "COE", "KR", "US-CO", "US-TX" ] }, { "code": "VER-018-D-03", "name": { "en": "AI-generated content marked as such", "fr": "Contenus générés par IA marqués comme tels" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "CONTENT" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CN", "COE", "KR" ] }, { "code": "VER-019-D-01", "name": { "en": "Need for a DPIA assessed", "fr": "DPIA réalisée" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "IMPACT", "PRIV" ], "isNew": false, "usedBy": [ "GDPR", "NISTRMF", "OECD" ] }, { "code": "VER-019-D-02", "name": { "en": "DPIA carried out in accordance with GDPR Art. 35", "fr": "DPIA réalisée conformément au RGPD art. 35" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "IMPACT", "PRIV" ], "isNew": false, "usedBy": [ "BRPL2338", "COE", "GDPR", "US-CA-ADMT" ] }, { "code": "VER-019-D-03", "name": { "en": "DPIA incorporating the provider's information (Art. 13)", "fr": "DPIA intégrant les informations du fournisseur (art. 13)" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "IMPACT", "PRIV" ], "isNew": false, "usedBy": [] }, { "code": "VER-020-D-01", "name": { "en": "FRIA carried out in accordance with Art. 27", "fr": "FRIA réalisée conformément à l'art. 27" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "IMPACT" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "COE", "ISO42001", "KR" ] }, { "code": "VER-020-D-07", "name": { "en": "Results of the FRIA notified to the market surveillance authority", "fr": "Résultats de la FRIA notifiés à l'autorité de surveillance du marché" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "REG" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-021-F-01", "name": { "en": "Operational monitoring plan", "fr": "Plan de surveillance opérationnel" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "MONIT" ], "isNew": false, "usedBy": [ "AIACT", "ISO42001", "NISTRMF", "PLD", "US-FED" ] }, { "code": "VER-021-D-03", "name": { "en": "Operation monitoring", "fr": "Surveillance du fonctionnement" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "MONIT" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CN" ] }, { "code": "VER-022-F-01", "name": { "en": "Risk and incident response procedure", "fr": "Procédure de réaction aux risques et incidents" }, "scope": "organization", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CRA", "DORA", "ISO42001", "NIS2", "NISTRMF" ] }, { "code": "VER-022-D-01", "name": { "en": "Serious incident reporting procedure", "fr": "Procédure de signalement des incidents graves" }, "scope": "organization", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "GDPR", "NISTRMF" ] }, { "code": "VER-023-F-03", "name": { "en": "System accessibility verified (compliance with Directives 2016/2102 and 2019/882)", "fr": "Accessibilité du système vérifiée (conformité directives 2016/2102 et 2019/882)" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "TRANS" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-024-F-01", "name": { "en": "Conformity assessment procedure performed (Annex VI or VII)", "fr": "Procédure d'évaluation de la conformité réalisée (annexe VI ou VII)" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "QMS" ], "isNew": false, "usedBy": [ "AIACT", "CRA" ] }, { "code": "VER-025-F-01", "name": { "en": "Authorised representative appointed by written mandate", "fr": "Mandataire désigné par mandat écrit" }, "scope": "organization", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "REG" ], "isNew": false, "usedBy": [ "AIACT", "KR" ] }, { "code": "VER-025-F-02", "name": { "en": "Representative holding the authority to act (mandate compliant with Article 22(3))", "fr": "Mandataire disposant de l'autorité pour agir (mandat conforme art. 22 par. 3)" }, "scope": "provider", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "REG" ], "isNew": false, "usedBy": [] }, { "code": "VER-025-F-03", "name": { "en": "Contact details of the authorised representative accessible", "fr": "Coordonnées du mandataire accessibles" }, "scope": "provider", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "REG" ], "isNew": false, "usedBy": [] }, { "code": "VER-026-F-01", "name": { "en": "Contractual responsibilities documented between provider and third parties", "fr": "Responsabilités contractuelles documentées entre fournisseur et tiers" }, "scope": "provider", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "TPR" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "GDPR", "ISO42001", "PLD" ] }, { "code": "VER-026-D-01", "name": { "en": "Role qualification analysis (provider/deployer/distributor) carried out", "fr": "Analyse de qualification du rôle (fournisseur/déployeur/distributeur) réalisée" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "TPR" ], "isNew": false, "usedBy": [ "AIACT", "PLD" ] }, { "code": "VER-027-D-01", "name": { "en": "Use compliant with the purpose intended by the provider verified", "fr": "Usage conforme à la finalité prévue par le fournisseur vérifié" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "AIACT", "ISO42001" ] }, { "code": "VER-028-D-01", "name": { "en": "Input data control process documented", "fr": "Processus de contrôle des données d'entrée documenté" }, "scope": "system", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "DATA" ], "isNew": false, "usedBy": [] }, { "code": "VER-028-D-02", "name": { "en": "Input data relevant in view of the intended purpose", "fr": "Données d'entrée pertinentes au regard de la destination" }, "scope": "system", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "DATA" ], "isNew": false, "usedBy": [] }, { "code": "VER-028-D-03", "name": { "en": "Input data sufficiently representative", "fr": "Données d'entrée suffisamment représentatives" }, "scope": "system", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "DATA", "FAIR" ], "isNew": false, "usedBy": [ "BRPL2338", "US-IL" ] }, { "code": "VER-029-D-01", "name": { "en": "Affected persons informed of the use of the AI system", "fr": "Personnes concernées informées de l'utilisation du système d'IA" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "TRANS" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CAN", "GDPR", "US-CA-ADMT", "US-CO", "US-NYC" ] }, { "code": "VER-030-D-01", "name": { "en": "Workers' representatives and workers informed of the use", "fr": "Représentants du personnel et travailleurs informés de l'utilisation" }, "scope": "system", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "TRANS" ], "isNew": false, "usedBy": [ "AIACT", "US-IL" ] }, { "code": "VER-031-G-01", "name": { "en": "GPAI model technical documentation compliant with Annex XI", "fr": "Documentation technique du modèle GPAI conforme à l'annexe XI" }, "scope": "model", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338" ] }, { "code": "VER-031-G-02", "name": { "en": "Documentation for downstream providers compliant with Annex XII", "fr": "Documentation pour les fournisseurs en aval conforme à l'annexe XII" }, "scope": "model", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "DOC", "TPR" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "US-CA-SB53" ] }, { "code": "VER-031-G-03", "name": { "en": "Documented copyright compliance policy", "fr": "Politique de respect du droit d'auteur documentée" }, "scope": "organization", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "IP" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CN" ] }, { "code": "VER-031-G-04", "name": { "en": "Published summary of training content", "fr": "Résumé du contenu d'entraînement publié" }, "scope": "model", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "IP" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338" ] }, { "code": "VER-032-G-01", "name": { "en": "Model evaluation with standardised protocols and adversarial testing", "fr": "Évaluation du modèle avec protocoles normalisés et tests contradictoires" }, "scope": "model", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "ROBUST" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-032-G-02", "name": { "en": "Systemic risks assessed and mitigation measures documented", "fr": "Risques systémiques évalués et mesures d'atténuation documentées" }, "scope": "model", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "KR", "US-CA-SB53" ] }, { "code": "VER-032-G-03", "name": { "en": "Serious incidents documented and reported to the AI Office", "fr": "Incidents graves documentés et communiqués au Bureau de l'IA" }, "scope": "model", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT", "KR", "US-CA-SB53" ] }, { "code": "VER-032-G-04", "name": { "en": "Cybersecurity of the model and physical infrastructure ensured", "fr": "Cybersécurité du modèle et de l'infrastructure physique garantie" }, "scope": "model", "evidenceType": "attestation", "recurring": false, "origin": "AIACT", "themes": [ "SEC" ], "isNew": false, "usedBy": [ "AIACT", "US-CA-SB53" ] }, { "code": "VER-032-G-05", "name": { "en": "Corrective measures for serious incidents documented", "fr": "Mesures correctives pour incidents graves documentées" }, "scope": "model", "evidenceType": "attestation", "recurring": true, "origin": "AIACT", "themes": [ "INCID" ], "isNew": false, "usedBy": [ "AIACT" ] }, { "code": "VER-033-D-01", "name": { "en": "Decision explanation procedure documented", "fr": "Procédure d'explication des décisions documentée" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "AIACT", "themes": [ "CONTEST" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "CAN", "COE", "GDPR", "UK", "US-CO" ] }, { "code": "VER-033-D-02", "name": { "en": "System explanation capability verified", "fr": "Capacité d'explication du système vérifiée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "CONTEST" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "KR", "UK" ] }, { "code": "VER-033-D-03", "name": { "en": "Explanations provided on request within a reasonable timeframe", "fr": "Explications fournies sur demande dans un délai raisonnable" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "AIACT", "themes": [ "CONTEST" ], "isNew": false, "usedBy": [ "AIACT", "BRPL2338", "GDPR", "US-CA-ADMT" ] }, { "code": "CHK-BR-PRELIM", "name": { "en": "Preliminary assessment carried out and kept on record", "fr": "Évaluation préliminaire réalisée et conservée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "BRPL2338", "themes": [ "RISK", "INV" ], "isNew": false, "usedBy": [ "BRPL2338" ] }, { "code": "CHK-BR-CONTEST", "name": { "en": "Procedure to contest a decision and obtain human review published", "fr": "Procédure de contestation et de révision humaine publiée" }, "scope": "organization", "evidenceType": "link", "recurring": false, "origin": "BRPL2338", "themes": [ "CONTEST", "HUMAN" ], "isNew": false, "usedBy": [ "BRPL2338", "COE", "GDPR", "UK", "US-CA-ADMT", "US-CO", "US-FED" ] }, { "code": "CHK-BR-AIA-PUBLISHED", "name": { "en": "Conclusions of the algorithmic impact assessment published", "fr": "Conclusions de l'étude d'impact algorithmique publiées" }, "scope": "system", "evidenceType": "link", "recurring": false, "origin": "BRPL2338", "themes": [ "IMPACT", "TRANS" ], "isNew": false, "usedBy": [ "BRPL2338" ] }, { "code": "CHK-BR-ENERGY", "name": { "en": "Energy and resource efficiency of the model documented", "fr": "Efficacité énergétique et en ressources du modèle documentée" }, "scope": "model", "evidenceType": "document", "recurring": false, "origin": "BRPL2338", "themes": [ "ENV" ], "isNew": false, "usedBy": [ "BRPL2338" ] }, { "code": "CHK-BR-PUBLIC-LOGS", "name": { "en": "Usage logs record who used the system, for which case and purpose", "fr": "Les journaux d'usage indiquent qui a utilisé le système, pour quel dossier et quelle finalité" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "BRPL2338", "themes": [ "LOG" ], "isNew": false, "usedBy": [ "BRPL2338" ] }, { "code": "CHK-BR-PUBLIC-PRELIM", "name": { "en": "Preliminary assessment published", "fr": "Évaluation préliminaire publiée" }, "scope": "system", "evidenceType": "link", "recurring": false, "origin": "BRPL2338", "themes": [ "TRANS" ], "isNew": false, "usedBy": [ "BRPL2338" ] }, { "code": "CHK-BR-REMUNERATION", "name": { "en": "Rights-holder remuneration arrangements in place", "fr": "Dispositif de rémunération des ayants droit en place" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "BRPL2338", "themes": [ "IP" ], "isNew": false, "usedBy": [ "BRPL2338" ] }, { "code": "CHK-LEGAL-MAP", "name": { "en": "Applicable legal and regulatory requirements for AI are identified, mapped and monitored", "fr": "Les exigences légales et réglementaires applicables à l'IA sont identifiées, cartographiées et suivies" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "GOV" ], "isNew": false, "usedBy": [ "ISO42001", "JP", "NISTRMF" ] }, { "code": "CHK-POL-RISK", "name": { "en": "An AI risk-management policy and process are established through transparent, documented controls", "fr": "Une politique et un processus de gestion des risques liés à l'IA sont établis au moyen de contrôles transparents et documentés" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "DORA", "ISO42001", "JP", "NISTRMF", "US-CO", "US-TX" ] }, { "code": "CHK-POL-TRUST", "name": { "en": "Trustworthy-AI characteristics are embedded in organizational policies and a safety-first culture", "fr": "Les caractéristiques d'une IA digne de confiance sont intégrées aux politiques de l'organisation et à une culture de la sécurité avant tout" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "GOV" ], "isNew": false, "usedBy": [ "ISO42001", "JP", "NISTRMF" ] }, { "code": "CHK-REVIEW-PLAN", "name": { "en": "Ongoing monitoring and periodic review of the risk-management process are planned, with defined roles and review frequency", "fr": "Le suivi continu et la revue périodique du processus de gestion des risques sont planifiés, avec des rôles et une fréquence de revue définis" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "GOV" ], "isNew": false, "usedBy": [ "ISO42001", "NISTRMF" ] }, { "code": "CHK-INVENTORY", "name": { "en": "A mechanism to inventory AI systems is in place and resourced", "fr": "Un mécanisme d'inventaire des systèmes d'IA est en place et doté de ressources" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "INV" ], "isNew": false, "usedBy": [ "DORA", "GDPR", "NISTRMF", "US-FED" ] }, { "code": "CHK-DECOMM", "name": { "en": "A documented process exists for safe decommissioning and phase-out of AI systems", "fr": "Un processus documenté existe pour la mise hors service et le retrait progressif sûrs des systèmes d'IA" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "MONIT" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-ROLES-CLARIFIED", "name": { "en": "Roles, responsibilities and delegated authorities are documented and clear to relevant stakeholders", "fr": "Les rôles, responsabilités et délégations d'autorité sont documentés et clairs pour les parties prenantes concernées" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "GOV" ], "isNew": false, "usedBy": [ "ISO42001", "NISTRMF", "OECD", "UK", "US-FED" ] }, { "code": "CHK-TRAINING", "name": { "en": "Personnel and partners receive AI risk-management training", "fr": "Le personnel et les partenaires reçoivent une formation à la gestion des risques liés à l'IA" }, "scope": "organization", "evidenceType": "attestation", "recurring": true, "origin": "NISTRMF", "themes": [ "LIT" ], "isNew": false, "usedBy": [ "ISO42001", "NIS2", "NISTRMF" ] }, { "code": "CHK-EXEC-ACCOUNT", "name": { "en": "Executive leadership is accountable for AI risk decisions (board committee, risk appetite)", "fr": "La direction exécutive est responsable des décisions de risque liées à l'IA (comité du conseil, appétence au risque)" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "GOV" ], "isNew": false, "usedBy": [ "DORA", "ISO42001", "NIS2", "NISTRMF", "US-FED" ] }, { "code": "CHK-TEAM-DIVERSE", "name": { "en": "A diverse, interdisciplinary team is involved and its participation documented", "fr": "Une équipe diversifiée et interdisciplinaire est impliquée et sa participation est documentée" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "GOV" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-EFFECTIVE-CHALLENGE", "name": { "en": "Effective-challenge, red-team or three-lines-of-defense practices are in place", "fr": "Des pratiques d'effective challenge, de red team ou de trois lignes de défense sont en place" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "ROBUST" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-IMPACT-ASSESS", "name": { "en": "An impact assessment is performed, documented and used in go/no-go and risk decisions", "fr": "Une analyse d'impact est réalisée, documentée et utilisée dans les décisions go/no-go et de risque" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "IMPACT" ], "isNew": false, "usedBy": [ "CAN", "ISO42001", "NISTRMF", "US-CO", "US-FED" ] }, { "code": "CHK-TESTING-ENABLE", "name": { "en": "Organizational practices enable AI testing and identification of limitations", "fr": "Les pratiques organisationnelles permettent les tests d'IA et l'identification des limites" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "ROBUST" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-STAKEHOLDER-FEEDBACK", "name": { "en": "Mechanisms collect, adjudicate and integrate external stakeholder / user feedback", "fr": "Des mécanismes recueillent, arbitrent et intègrent les retours des parties prenantes externes et des utilisateurs" }, "scope": "organization", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "CONTEST" ], "isNew": false, "usedBy": [ "CN", "NISTRMF" ] }, { "code": "CHK-RISK-TOLERANCE", "name": { "en": "Risk tolerances are defined and AI systems are assigned to risk levels", "fr": "Les tolérances au risque sont définies et les systèmes d'IA sont classés par niveau de risque" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-THIRDPARTY-POL", "name": { "en": "Policies address third-party AI/data risks, incl. IP, transparency and testing", "fr": "Des politiques traitent les risques liés à l'IA et aux données de tiers, y compris la propriété intellectuelle, la transparence et les tests" }, "scope": "organization", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "TPR" ], "isNew": false, "usedBy": [ "DORA", "GDPR", "ISO42001", "NIS2", "NISTRMF", "US-FED" ] }, { "code": "CHK-THIRDPARTY-CONTINGENCY", "name": { "en": "Contingency/redundancy for high-risk third-party failures and ongoing third-party monitoring", "fr": "Un dispositif de secours/redondance pour les défaillances de tiers à haut risque et une surveillance continue des tiers" }, "scope": "model", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "TPR" ], "isNew": false, "usedBy": [ "DORA", "NISTRMF" ] }, { "code": "CHK-USECASE-SCOPING", "name": { "en": "Intended purpose, context, applicable laws, business value and application scope are documented", "fr": "La finalité prévue, le contexte, les lois applicables, la valeur métier et le périmètre d'application sont documentés" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-REQ-SPEC", "name": { "en": "System requirements are elicited with socio-technical implications addressed", "fr": "Les exigences du système sont recueillies en tenant compte des implications socio-techniques" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-CATEGORIZATION", "name": { "en": "AI system tasks and methods are categorized (classifier, generative, recommender)", "fr": "Les tâches et méthodes du système d'IA sont catégorisées (classifieur, génératif, recommandation)" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "INV" ], "isNew": false, "usedBy": [ "KR", "NISTRMF" ] }, { "code": "CHK-DOC-TECH", "name": { "en": "Technical documentation incl. knowledge limits, human oversight and usage instructions is maintained", "fr": "Une documentation technique incluant les limites de connaissance, la supervision humaine et la notice d'utilisation est tenue à jour" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-TEVV", "name": { "en": "TEVV plan, test sets, metrics and data considerations are documented", "fr": "Le plan TEVV, les jeux de test, les métriques et les considérations relatives aux données sont documentés" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "ROBUST" ], "isNew": false, "usedBy": [ "CAN", "ISO42001", "NISTRMF", "US-FED" ] }, { "code": "CHK-COMPETENCE", "name": { "en": "Operator/practitioner proficiency processes and relevant standards are defined", "fr": "Les processus de maîtrise par les opérateurs/praticiens et les normes pertinentes sont définis" }, "scope": "system", "evidenceType": "attestation", "recurring": true, "origin": "NISTRMF", "themes": [ "LIT" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-COMPONENTS", "name": { "en": "Legal risks and internal controls for AI components, incl. third-party, are identified", "fr": "Les risques juridiques et les contrôles internes des composants d'IA, y compris tiers, sont identifiés" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "TPR" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-MEASURE-PLAN", "name": { "en": "Measurement approaches and metrics are selected and connected to context; unmeasured risks documented", "fr": "Les approches et métriques de mesure sont sélectionnées et reliées au contexte ; les risques non mesurés sont documentés" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-METRIC-REVIEW", "name": { "en": "Metric appropriateness and control effectiveness are regularly assessed and updated", "fr": "La pertinence des métriques et l'efficacité des contrôles sont régulièrement évaluées et mises à jour" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "MONIT" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-INDEP-ASSESS", "name": { "en": "Independent or internal-expert assessment involves domain experts and affected communities", "fr": "Une évaluation indépendante ou par des experts internes associe des experts du domaine et les communautés concernées" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "ROBUST" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-HUMAN-SUBJECTS", "name": { "en": "Human-subject evaluations meet protection requirements and are representative", "fr": "Les évaluations sur sujets humains respectent les exigences de protection et sont représentatives" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "PRIV" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-SAFETY", "name": { "en": "Safety risks are evaluated and safe-failure demonstrated", "fr": "Les risques de sécurité (safety) sont évalués et la défaillance sûre est démontrée" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "ROBUST" ], "isNew": false, "usedBy": [ "NISTRMF", "OECD" ] }, { "code": "CHK-SECURITY", "name": { "en": "Security and resilience are evaluated and documented", "fr": "La sécurité (security) et la résilience sont évaluées et documentées" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "SEC" ], "isNew": false, "usedBy": [ "DORA", "NISTRMF", "OECD" ] }, { "code": "CHK-TRANSPARENCY", "name": { "en": "Transparency and accountability risks are examined and documented", "fr": "Les risques de transparence et de redevabilité sont examinés et documentés" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "TRANS" ], "isNew": false, "usedBy": [ "JP", "NISTRMF", "OECD", "UK" ] }, { "code": "CHK-MODEL-CARD", "name": { "en": "The model is explained, validated and documented (model card)", "fr": "Le modèle est expliqué, validé et documenté (model card)" }, "scope": "model", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "DOC" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-BIAS", "name": { "en": "Fairness and bias are evaluated and results documented", "fr": "L'équité et les biais sont évalués et les résultats documentés" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "FAIR" ], "isNew": false, "usedBy": [ "CAN", "COE", "JP", "NISTRMF", "OECD", "UK", "US-CO", "US-IL", "US-NYC" ] }, { "code": "CHK-ENV", "name": { "en": "Environmental impact and sustainability of model training are assessed", "fr": "L'impact environnemental et la durabilité de l'entraînement du modèle sont évalués" }, "scope": "model", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "ENV" ], "isNew": false, "usedBy": [ "NISTRMF", "OECD" ] }, { "code": "CHK-GO-NOGO", "name": { "en": "A go/no-go determination on system deployment is made and documented", "fr": "Une décision go/no-go sur le déploiement du système est prise et documentée" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "GOV" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-RISK-RESPONSE", "name": { "en": "Risk treatment is prioritized and high-priority responses are planned and documented", "fr": "Le traitement des risques est priorisé et les réponses prioritaires sont planifiées et documentées" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "ISO42001", "NISTRMF" ] }, { "code": "CHK-ALT", "name": { "en": "Required resources and viable non-AI alternatives are considered", "fr": "Les ressources nécessaires et les alternatives viables non fondées sur l'IA sont prises en compte" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NISTRMF", "themes": [ "RISK" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-MODEL-MONITORING", "name": { "en": "Pre-trained models used in development are monitored and maintained", "fr": "Les modèles pré-entraînés utilisés en développement sont surveillés et maintenus" }, "scope": "model", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "MONIT" ], "isNew": false, "usedBy": [ "NISTRMF" ] }, { "code": "CHK-CONTINUAL-IMPROVE", "name": { "en": "Continual-improvement activities are integrated with stakeholder engagement", "fr": "Les activités d'amélioration continue sont intégrées avec un engagement des parties prenantes" }, "scope": "system", "evidenceType": "document", "recurring": true, "origin": "NISTRMF", "themes": [ "MONIT" ], "isNew": false, "usedBy": [ "ISO42001", "NISTRMF" ] }, { "code": "NEW-GDPR-01", "name": { "fr": "Base légale documentée par finalité (entraînement, inférence)", "en": "Lawful basis documented per purpose (training, inference)" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "GDPR", "themes": [ "PRIV" ], "isNew": true, "usedBy": [ "GDPR" ] }, { "code": "NEW-GDPR-02", "name": { "fr": "Traitement IA inscrit au registre Art. 30", "en": "AI processing listed in the Art. 30 record" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "GDPR", "themes": [ "INV" ], "isNew": true, "usedBy": [ "GDPR" ] }, { "code": "NEW-GDPR-03", "name": { "fr": "Procédure de notification CNIL sous 72 h", "en": "72-hour notification procedure to the DPA" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "GDPR", "themes": [ "INCID" ], "isNew": true, "usedBy": [ "GDPR" ] }, { "code": "NEW-ISO42001-01", "name": { "fr": "Périmètre du SMIA défini et approuvé", "en": "AIMS scope defined and approved" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "ISO42001", "themes": [ "GOV" ], "isNew": true, "usedBy": [ "ISO42001" ] }, { "code": "NEW-ISO42001-02", "name": { "fr": "Déclaration d'applicabilité (SoA) de l'Annexe A tenue à jour", "en": "Annex A Statement of Applicability kept up to date" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "ISO42001", "themes": [ "RISK" ], "isNew": true, "usedBy": [ "ISO42001" ] }, { "code": "NEW-ISO42001-03", "name": { "fr": "Audit interne du SMIA réalisé sur le cycle", "en": "AIMS internal audit completed for the cycle" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "ISO42001", "themes": [ "QMS" ], "isNew": true, "usedBy": [ "ISO42001" ] }, { "code": "NEW-US-CO-01", "name": { "fr": "Déclaration publique des systèmes à haut risque publiée", "en": "Public statement of high-risk systems published" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "US-CO", "themes": [ "TRANS" ], "isNew": true, "usedBy": [ "US-CO" ] }, { "code": "NEW-US-CO-02", "name": { "fr": "Procédure de signalement AG sous 90 jours", "en": "90-day Attorney General reporting procedure" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "US-CO", "themes": [ "INCID" ], "isNew": true, "usedBy": [ "US-CO" ] }, { "code": "NEW-US-CA-SB53-01", "name": { "fr": "Cadre de sûreté de frontière publié et revu chaque année", "en": "Frontier AI framework published and reviewed yearly" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "US-CA-SB53", "themes": [ "RISK" ], "isNew": true, "usedBy": [ "US-CA-SB53" ] }, { "code": "NEW-US-CA-SB53-02", "name": { "fr": "Résumé trimestriel transmis à l'OES", "en": "Quarterly summary sent to OES" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "US-CA-SB53", "themes": [ "REG" ], "isNew": true, "usedBy": [ "US-CA-SB53" ] }, { "code": "NEW-US-CA-SB53-03", "name": { "fr": "Canal interne de signalement anonyme opérationnel", "en": "Anonymous internal reporting channel in place" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "US-CA-SB53", "themes": [ "GOV" ], "isNew": true, "usedBy": [ "US-CA-SB53" ] }, { "code": "NEW-US-NYC-01", "name": { "fr": "Audit de biais indépendant daté de moins de 12 mois", "en": "Independent bias audit dated within 12 months" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "US-NYC", "themes": [ "FAIR" ], "isNew": true, "usedBy": [ "US-NYC" ] }, { "code": "NEW-US-NYC-02", "name": { "fr": "Résumé d'audit publié sur le site carrières", "en": "Audit summary published on the careers site" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "US-NYC", "themes": [ "TRANS" ], "isNew": true, "usedBy": [ "US-NYC" ] }, { "code": "NEW-CN-01", "name": { "fr": "Algorithme déposé auprès de la CAC (numéro de dépôt)", "en": "Algorithm filed with the CAC (filing number)" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "CN", "themes": [ "REG" ], "isNew": true, "usedBy": [ "CN" ] }, { "code": "NEW-CN-02", "name": { "fr": "Évaluation de sécurité CAC réalisée", "en": "CAC security assessment completed" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "CN", "themes": [ "RISK" ], "isNew": true, "usedBy": [ "CN" ] }, { "code": "NEW-DORA-01", "name": { "fr": "Procédure de notification DORA des incidents majeurs", "en": "DORA major incident reporting procedure" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "DORA", "themes": [ "INCID" ], "isNew": true, "usedBy": [ "DORA" ] }, { "code": "NEW-DORA-02", "name": { "fr": "Fournisseur IA inscrit au registre d'information DORA", "en": "AI vendor listed in the DORA register of information" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "DORA", "themes": [ "TPR" ], "isNew": true, "usedBy": [ "DORA" ] }, { "code": "NEW-NIS2-01", "name": { "fr": "Entité enregistrée auprès de l'ANSSI", "en": "Entity registered with ANSSI" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "NIS2", "themes": [ "REG" ], "isNew": true, "usedBy": [ "NIS2" ] }, { "code": "NEW-CRA-01", "name": { "fr": "SBOM du système maintenu", "en": "System SBOM maintained" }, "scope": "system", "evidenceType": "document", "recurring": false, "origin": "CRA", "themes": [ "SEC" ], "isNew": true, "usedBy": [ "CRA" ] } ], "regulations": [ { "id": "AIACT", "short": "AI Act", "name": { "fr": "Règlement européen sur l'IA (UE) 2024/1689", "en": "EU AI Act, Regulation (EU) 2024/1689" }, "jurisdiction": "EU", "kind": "regulation", "status": "phased", "binding": true, "object": "system", "summary": { "fr": "Premier cadre horizontal et contraignant sur l'IA. Approche par les risques : pratiques interdites, systèmes à haut risque, obligations de transparence, modèles à usage général.", "en": "First horizontal, binding AI framework. Risk-based: prohibited practices, high-risk systems, transparency duties, general-purpose models." }, "scope": { "fr": "Fournisseurs, déployeurs, importateurs et distributeurs de systèmes d'IA ; fournisseurs de modèles GPAI.", "en": "Providers, deployers, importers and distributors of AI systems; providers of GPAI models." }, "territorial": { "fr": "Extraterritorial : s'applique dès que le système est mis sur le marché de l'UE ou que ses sorties y sont utilisées.", "en": "Extraterritorial: applies when the system is placed on the EU market or its output is used in the EU." }, "axes": [ { "key": "ai_act", "label": { "fr": "Niveau de risque AI Act", "en": "AI Act risk level" }, "scale": "ordinal", "verdicts": [ [ "prohibited", { "fr": "Interdit (Art. 5)", "en": "Prohibited (Art. 5)" }, "red" ], [ "high", { "fr": "Haut risque (Art. 6, Annexes I et III)", "en": "High risk (Art. 6, Annexes I and III)" }, "orange" ], [ "transparency", { "fr": "Risque de transparence (Art. 50)", "en": "Transparency risk (Art. 50)" }, "amber" ], [ "none", { "fr": "Risque minimal", "en": "Minimal risk" }, "green" ] ] }, { "key": "ai_act_role", "label": { "fr": "Rôle de l'organisation", "en": "Organisation role" }, "scale": "categorical", "verdicts": [ [ "provider", { "fr": "Fournisseur", "en": "Provider" }, "indigo" ], [ "deployer", { "fr": "Déployeur", "en": "Deployer" }, "violet" ], [ "provider_and_deployer", { "fr": "Fournisseur et déployeur", "en": "Provider and deployer" }, "slate" ], [ "importer", { "fr": "Importateur", "en": "Importer" }, "slate" ], [ "distributor", { "fr": "Distributeur", "en": "Distributor" }, "slate" ] ] }, { "key": "ai_act_gpai", "label": { "fr": "Modèle à usage général", "en": "General-purpose model" }, "scale": "ordinal", "verdicts": [ [ "gpai_systemic", { "fr": "GPAI à risque systémique (> 10^25 FLOP)", "en": "GPAI with systemic risk (> 10^25 FLOP)" }, "red" ], [ "gpai", { "fr": "GPAI", "en": "GPAI" }, "amber" ], [ "not_gpai", { "fr": "Pas un modèle GPAI", "en": "Not a GPAI model" }, "green" ] ] } ], "roles": [ [ "fournisseur", { "fr": "Fournisseur", "en": "Provider" } ], [ "deployeur", { "fr": "Déployeur", "en": "Deployer" } ], [ "fournisseur_gpai", { "fr": "Fournisseur GPAI", "en": "GPAI provider" } ] ], "penalties": { "fr": "Jusqu'à 35 M€ ou 7 % du CA mondial (pratiques interdites) ; 15 M€ ou 3 % (autres obligations) ; 7,5 M€ ou 1 % (informations inexactes).", "en": "Up to €35M or 7% of worldwide turnover (prohibited practices); €15M or 3% (other obligations); €7.5M or 1% (incorrect information)." }, "milestones": [ [ "2021-04-21", { "fr": "Proposition de la Commission", "en": "Commission proposal" }, "done" ], [ "2024-07-12", { "fr": "Publication au JOUE", "en": "Published in the Official Journal" }, "done" ], [ "2024-08-01", { "fr": "Entrée en vigueur", "en": "Entry into force" }, "done" ], [ "2025-02-02", { "fr": "Pratiques interdites (Art. 5) et maîtrise de l'IA (Art. 4)", "en": "Prohibited practices (Art. 5) and AI literacy (Art. 4)" }, "done" ], [ "2025-07-10", { "fr": "Code de bonnes pratiques GPAI publié", "en": "GPAI Code of Practice published" }, "done" ], [ "2025-08-02", { "fr": "Obligations GPAI, gouvernance, sanctions, organismes notifiés", "en": "GPAI obligations, governance, penalties, notified bodies" }, "done" ], [ "2025-11-19", { "fr": "Proposition Omnibus numérique : report du haut risque lié aux normes", "en": "Digital Omnibus proposal: high-risk delay tied to standards" }, "done" ], [ "2026-08-02", { "fr": "Application générale : Art. 50, bacs à sable, haut risque Annexe III (sauf report Omnibus)", "en": "General application: Art. 50, sandboxes, Annex III high risk (unless Omnibus delay)" }, "verify" ], [ "2027-08-02", { "fr": "Haut risque Annexe I (produits réglementés) ; GPAI mis sur le marché avant août 2025", "en": "Annex I high risk (regulated products); GPAI placed on the market before Aug 2025" }, "scheduled" ], [ "2027-12-02", { "fr": "Date butoir Omnibus pour le haut risque Annexe III", "en": "Omnibus backstop for Annex III high risk" }, "potential" ], [ "2028-08-02", { "fr": "Date butoir Omnibus pour le haut risque Annexe I", "en": "Omnibus backstop for Annex I high risk" }, "potential" ], [ "2030-08-02", { "fr": "Systèmes à haut risque des autorités publiques déjà en service (Art. 111)", "en": "High-risk systems of public authorities already in service (Art. 111)" }, "scheduled" ] ], "related": [ "GDPR", "CRA", "PLD", "ISO42001", "COE" ], "sources": [ [ "EUR-Lex 2024/1689", "https://eur-lex.europa.eu/eli/reg/2024/1689/oj" ], [ "AI Act Service Desk", "https://ai-act-service-desk.ec.europa.eu/" ] ], "requirements": [ { "code": "EX-001", "art": { "fr": "Art. 4", "en": "Art. 4" }, "title": { "en": "AI literacy", "fr": "Maîtrise de l'IA" }, "desc": { "en": "Article 4 requires every provider and deployer to ensure a sufficient level of AI literacy for the persons involved in the operation and use of AI systems. TrustFlow must verify that training and awareness programmes are in place, both at the organisational level and at the level of each system.", "fr": "L'article 4 impose à tout fournisseur et déployeur de garantir un niveau suffisant de maîtrise de l'IA pour les personnes impliquées dans le fonctionnement et l'utilisation des systèmes d'IA. {{customerName}} doit vérifier que des programmes de formation et de sensibilisation sont en place, tant au niveau organisationnel qu'au niveau de chaque système." }, "roles": [ "fournisseur", "deployeur" ], "levels": [], "themes": [ "LIT" ], "checks": [ "VER-001-F-01", "VER-001-F-02", "VER-001-F-03", "VER-001-D-02" ], "newChecks": [], "category": "maitrise_ia" }, { "code": "EX-002", "art": { "fr": "Art. 5", "en": "Art. 5" }, "title": { "en": "Prohibited practices", "fr": "Pratiques interdites en matière d'IA" }, "desc": { "en": "Article 5 defines the AI practices that are strictly prohibited. TrustFlow must make it possible to verify that no AI system in the organisation falls within the scope of these prohibited practices, and that a process for detecting drift is in place.", "fr": "L'article 5 définit les pratiques d'IA strictement interdites. {{customerName}} doit permettre de vérifier qu'aucun système d'IA de l'organisation ne tombe dans le champ de ces pratiques prohibées, et qu'un processus de détection des dérives est en place." }, "roles": [ "fournisseur", "deployeur" ], "levels": [], "themes": [ "PROHIB" ], "checks": [ "VER-002-01", "VER-002-02", "VER-002-03" ], "newChecks": [], "category": "pratiques_interdites" }, { "code": "EX-003", "art": { "fr": "Art. 9", "en": "Art. 9" }, "title": { "en": "Risk management", "fr": "Système de gestion des risques" }, "desc": { "en": "Article 9 requires an iterative and documented risk management system covering the entire lifecycle. TrustFlow must verify that risks are identified, that residual risks are communicated to deployers, and that mitigation measures are in place.", "fr": "L'article 9 impose un système de gestion des risques itératif et documenté, couvrant l'ensemble du cycle de vie. {{customerName}} doit vérifier que les risques sont identifiés, les risques résiduels communiqués aux déployeurs, et que des mesures d'atténuation sont en place." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "RISK" ], "checks": [ "VER-003-01", "VER-003-02", "VER-003-03", "VER-003-04" ], "newChecks": [], "category": "gestion_des_risques" }, { "code": "EX-004", "art": { "fr": "Art. 10", "en": "Art. 10" }, "title": { "en": "Data and data governance", "fr": "Données et gouvernance des données" }, "desc": { "en": "Article 10 requires rigorous data governance for high-risk AI systems. TrustFlow must verify that the data governance policy is documented (provider) and that input data are relevant and representative (deployer).", "fr": "L'article 10 exige une gouvernance des données rigoureuse pour les systèmes d'IA à haut risque. {{customerName}} doit vérifier que la politique de gouvernance des données est documentée (fournisseur) et que les données d'entrée sont pertinentes et représentatives (déployeur)." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "DATA", "FAIR" ], "checks": [ "VER-004-01", "VER-004-02" ], "newChecks": [], "category": "gouvernance_donnees" }, { "code": "EX-005", "art": { "fr": "Art. 11 + Annexe IV", "en": "Art. 11 + Annexe IV" }, "title": { "en": "Technical documentation", "fr": "Documentation technique" }, "desc": { "en": "Article 11 requires complete technical documentation to be drawn up and kept up to date before placing on the market. TrustFlow must verify that this documentation exists (provider) and that the deployer has obtained and followed the instructions for use.", "fr": "L'article 11 impose la rédaction et la tenue à jour d'une documentation technique complète avant mise sur le marché. {{customerName}} doit vérifier que cette documentation existe (fournisseur) et que le déployeur a obtenu et suivi les instructions d'utilisation." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "DOC" ], "checks": [ "VER-005-01", "VER-005-02", "VER-005-03" ], "newChecks": [], "category": "documentation_technique" }, { "code": "EX-006", "art": { "fr": "Art. 12", "en": "Art. 12" }, "title": { "en": "Record-keeping / logging", "fr": "Enregistrement / journalisation" }, "desc": { "en": "Article 12 requires high-risk AI systems to allow for the automatic recording of events throughout their lifecycle. TrustFlow must verify the existence of a log retention policy, the proper functioning of logging, and the accessibility of logs.", "fr": "L'article 12 impose que les systèmes d'IA à haut risque permettent l'enregistrement automatique des événements tout au long de leur cycle de vie. {{customerName}} doit vérifier l'existence d'une politique de conservation des logs, le bon fonctionnement de la journalisation, et l'accessibilité des logs." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "LOG" ], "checks": [ "VER-006-01", "VER-006-02", "VER-006-03" ], "newChecks": [], "category": "logs_tracabilite" }, { "code": "EX-007", "art": { "fr": "Art. 13", "en": "Art. 13" }, "title": { "en": "Transparency to deployers", "fr": "Transparence et fourniture d'informations aux déployeurs" }, "desc": { "en": "Article 13 requires high-risk AI systems to be sufficiently transparent so that deployers can interpret the outputs. TrustFlow must verify that the instructions for use are complete and that residual risks are communicated.", "fr": "L'article 13 impose que les systèmes d'IA soient suffisamment transparents pour que les déployeurs puissent interpréter les sorties. {{customerName}} doit vérifier que les instructions d'utilisation sont complètes et que les risques résiduels sont communiqués." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "DOC", "TRANS", "RISK" ], "checks": [ "VER-007-01", "VER-005-02", "VER-003-02" ], "newChecks": [], "category": "transparence_utilisateur" }, { "code": "EX-008", "art": { "fr": "Art. 14", "en": "Art. 14" }, "title": { "en": "Human oversight", "fr": "Contrôle humain" }, "desc": { "en": "Article 14 requires effective human oversight during the use of high-risk AI systems. TrustFlow must verify that an escalation procedure exists, that the system is designed for human oversight, and that the overseers are competent.", "fr": "L'article 14 impose un contrôle humain effectif pendant l'utilisation des systèmes d'IA à haut risque. {{customerName}} doit vérifier qu'une procédure d'escalade existe, que le système est conçu pour la supervision humaine, et que les superviseurs sont compétents." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "LIT", "HUMAN" ], "checks": [ "VER-001-D-02", "VER-008-01", "VER-008-02", "VER-008-03" ], "newChecks": [], "category": "supervision_humaine" }, { "code": "EX-009", "art": { "fr": "Art. 15", "en": "Art. 15" }, "title": { "en": "Accuracy, robustness, cybersecurity", "fr": "Exactitude, robustesse et cybersécurité" }, "desc": { "en": "Article 15 requires an appropriate level of accuracy, robustness and cybersecurity throughout the lifecycle. TrustFlow must verify the cybersecurity measures, the accuracy and robustness testing, and the resilience against adversarial attacks.", "fr": "L'article 15 exige un niveau approprié d'exactitude, de robustesse et de cybersécurité tout au long du cycle de vie. {{customerName}} doit vérifier les mesures de cybersécurité, les tests de précision et robustesse, et la résistance aux attaques adversariales." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "ROBUST", "MONIT", "SEC" ], "checks": [ "VER-AUTO-05", "VER-009-01", "VER-009-02", "VER-009-03" ], "newChecks": [], "category": "cybersecurite" }, { "code": "EX-010", "art": { "fr": "Art. 17", "en": "Art. 17" }, "title": { "en": "QMS", "fr": "Système de gestion de la qualité" }, "desc": { "en": "Article 17 requires providers of high-risk AI systems to put in place a quality management system (QMS) covering all aspects of the lifecycle. TrustFlow must verify that this QMS is documented and implemented.", "fr": "L'article 17 impose aux fournisseurs de systèmes d'IA à haut risque de mettre en place un système de gestion de la qualité (QMS) couvrant l'ensemble des aspects du cycle de vie. {{customerName}} doit vérifier que ce QMS est documenté et mis en œuvre." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "QMS" ], "checks": [ "VER-010-01" ], "newChecks": [], "category": "qualite_conformite" }, { "code": "EX-011", "art": { "fr": "Art. 18", "en": "Art. 18" }, "title": { "en": "10-year retention", "fr": "Conservation de la documentation (10 ans)" }, "desc": { "en": "Article 18 requires documentation to be kept for a minimum of 10 years. TrustFlow must verify that the document retention policy is in place.", "fr": "L'article 18 impose une conservation de la documentation pendant 10 ans minimum. {{customerName}} doit vérifier que la politique de rétention documentaire est en place." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "DOC" ], "checks": [ "VER-011-01" ], "newChecks": [], "category": "conservation_documentation" }, { "code": "EX-012", "art": { "fr": "Art. 19", "en": "Art. 19" }, "title": { "en": "Automatically generated logs", "fr": "Journaux générés automatiquement" }, "desc": { "en": "Article 19 requires the retention of automatically generated logs (minimum 6 months). TrustFlow reuses the verifications of Article 12 (EX-006).", "fr": "L'article 19 impose la conservation des journaux générés automatiquement (minimum 6 mois). {{customerName}} réutilise les vérifications de l'article 12 (EX-006)." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "LOG" ], "checks": [ "VER-006-02", "VER-006-01", "VER-006-03" ], "newChecks": [], "category": "logs_tracabilite" }, { "code": "EX-013", "art": { "fr": "Art. 20", "en": "Art. 20" }, "title": { "en": "Corrective actions", "fr": "Mesures correctives et devoir d'information" }, "desc": { "en": "Article 20 requires providers to take immediate corrective actions and to inform the parties concerned in the event of non-conformity. TrustFlow must verify the existence of non-conformity management procedures and the traceability of corrective actions.", "fr": "L'article 20 impose aux fournisseurs de prendre des mesures correctives immédiates et d'informer les parties concernées en cas de non-conformité. {{customerName}} doit vérifier l'existence de procédures de gestion des non-conformités et la traçabilité des actions correctives." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "INCID" ], "checks": [ "VER-013-F-01", "VER-013-F-02", "VER-013-F-03", "VER-013-F-04" ], "newChecks": [], "category": "actions_correctives" }, { "code": "EX-014", "art": { "fr": "Art. 21 + Art. 26§12", "en": "Art. 21 + Art. 26§12" }, "title": { "en": "Cooperation with authorities", "fr": "Coopération avec les autorités compétentes" }, "desc": { "en": "Articles 21 and 26(12) require cooperation with competent authorities. TrustFlow must verify that a cooperation procedure is in place and that the documentation is accessible.", "fr": "Les articles 21 et 26 par. 12 imposent la coopération avec les autorités compétentes. {{customerName}} doit vérifier qu'une procédure de coopération est en place et que la documentation est accessible." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "DOC", "LOG", "REG" ], "checks": [ "VER-005-01", "VER-006-03", "VER-AUTO-02", "VER-005-02" ], "newChecks": [], "category": "cooperation_autorites" }, { "code": "EX-015", "art": { "fr": "Art. 47", "en": "Art. 47" }, "title": { "en": "EU declaration of conformity", "fr": "Déclaration UE de conformité" }, "desc": { "en": "Article 47 requires the provider to draw up an EU declaration of conformity and to keep it for 10 years. TrustFlow must verify its existence and retention.", "fr": "L'article 47 impose au fournisseur d'établir une déclaration UE de conformité et de la conserver pendant 10 ans. {{customerName}} doit vérifier son existence et sa conservation." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "QMS", "DOC" ], "checks": [ "VER-AUTO-03", "VER-011-01" ], "newChecks": [], "category": "conformite_ue" }, { "code": "EX-016", "art": { "fr": "Art. 48", "en": "Art. 48" }, "title": { "en": "CE marking", "fr": "Marquage CE" }, "desc": { "en": "Article 48 requires CE marking on high-risk AI systems. TrustFlow must verify that this marking is affixed.", "fr": "L'article 48 impose le marquage CE sur les systèmes d'IA à haut risque. {{customerName}} doit vérifier que ce marquage est apposé." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "QMS" ], "checks": [ "VER-016-F-01" ], "newChecks": [], "category": "marquage_ce" }, { "code": "EX-017", "art": { "fr": "Art. 49", "en": "Art. 49" }, "title": { "en": "EU database registration", "fr": "Enregistrement dans la base de données de l'UE" }, "desc": { "en": "Article 49 requires registration in the EU database before placing on the market or deployment. TrustFlow must verify this registration.", "fr": "L'article 49 impose l'enregistrement dans la base de données de l'UE avant mise sur le marché ou déploiement. {{customerName}} doit vérifier cet enregistrement." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "REG" ], "checks": [ "VER-017-F-01", "VER-017-D-02" ], "newChecks": [], "category": "identification_enregistrement" }, { "code": "EX-018", "art": { "fr": "Art. 50", "en": "Art. 50" }, "title": { "en": "Transparency for all systems", "fr": "Obligations de transparence (tous systèmes)" }, "desc": { "en": "Article 50 imposes transparency obligations for ALL AI systems (not only high-risk): inform users that they are interacting with an AI, and mark AI-generated content.", "fr": "L'article 50 impose des obligations de transparence pour TOUS les systèmes d'IA (pas seulement haut risque) : informer les utilisateurs qu'ils interagissent avec une IA, et marquer les contenus générés par IA." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "transparency" ], "themes": [ "TRANS", "CONTENT" ], "checks": [ "VER-018-D-01", "VER-018-D-03" ], "newChecks": [], "category": "transparence_utilisateur" }, { "code": "EX-019", "art": { "fr": "Art. 26§9", "en": "Art. 26§9" }, "title": { "en": "DPIA", "fr": "Analyse d'impact protection des données (DPIA)" }, "desc": { "en": "Article 26(9) requires the deployer to use the information provided by the provider to carry out a data protection impact assessment (DPIA).", "fr": "L'article 26 par. 9 impose au déployeur d'utiliser les informations fournies par le fournisseur pour réaliser une analyse d'impact relative à la protection des données (DPIA/AIPD)." }, "roles": [ "deployeur" ], "levels": [ "high" ], "themes": [ "DOC", "IMPACT", "PRIV" ], "checks": [ "VER-005-02", "VER-AUTO-06" ], "newChecks": [], "category": "dpia" }, { "code": "EX-020", "art": { "fr": "Art. 27", "en": "Art. 27" }, "title": { "en": "FRIA", "fr": "Analyse d'impact sur les droits fondamentaux (FRIA)" }, "desc": { "en": "Article 27 requires a fundamental rights impact assessment (FRIA) before any deployment of certain high-risk AI systems. TrustFlow must verify that this assessment is carried out and notified.", "fr": "L'article 27 impose une analyse d'impact sur les droits fondamentaux (FRIA) avant tout déploiement de certains systèmes d'IA à haut risque. {{customerName}} doit vérifier que cette analyse est réalisée et notifiée." }, "roles": [ "deployeur" ], "levels": [ "high" ], "themes": [ "IMPACT", "REG" ], "checks": [ "VER-020-D-01", "VER-020-D-07" ], "newChecks": [], "category": "droits_fondamentaux" }, { "code": "EX-021", "art": { "fr": "Art. 72", "en": "Art. 72" }, "title": { "en": "Post-market monitoring", "fr": "Surveillance post-commercialisation" }, "desc": { "en": "Article 72 requires providers of high-risk AI systems to establish and document a proportionate post-market monitoring system, based on a plan integrated into the technical documentation (Annex IV). This system actively collects, documents and analyses operational data (provided by deployers or through other sources) to evaluate whether the system remains continuously compliant with high-risk requirements and to enable detection of drift throughout the lifecycle. Deployers contribute by monitoring the operation of the system in accordance with the instructions for use (Art. 26(5)) and by reporting relevant information back to the provider. The Commission must publish a plan template by 2 February 2026.", "fr": "Mise en place d'un système de surveillance post-commercialisation proportionné, avec collecte et analyse continue des données de performance." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "MONIT", "INCID" ], "checks": [ "VER-021-F-01", "VER-021-D-03", "VER-AUTO-01" ], "newChecks": [], "category": "incidents_surveillance" }, { "code": "EX-022", "art": { "fr": "Art. 73", "en": "Art. 73" }, "title": { "en": "Serious incident reporting", "fr": "Signalement des incidents graves" }, "desc": { "en": "Article 73 requires providers of high-risk AI systems to report any serious incident to the market surveillance authorities, with strict deadlines: 15 days maximum as a general rule, 2 days in the event of a widespread infringement or a serious incident within the meaning of Art. 3(49)(b), and 10 days in the event of death. Deployers must report incidents to the provider as soon as they become aware of them. Following the report, the provider shall, without delay, perform the necessary investigations (risk assessment, corrective action) in cooperation with the competent authorities and the notified body. A failure to report under Article 26 (deployer) exposes the party to an administrative fine of up to EUR 15 million or 3% of worldwide turnover (Art. 99(4)).", "fr": "Signalement des incidents graves aux autorités de surveillance dans les délais requis, avec enquête post-incident." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "MONIT", "INCID" ], "checks": [ "VER-021-D-03", "VER-022-F-01", "VER-022-D-01" ], "newChecks": [], "category": "incidents_surveillance" }, { "code": "EX-023", "art": { "fr": "Art. 16(l)", "en": "Art. 16(l)" }, "title": { "en": "Accessibility", "fr": "Accessibilité" }, "desc": { "en": "Article 16(l) requires providers to ensure that the high-risk AI system complies with accessibility requirements. TrustFlow must verify this compliance.", "fr": "L'article 16(l) impose aux fournisseurs de s'assurer que le système d'IA à haut risque est conforme aux exigences d'accessibilité. {{customerName}} doit vérifier cette conformité." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "TRANS" ], "checks": [ "VER-023-F-03" ], "newChecks": [], "category": "accessibilite" }, { "code": "EX-024", "art": { "fr": "Art. 43", "en": "Art. 43" }, "title": { "en": "Conformity assessment", "fr": "Évaluation de la conformité" }, "desc": { "en": "Article 43 defines the conformity assessment procedures. TrustFlow must verify that the appropriate procedure has been followed.", "fr": "L'article 43 définit les procédures d'évaluation de la conformité. {{customerName}} doit vérifier que la procédure appropriée a été suivie." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "QMS" ], "checks": [ "VER-024-F-01" ], "newChecks": [], "category": "qualite_conformite" }, { "code": "EX-025", "art": { "fr": "Art. 22", "en": "Art. 22" }, "title": { "en": "Authorised representative outside the EU", "fr": "Désignation d'un mandataire (hors UE)" }, "desc": { "en": "Article 22 requires non-EU providers to appoint an authorised representative in the Union. TrustFlow must verify this appointment and the representative's powers.", "fr": "L'article 22 impose aux fournisseurs hors UE de désigner un mandataire dans l'Union. {{customerName}} doit vérifier cette désignation et les pouvoirs du mandataire." }, "roles": [ "fournisseur" ], "levels": [ "high" ], "themes": [ "REG" ], "checks": [ "VER-025-F-01" ], "newChecks": [], "category": "supply_chain" }, { "code": "EX-026", "art": { "fr": "Art. 25", "en": "Art. 25" }, "title": { "en": "Value chain", "fr": "Responsabilités le long de la chaîne de valeur" }, "desc": { "en": "Article 25 defines the responsibilities along the value chain. TrustFlow must verify that contractual responsibilities are clear and that the role of each actor is analysed.", "fr": "L'article 25 définit les responsabilités tout au long de la chaîne de valeur. {{customerName}} doit vérifier que les responsabilités contractuelles sont claires et que le rôle de chaque acteur est analysé." }, "roles": [ "fournisseur", "deployeur" ], "levels": [ "high" ], "themes": [ "TPR" ], "checks": [ "VER-026-F-01", "VER-026-D-01" ], "newChecks": [], "category": "supply_chain" }, { "code": "EX-027", "art": { "fr": "Art. 26§1", "en": "Art. 26§1" }, "title": { "en": "Compliant use", "fr": "Usage conforme" }, "desc": { "en": "Article 26(1) requires the deployer to use the system in accordance with the provider's instructions.", "fr": "L'article 26 par. 1 impose au déployeur d'utiliser le système conformément aux instructions du fournisseur." }, "roles": [ "deployeur" ], "levels": [ "high" ], "themes": [ "DOC" ], "checks": [ "VER-005-02", "VER-027-D-01" ], "newChecks": [], "category": "deploiement_exploitation" }, { "code": "EX-028", "art": { "fr": "Art. 26§4", "en": "Art. 26§4" }, "title": { "en": "Input data", "fr": "Données d'entrée" }, "desc": { "en": "Article 26(4) requires the deployer to ensure the relevance and representativeness of the input data.", "fr": "L'article 26 par. 4 impose au déployeur de veiller à la pertinence et représentativité des données d'entrée." }, "roles": [ "deployeur" ], "levels": [ "high" ], "themes": [ "DATA" ], "checks": [ "VER-004-02" ], "newChecks": [], "category": "gouvernance_donnees" }, { "code": "EX-029", "art": { "fr": "Art. 26§11", "en": "Art. 26§11" }, "title": { "en": "Information to affected persons", "fr": "Information des personnes concernées" }, "desc": { "en": "Article 26(11) requires natural persons to be informed that they are subject to the use of a high-risk AI system when it makes or assists in making decisions concerning them.", "fr": "L'article 26 par. 11 impose d'informer les personnes physiques qu'elles sont soumises à l'utilisation d'un système d'IA à haut risque lorsque celui-ci prend ou facilite des décisions les concernant." }, "roles": [ "deployeur" ], "levels": [ "high" ], "themes": [ "TRANS" ], "checks": [ "VER-029-D-01" ], "newChecks": [], "category": "transparence_utilisateur" }, { "code": "EX-030", "art": { "fr": "Art. 26§7", "en": "Art. 26§7" }, "title": { "en": "Information to workers' representatives", "fr": "Information des représentants du personnel" }, "desc": { "en": "Article 26(7) requires workers' representatives and workers to be informed before the use of a high-risk AI system at the workplace.", "fr": "L'article 26 par. 7 impose d'informer les représentants du personnel et les travailleurs avant l'utilisation d'un système d'IA à haut risque sur le lieu de travail." }, "roles": [ "deployeur" ], "levels": [ "high" ], "themes": [ "TRANS" ], "checks": [ "VER-030-D-01" ], "newChecks": [], "category": "transparence_utilisateur" }, { "code": "EX-031", "art": { "fr": "Art. 53", "en": "Art. 53" }, "title": { "en": "GPAI obligations", "fr": "Obligations des fournisseurs de modèles GPAI" }, "desc": { "en": "Article 53 imposes documentation, transparency and copyright compliance obligations on providers of general-purpose AI (GPAI) models.", "fr": "L'article 53 impose aux fournisseurs de modèles d'IA à usage général (GPAI) des obligations de documentation, transparence et conformité au droit d'auteur." }, "roles": [ "fournisseur_gpai" ], "levels": [], "themes": [ "DOC", "TPR", "IP" ], "checks": [ "VER-031-G-01", "VER-031-G-02", "VER-031-G-03", "VER-031-G-04" ], "newChecks": [], "category": "gpai" }, { "code": "EX-032", "art": { "fr": "Art. 55", "en": "Art. 55" }, "title": { "en": "GPAI obligations with systemic risk", "fr": "Obligations GPAI à risque systémique" }, "desc": { "en": "Article 55 imposes enhanced obligations on providers of GPAI models with systemic risk: adversarial evaluations, risk mitigation, incident reporting, and cybersecurity.", "fr": "L'article 55 impose des obligations renforcées aux fournisseurs de modèles GPAI présentant un risque systémique : évaluations adversariales, atténuation des risques, signalement des incidents, et cybersécurité." }, "roles": [ "fournisseur_gpai" ], "levels": [], "themes": [ "ROBUST", "RISK", "INCID", "SEC" ], "checks": [ "VER-032-G-01", "VER-032-G-02", "VER-032-G-03", "VER-032-G-04", "VER-032-G-05", "VER-009-F-04" ], "newChecks": [], "category": "gpai" }, { "code": "EX-033", "art": { "fr": "Art. 86", "en": "Art. 86" }, "title": { "en": "Right to explanation of individual decision-making", "fr": "Droit à l'explication des décisions individuelles" }, "desc": { "en": "Article 86 grants persons affected by a decision based on a high-risk AI system (Annex III, excluding point 2) the right to obtain a clear explanation of the role of the AI system in the decision and of its main elements. The deployer must put in place the organisational and technical means to respond to this right. This right is complementary to the information obligation in Article 26(11) (EX-029), which covers prior information, whereas Article 86 covers the a posteriori explanation of a specific decision.", "fr": "L'article 86 confère aux personnes affectées par une décision fondée sur un SIA haut risque (Annexe III, hors point 2) le droit d'obtenir une explication claire sur le rôle du système d'IA dans la décision et sur ses principaux éléments. Le déployeur doit mettre en place les moyens organisationnels et techniques pour répondre à ce droit. Ce droit est complémentaire à l'obligation d'information de l'article 26 par. 11 (EX-029) qui porte sur l'information préalable, tandis que l'article 86 porte sur l'explication a posteriori d'une décision spécifique." }, "roles": [ "deployeur" ], "levels": [ "high" ], "themes": [ "CONTEST" ], "checks": [ "VER-033-D-01", "VER-033-D-02", "VER-033-D-03" ], "newChecks": [], "category": "transparence_utilisateur" } ], "seeded": true, "stats": { "requirements": 33, "coveredByExisting": 33, "existingChecks": 69, "reusedFromOthers": 0, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/ai-act/", "en": "https://atlas.trustflow.ai/en/eu-ai-act/" } }, { "id": "GDPR", "short": "RGPD", "name": { "fr": "Règlement général sur la protection des données (UE) 2016/679", "en": "General Data Protection Regulation (EU) 2016/679" }, "jurisdiction": "EU", "kind": "regulation", "status": "in_force", "binding": true, "object": "processing", "summary": { "fr": "S'applique à tout système d'IA qui traite des données personnelles, à l'entraînement comme à l'inférence. Encadre les décisions entièrement automatisées (Art. 22) et impose l'AIPD pour les traitements à risque élevé.", "en": "Applies to any AI system processing personal data, in training and inference. Governs solely automated decisions (Art. 22) and requires a DPIA for high-risk processing." }, "scope": { "fr": "Responsables de traitement et sous-traitants.", "en": "Controllers and processors." }, "territorial": { "fr": "Établissement dans l'UE, ou ciblage / suivi de personnes dans l'UE.", "en": "EU establishment, or targeting / monitoring people in the EU." }, "axes": [ { "key": "gdpr_adm", "label": { "fr": "Décision automatisée (Art. 22)", "en": "Automated decision (Art. 22)" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "Décision exclusivement automatisée à effet juridique", "en": "Solely automated decision with legal effect" }, "orange" ], [ "out_of_scope", { "fr": "Pas de décision Art. 22", "en": "No Art. 22 decision" }, "green" ] ] }, { "key": "gdpr_dpia", "label": { "fr": "AIPD requise (Art. 35)", "en": "DPIA required (Art. 35)" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "AIPD obligatoire", "en": "DPIA mandatory" }, "amber" ], [ "out_of_scope", { "fr": "AIPD non requise", "en": "DPIA not required" }, "green" ] ] } ], "roles": [ [ "controller", { "fr": "Responsable de traitement", "en": "Controller" } ], [ "processor", { "fr": "Sous-traitant", "en": "Processor" } ] ], "penalties": { "fr": "Jusqu'à 20 M€ ou 4 % du CA mondial.", "en": "Up to €20M or 4% of worldwide turnover." }, "milestones": [ [ "2016-04-27", { "fr": "Adoption", "en": "Adoption" }, "done" ], [ "2018-05-25", { "fr": "Entrée en application", "en": "Application date" }, "done" ], [ "2024-12-17", { "fr": "Avis CEPD 28/2024 sur les modèles d'IA", "en": "EDPB Opinion 28/2024 on AI models" }, "done" ], [ "2025-11-19", { "fr": "Omnibus numérique : intérêt légitime pour l'entraînement IA, définition des données personnelles", "en": "Digital Omnibus: legitimate interest for AI training, personal data definition" }, "done" ], [ "2027-01", { "fr": "Adoption possible des amendements Omnibus", "en": "Possible adoption of the Omnibus amendments" }, "potential" ] ], "requirements": [ { "code": "GDPR-01", "art": { "fr": "Art. 5, 6", "en": "Art. 5, 6" }, "title": { "fr": "Base légale et limitation des finalités pour l'entraînement et l'inférence", "en": "Lawful basis and purpose limitation for training and inference" }, "roles": [ "controller" ], "levels": [], "themes": [ "PRIV" ], "checks": [], "newChecks": [ "NEW-GDPR-01" ] }, { "code": "GDPR-02", "art": { "fr": "Art. 13, 14", "en": "Art. 13, 14" }, "title": { "fr": "Information des personnes, y compris la logique sous-jacente", "en": "Information to data subjects, including the logic involved" }, "roles": [ "controller" ], "levels": [], "themes": [ "TRANS" ], "checks": [ "VER-029-D-01" ], "newChecks": [] }, { "code": "GDPR-03", "art": { "fr": "Art. 22", "en": "Art. 22" }, "title": { "fr": "Garanties sur les décisions exclusivement automatisées", "en": "Safeguards on solely automated decisions" }, "roles": [ "controller" ], "levels": [ "gdpr_adm" ], "themes": [ "HUMAN", "CONTEST" ], "checks": [ "VER-008-02", "VER-033-D-01", "CHK-BR-CONTEST" ], "newChecks": [] }, { "code": "GDPR-04", "art": { "fr": "Art. 25", "en": "Art. 25" }, "title": { "fr": "Protection des données dès la conception", "en": "Data protection by design and by default" }, "roles": [ "controller" ], "levels": [], "themes": [ "PRIV", "DATA" ], "checks": [ "VER-004-01" ], "newChecks": [] }, { "code": "GDPR-05", "art": { "fr": "Art. 30", "en": "Art. 30" }, "title": { "fr": "Registre des activités de traitement", "en": "Record of processing activities" }, "roles": [ "controller", "processor" ], "levels": [], "themes": [ "INV" ], "checks": [ "CHK-INVENTORY" ], "newChecks": [ "NEW-GDPR-02" ] }, { "code": "GDPR-06", "art": { "fr": "Art. 35, 36", "en": "Art. 35, 36" }, "title": { "fr": "Analyse d'impact (AIPD) et consultation préalable", "en": "Impact assessment (DPIA) and prior consultation" }, "roles": [ "controller" ], "levels": [ "gdpr_dpia" ], "themes": [ "IMPACT", "PRIV" ], "checks": [ "VER-019-D-01", "VER-019-D-02" ], "newChecks": [] }, { "code": "GDPR-07", "art": { "fr": "Art. 32", "en": "Art. 32" }, "title": { "fr": "Sécurité du traitement", "en": "Security of processing" }, "roles": [ "controller", "processor" ], "levels": [], "themes": [ "SEC" ], "checks": [ "VER-009-01", "VER-009-03" ], "newChecks": [] }, { "code": "GDPR-08", "art": { "fr": "Art. 33, 34", "en": "Art. 33, 34" }, "title": { "fr": "Notification des violations sous 72 h", "en": "Breach notification within 72 hours" }, "roles": [ "controller", "processor" ], "levels": [], "themes": [ "INCID" ], "checks": [ "VER-022-D-01" ], "newChecks": [ "NEW-GDPR-03" ] }, { "code": "GDPR-09", "art": { "fr": "Art. 28", "en": "Art. 28" }, "title": { "fr": "Contrats avec les fournisseurs d'IA sous-traitants", "en": "Contracts with AI vendors acting as processors" }, "roles": [ "controller" ], "levels": [], "themes": [ "TPR" ], "checks": [ "VER-026-F-01", "CHK-THIRDPARTY-POL" ], "newChecks": [] }, { "code": "GDPR-10", "art": { "fr": "Art. 15", "en": "Art. 15" }, "title": { "fr": "Droit d'accès, dont l'information sur la décision automatisée", "en": "Right of access, including information on automated decisions" }, "roles": [ "controller" ], "levels": [ "gdpr_adm" ], "themes": [ "CONTEST" ], "checks": [ "VER-033-D-03" ], "newChecks": [] } ], "related": [ "AIACT", "UK", "CN" ], "sources": [ [ "EUR-Lex 2016/679", "https://eur-lex.europa.eu/eli/reg/2016/679/oj" ], [ "CNIL IA", "https://www.cnil.fr/fr/intelligence-artificielle" ] ], "seeded": false, "stats": { "requirements": 10, "coveredByExisting": 9, "existingChecks": 14, "reusedFromOthers": 14, "newChecks": 3 }, "url": { "fr": "https://atlas.trustflow.ai/fr/rgpd/", "en": "https://atlas.trustflow.ai/en/gdpr/" } }, { "id": "NISTRMF", "short": "NIST AI RMF", "name": { "fr": "NIST AI Risk Management Framework 1.0", "en": "NIST AI Risk Management Framework 1.0" }, "jurisdiction": "US", "kind": "framework", "status": "voluntary", "binding": false, "object": "system", "summary": { "fr": "Cadre volontaire de référence aux États-Unis, structuré en 4 fonctions (Govern, Map, Measure, Manage) et 72 sous-catégories. Cité comme valeur refuge par le Colorado et le Texas.", "en": "The US reference voluntary framework: 4 functions (Govern, Map, Measure, Manage), 72 subcategories. Cited as a safe harbour by Colorado and Texas." }, "scope": { "fr": "Toute organisation qui conçoit, déploie ou utilise de l'IA.", "en": "Any organisation designing, deploying or using AI." }, "territorial": { "fr": "Sans portée territoriale ; référence de fait pour les acheteurs publics américains.", "en": "No territorial scope; de facto reference for US public buyers." }, "axes": [ { "key": "nist_tier", "label": { "fr": "Niveau de risque interne (défini par l'organisation)", "en": "Internal risk tier (organisation-defined)" }, "scale": "ordinal", "verdicts": [ [ "high", { "fr": "Élevé", "en": "High" }, "orange" ], [ "medium", { "fr": "Moyen", "en": "Medium" }, "amber" ], [ "low", { "fr": "Faible", "en": "Low" }, "green" ] ] } ], "roles": [ [ "ai_actor", { "fr": "Acteur IA", "en": "AI actor" } ] ], "penalties": { "fr": "Aucune (volontaire). Levier : valeur refuge dans les lois d'États.", "en": "None (voluntary). Leverage: safe harbour in state laws." }, "milestones": [ [ "2023-01-26", { "fr": "AI RMF 1.0", "en": "AI RMF 1.0" }, "done" ], [ "2024-07-26", { "fr": "Profil IA générative (NIST AI 600-1)", "en": "Generative AI Profile (NIST AI 600-1)" }, "done" ], [ "2025-07-23", { "fr": "L'AI Action Plan demande une révision du cadre", "en": "AI Action Plan asks for a revision of the framework" }, "done" ], [ "2026-12", { "fr": "Révision du RMF attendue", "en": "Expected RMF revision" }, "potential" ] ], "related": [ "ISO42001", "US-CO", "US-TX", "OECD" ], "sources": [ [ "NIST AI 100-1", "https://doi.org/10.6028/NIST.AI.100-1" ], [ "NIST AI 600-1", "https://doi.org/10.6028/NIST.AI.600-1" ] ], "requirements": [ { "code": "GOVERN-1.1", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Legal and regulatory requirements involving AI are understood, managed, and documented.", "fr": "Les exigences légales et réglementaires relatives à l'IA sont comprises, gérées et documentées." }, "desc": { "en": "AI systems may be subject to specific applicable legal and regulatory requirements. Some legal requirements can mandate (e.g., nondiscrimination, data privacy and security controls) documentation, disclosure, and increased AI system transparency. These requirements are complex and may not be applicable or differ across applications and contexts.", "fr": "Les systèmes d'IA peuvent être soumis à des exigences légales et réglementaires spécifiques applicables. Certaines exigences légales peuvent imposer (par exemple, la non-discrimination, les contrôles de confidentialité et de sécurité des données) la documentation, la divulgation et une transparence accrue du système d'IA. Ces exigences sont complexes et peuvent ne pas être applicables ou différer selon les applications et les contextes." }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-LEGAL-MAP" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-1.2", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.", "fr": "Les caractéristiques d'une IA digne de confiance sont intégrées aux politiques, processus, procédures et pratiques de l'organisation." }, "desc": { "en": "Policies, processes, and procedures are central components of effective AI risk management and fundamental to individual and organizational accountability. All stakeholders benefit from policies, processes, and procedures which require preventing harm by design and default.", "fr": "Les politiques, les processus et les procédures sont des composantes centrales d'une gestion des risques liés à l'IA efficace et sont fondamentaux pour la responsabilité individuelle et organisationnelle. Toutes les parties prenantes bénéficient de politiques, de processus et de procédures qui exigent la prévention des préjudices dès la conception et par défaut." }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-POL-TRUST" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-1.3", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance.", "fr": "Des processus, procédures et pratiques sont en place pour déterminer le niveau nécessaire d'activités de gestion des risques en fonction de la tolérance au risque de l'organisation." }, "desc": { "en": "Risk management resources are finite in any organization. Adequate AI governance policies delineate the mapping, measurement, and prioritization of risks to allocate resources toward the most material issues for an AI system to ensure effective risk management. Policies may specify systematic processes for assigning mapped and measured risks to standardized risk scales.", "fr": "Les ressources de gestion des risques sont limitées dans toute organisation. Des politiques de gouvernance de l'IA adéquates définissent la cartographie, la mesure et la hiérarchisation des risques afin d'allouer les ressources aux enjeux les plus importants d'un système d'IA, garantissant ainsi une gestion des risques efficace. Les politiques peuvent spécifier des processus systématiques d'attribution des risques cartographiés et mesurés à des échelles de risque normalisées." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-POL-RISK", "CHK-RISK-TOLERANCE" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-1.4", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.", "fr": "Le processus de gestion des risques et ses résultats sont établis au moyen de politiques, procédures et autres contrôles transparents, fondés sur les priorités de risque de l'organisation." }, "desc": { "en": "Clear policies and procedures relating to documentation and transparency facilitate and enhance efforts to communicate roles and responsibilities for the Map, Measure and Manage functions across the AI lifecycle. Standardized documentation can help organizations systematically integrate AI risk management processes and enhance accountability efforts. For example, by adding their contact information to a work product document, AI actors can improve communication, increase ownership of work products, and potentially enhance consideration of product quality. Documentation may generate downstream benefits related to improved system replicability and robustness. Proper documentation storage and access procedures allow for quick retrieval of critical information during a negative incident. Explainable machine learning efforts (models and explanatory methods) may bolster technical documentation practices by introducing additional information for review and interpretation by AI Actors.", "fr": "Des politiques et procédures claires relatives à la documentation et à la transparence facilitent et renforcent les efforts de communication des rôles et des responsabilités pour les fonctions de Cartographie, de Mesure et de Gestion tout au long du cycle de vie de l'IA. Une documentation normalisée peut aider les organisations à intégrer systématiquement les processus de gestion des risques liés à l'IA et à renforcer les efforts en matière de responsabilité. Par exemple, en ajoutant leurs coordonnées à un document de produit de travail, les acteurs de l'IA peuvent améliorer la communication, accroître l'appropriation des produits de travail et potentiellement renforcer la prise en compte de la qualité du produit. La documentation peut générer des avantages en aval liés à l'amélioration de la reproductibilité et de la robustesse du système. Des procédures appropriées de stockage et d'accès à la documentation permettent une récupération rapide d'informations critiques lors d'un incident négatif. Les efforts d'apprentissage automatique explicable (modèles et méthodes explicatives) peuvent renforcer les pratiques de documentation technique en introduisant des informations supplémentaires à des fins d'examen et d'interprétation par les acteurs de l'IA." }, "roles": [], "levels": [], "themes": [ "RISK", "GOV" ], "checks": [ "CHK-POL-RISK", "CHK-ROLES-CLARIFIED" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-1.5", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.", "fr": "Le suivi continu et la revue périodique du processus de gestion des risques et de ses résultats sont planifiés, et les rôles et responsabilités de l'organisation sont clairement définis, y compris la détermination de la fréquence des revues périodiques." }, "desc": { "en": "AI systems are dynamic and may perform in unexpected ways once deployed or after deployment. Continuous monitoring is a risk management process for tracking unexpected issues and performance changes, in real-time or at a specific frequency, across the AI system lifecycle.", "fr": "Les systèmes d'IA sont dynamiques et peuvent se comporter de manière inattendue une fois déployés ou après leur déploiement. La surveillance continue est un processus de gestion des risques permettant de suivre les problèmes inattendus et les évolutions de performance, en temps réel ou à une fréquence déterminée, tout au long du cycle de vie du système d'IA." }, "roles": [], "levels": [], "themes": [ "GOV", "INCID" ], "checks": [ "CHK-REVIEW-PLAN", "VER-022-F-01", "VER-022-D-01" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-1.6", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.", "fr": "Des mécanismes sont en place pour inventorier les systèmes d'IA et sont dotés de ressources selon les priorités de risque de l'organisation." }, "desc": { "en": "An AI system inventory is an organized database of artifacts relating to an AI system or model. It may include system documentation, incident response plans, data dictionaries, links to implementation software or source code, names and contact information for relevant AI actors, or other information that may be helpful for model or system maintenance and incident response purposes. AI system inventories also enable a holistic view of organizational AI assets. A serviceable AI system inventory may allow for the quick resolution of:", "fr": "Un inventaire des systèmes d'IA est une base de données organisée d'artefacts relatifs à un système ou à un modèle d'IA. Il peut inclure la documentation du système, les plans de réponse aux incidents, les dictionnaires de données, les liens vers les logiciels d'implémentation ou le code source, les noms et coordonnées des acteurs de l'IA concernés, ou toute autre information pouvant être utile à des fins de maintenance du modèle ou du système et de réponse aux incidents. Les inventaires des systèmes d'IA permettent également d'obtenir une vue d'ensemble des actifs d'IA de l'organisation. Un inventaire des systèmes d'IA exploitable peut permettre la résolution rapide de :" }, "roles": [], "levels": [], "themes": [ "INV" ], "checks": [ "CHK-INVENTORY" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-1.7", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness.", "fr": "Des processus et procédures sont en place pour mettre hors service et retirer progressivement les systèmes d'IA de manière sûre, sans accroître les risques ni diminuer la fiabilité de l'organisation." }, "desc": { "en": "Irregular or indiscriminate termination or deletion of models or AI systems may be inappropriate and increase organizational risk. For example, AI systems may be subject to regulatory requirements or implicated in future security or legal investigations. To maintain trust, organizations may consider establishing policies and processes for the systematic and deliberate decommissioning of AI systems. Typically, such policies consider user and community concerns, risks in dependent and linked systems, and security, legal or regulatory concerns. Decommissioned models or systems may be stored in a model inventory along with active models, for an established length of time.", "fr": "La cessation ou la suppression irrégulière ou aveugle de modèles ou de systèmes d'IA peut s'avérer inappropriée et accroître le risque organisationnel. Par exemple, les systèmes d'IA peuvent être soumis à des exigences réglementaires ou être impliqués dans de futures enquêtes de sécurité ou judiciaires. Afin de préserver la confiance, les organisations peuvent envisager d'établir des politiques et des processus pour le démantèlement systématique et délibéré des systèmes d'IA. Généralement, de telles politiques prennent en compte les préoccupations des utilisateurs et des communautés, les risques dans les systèmes dépendants et interconnectés, ainsi que les préoccupations de sécurité, juridiques ou réglementaires. Les modèles ou systèmes démantelés peuvent être conservés dans un inventaire de modèles aux côtés des modèles actifs, pour une durée déterminée." }, "roles": [], "levels": [], "themes": [ "MONIT" ], "checks": [ "CHK-DECOMM" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-2.1", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.", "fr": "Les rôles, responsabilités et lignes de communication relatifs à la cartographie, à la mesure et à la gestion des risques liés à l'IA sont documentés et clairs pour les individus et les équipes dans toute l'organisation." }, "desc": { "en": "The development of a risk-aware organizational culture starts with defining responsibilities. For example, under some risk management structures, professionals carrying out test and evaluation tasks are independent from AI system developers and report through risk management functions or directly to executives. This kind of structure may help counter implicit biases such as groupthink or sunk cost fallacy and bolster risk management functions, so efforts are not easily bypassed or ignored.", "fr": "Le développement d'une culture organisationnelle consciente des risques commence par la définition des responsabilités. Par exemple, dans certaines structures de gestion des risques, les professionnels chargés des tâches de test et d'évaluation sont indépendants des développeurs du système d'IA et rendent compte par l'intermédiaire des fonctions de gestion des risques ou directement aux dirigeants. Ce type de structure peut contribuer à contrecarrer des biais implicites tels que la pensée de groupe ou le sophisme des coûts irrécupérables et à renforcer les fonctions de gestion des risques, de sorte que les efforts ne puissent pas être facilement contournés ou ignorés." }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-ROLES-CLARIFIED" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-2.2", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.", "fr": "Le personnel et les partenaires de l'organisation reçoivent une formation à la gestion des risques liés à l'IA afin de leur permettre d'exercer leurs missions et responsabilités conformément aux politiques, procédures et accords applicables." }, "desc": { "en": "To enhance AI risk management adoption and effectiveness, organizations are encouraged to identify and integrate appropriate training curricula into enterprise learning requirements. Through regular training, AI actors can maintain awareness of:", "fr": "Afin de renforcer l'adoption et l'efficacité de la gestion des risques liés à l'IA, les organisations sont encouragées à identifier et à intégrer des programmes de formation appropriés dans les exigences d'apprentissage de l'entreprise. Grâce à une formation régulière, les acteurs de l'IA peuvent maintenir leur connaissance de :" }, "roles": [], "levels": [], "themes": [ "LIT" ], "checks": [ "CHK-TRAINING" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-2.3", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.", "fr": "La direction exécutive de l'organisation assume la responsabilité des décisions relatives aux risques associés au développement et au déploiement des systèmes d'IA." }, "desc": { "en": "Senior leadership and members of the C-Suite in organizations that maintain an AI portfolio, should maintain awareness of AI risks, affirm the organizational appetite for such risks, and be responsible for managing those risks..", "fr": "Les cadres dirigeants et les membres de la direction générale des organisations qui gèrent un portefeuille d'IA doivent maintenir leur connaissance des risques liés à l'IA, affirmer l'appétit de l'organisation pour de tels risques et être responsables de la gestion de ces risques." }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-ROLES-CLARIFIED", "CHK-EXEC-ACCOUNT" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-3.1", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).", "fr": "La prise de décision relative à la cartographie, à la mesure et à la gestion des risques liés à l'IA tout au long du cycle de vie s'appuie sur une équipe diversifiée (p. ex. diversité démographique, disciplinaire, d'expérience, d'expertise et de parcours)." }, "desc": { "en": "A diverse team that includes AI actors with diversity of experience, disciplines, and backgrounds to enhance organizational capacity and capability for anticipating risks is better equipped to carry out risk management. Consultation with external personnel may be necessary when internal teams lack a diverse range of lived experiences or disciplinary expertise.", "fr": "Une équipe diversifiée comprenant des acteurs de l'IA dotés d'une diversité d'expériences, de disciplines et de parcours, afin de renforcer la capacité et l'aptitude de l'organisation à anticiper les risques, est mieux outillée pour assurer la gestion des risques. La consultation de personnel externe peut s'avérer nécessaire lorsque les équipes internes ne disposent pas d'un éventail diversifié d'expériences vécues ou d'expertises disciplinaires." }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-TEAM-DIVERSE" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-3.2", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.", "fr": "Des politiques et procédures sont en place pour définir et différencier les rôles et responsabilités relatifs aux configurations humain-IA et à la supervision des systèmes d'IA." }, "desc": { "en": "Identifying and managing AI risks and impacts are enhanced when a broad set of perspectives and actors across the AI lifecycle, including technical, legal, compliance, social science, and human factors expertise is engaged. AI actors include those who operate, use, or interact with AI systems for downstream tasks, or monitor AI system performance. Effective risk management efforts include:", "fr": "L'identification et la gestion des risques et des impacts liés à l'IA sont renforcées lorsqu'un large éventail de perspectives et d'acteurs tout au long du cycle de vie de l'IA, incluant une expertise technique, juridique, en conformité, en sciences sociales et en facteurs humains, est mobilisé. Les acteurs de l'IA comprennent ceux qui exploitent, utilisent ou interagissent avec les systèmes d'IA pour des tâches en aval, ou qui surveillent la performance du système d'IA. Des efforts de gestion des risques efficaces incluent :" }, "roles": [], "levels": [], "themes": [ "GOV", "HUMAN" ], "checks": [ "CHK-ROLES-CLARIFIED", "VER-008-03", "VER-008-01" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-4.1", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.", "fr": "Des politiques et pratiques organisationnelles sont en place pour favoriser un esprit critique et une culture de la sécurité avant tout dans la conception, le développement, le déploiement et les usages des systèmes d'IA, afin de minimiser les impacts négatifs potentiels." }, "desc": { "en": "A risk culture and accompanying practices can help organizations effectively triage the most critical risks. Organizations in some industries implement three (or more) “lines of defense,” where separate teams are held accountable for different aspects of the system lifecycle, such as development, risk management, and auditing. While a traditional three- lines approach may be impractical for smaller organizations, leadership can commit to cultivating a strong risk culture through other means. For example, “effective challenge,” is a culture- based practice that encourages critical thinking and questioning of important design and implementation decisions by experts with the authority and stature to make such changes.", "fr": "Une culture du risque et les pratiques qui l'accompagnent peuvent aider les organisations à trier efficacement les risques les plus critiques. Les organisations de certains secteurs mettent en œuvre trois (ou plus) « lignes de défense », où des équipes distinctes sont tenues responsables de différents aspects du cycle de vie du système, tels que le développement, la gestion des risques et l'audit. Bien qu'une approche traditionnelle à trois lignes puisse être peu pratique pour les organisations de plus petite taille, la direction peut s'engager à cultiver une solide culture du risque par d'autres moyens. Par exemple, la « contestation constructive » est une pratique fondée sur la culture qui encourage la pensée critique et la remise en question des décisions importantes de conception et de mise en œuvre par des experts dotés de l'autorité et du statut nécessaires pour opérer de tels changements." }, "roles": [], "levels": [], "themes": [ "GOV", "ROBUST" ], "checks": [ "CHK-POL-TRUST", "CHK-EFFECTIVE-CHALLENGE" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-4.2", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.", "fr": "Les équipes de l'organisation documentent les risques et impacts potentiels de la technologie d'IA qu'elles conçoivent, développent, déploient, évaluent et utilisent, et communiquent plus largement sur ces impacts." }, "desc": { "en": "Impact assessments are one approach for driving responsible technology development practices. And, within a specific use case, these assessments can provide a high-level structure for organizations to frame risks of a given algorithm or deployment. Impact assessments can also serve as a mechanism for organizations to articulate risks and generate documentation for managing and oversight activities when harms do arise.", "fr": "Les analyses d'impact constituent une approche permettant de promouvoir des pratiques de développement technologique responsable. En outre, dans le cadre d'un cas d'usage spécifique, ces analyses peuvent fournir aux organisations une structure de haut niveau pour cadrer les risques d'un algorithme ou d'un déploiement donné. Les analyses d'impact peuvent également servir de mécanisme permettant aux organisations d'exprimer les risques et de générer une documentation à des fins de gestion et d'activités de supervision lorsque des préjudices surviennent." }, "roles": [], "levels": [], "themes": [ "IMPACT" ], "checks": [ "CHK-IMPACT-ASSESS" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-4.3", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.", "fr": "Des pratiques organisationnelles sont en place pour permettre les tests d'IA, l'identification des incidents et le partage d'information." }, "desc": { "en": "Identifying AI system limitations, detecting and tracking negative impacts and incidents, and sharing information about these issues with appropriate AI actors will improve risk management. Issues such as concept drift, AI bias and discrimination, shortcut learning or underspecification are difficult to identify using current standard AI testing processes. Organizations can institute in-house use and testing policies and procedures to identify and manage such issues. Efforts can take the form of pre-alpha or pre-beta testing, or deploying internally developed systems or products within the organization. Testing may entail limited and controlled in-house, or publicly available, AI system testbeds, and accessibility of AI system interfaces and outputs.", "fr": "L'identification des limites du système d'IA, la détection et le suivi des impacts négatifs et des incidents, ainsi que le partage d'informations sur ces problèmes avec les acteurs de l'IA appropriés amélioreront la gestion des risques. Des problèmes tels que la dérive conceptuelle, le biais et la discrimination liés à l'IA, l'apprentissage par raccourci ou la sous-spécification sont difficiles à identifier à l'aide des processus de test standards actuels de l'IA. Les organisations peuvent instaurer des politiques et des procédures internes d'utilisation et de test afin d'identifier et de gérer de tels problèmes. Ces efforts peuvent prendre la forme de tests pré-alpha ou pré-bêta, ou du déploiement de systèmes ou de produits développés en interne au sein de l'organisation. Les tests peuvent impliquer des bancs d'essai de systèmes d'IA internes limités et contrôlés, ou accessibles au public, ainsi que l'accessibilité des interfaces et des sorties du système d'IA." }, "roles": [], "levels": [], "themes": [ "INCID", "ROBUST" ], "checks": [ "VER-022-F-01", "VER-022-D-01", "CHK-TESTING-ENABLE" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-5.1", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.", "fr": "Des politiques et pratiques organisationnelles sont en place pour recueillir, prendre en compte, prioriser et intégrer les retours des personnes extérieures à l'équipe ayant développé ou déployé le système d'IA, concernant les impacts individuels et sociétaux potentiels liés aux risques de l'IA." }, "desc": { "en": "Beyond internal and laboratory-based system testing, organizational policies and practices may consider AI system fitness-for-purpose related to the intended context of use.", "fr": "Au-delà des tests internes et en laboratoire du système, les politiques et pratiques organisationnelles peuvent prendre en compte l'adéquation à l'usage du système d'IA au regard du contexte d'utilisation prévu." }, "roles": [], "levels": [], "themes": [ "GOV", "CONTEST" ], "checks": [ "CHK-ROLES-CLARIFIED", "CHK-STAKEHOLDER-FEEDBACK" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-5.2", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.", "fr": "Des mécanismes sont établis pour permettre à l'équipe ayant développé ou déployé les systèmes d'IA d'intégrer régulièrement, dans la conception et la mise en œuvre du système, les retours arbitrés des acteurs pertinents de l'IA." }, "desc": { "en": "Organizational policies and procedures that equip AI actors with the processes, knowledge, and expertise needed to inform collaborative decisions about system deployment improve risk management. These decisions are closely tied to AI systems and organizational risk tolerance.", "fr": "Les politiques et procédures organisationnelles qui dotent les acteurs de l'IA des processus, des connaissances et de l'expertise nécessaires pour éclairer des décisions collaboratives concernant le déploiement du système améliorent la gestion des risques. Ces décisions sont étroitement liées aux systèmes d'IA et à la tolérance au risque de l'organisation." }, "roles": [], "levels": [], "themes": [ "CONTEST", "RISK" ], "checks": [ "CHK-STAKEHOLDER-FEEDBACK", "CHK-RISK-TOLERANCE" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-6.1", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights.", "fr": "Des politiques et procédures sont en place pour traiter les risques liés à l'IA associés aux entités tierces, y compris les risques d'atteinte à la propriété intellectuelle ou à d'autres droits d'un tiers." }, "desc": { "en": "Risk measurement and management can be complicated by how customers use or integrate third-party data or systems into AI products or services, particularly without sufficient internal governance structures and technical safeguards.", "fr": "La mesure et la gestion des risques peuvent être compliquées par la manière dont les clients utilisent ou intègrent des données ou des systèmes tiers dans des produits ou des services d'IA, en particulier en l'absence de structures de gouvernance internes et de garde-fous techniques suffisants." }, "roles": [], "levels": [], "themes": [ "TPR" ], "checks": [ "CHK-THIRDPARTY-POL" ], "newChecks": [], "category": "govern" }, { "code": "GOVERN-6.2", "art": { "fr": "GOVERN", "en": "GOVERN" }, "title": { "en": "Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.", "fr": "Des processus de secours sont en place pour gérer les défaillances ou incidents affectant les données ou systèmes d'IA de tiers jugés à haut risque." }, "desc": { "en": "To mitigate the potential harms of third-party system failures, organizations may implement policies and procedures that include redundancies for covering third-party functions.", "fr": "Afin d'atténuer les préjudices potentiels des défaillances de systèmes tiers, les organisations peuvent mettre en œuvre des politiques et des procédures incluant des redondances pour couvrir les fonctions assurées par des tiers." }, "roles": [], "levels": [], "themes": [ "INCID", "TPR" ], "checks": [ "VER-022-F-01", "VER-022-D-01", "CHK-THIRDPARTY-CONTINGENCY" ], "newChecks": [], "category": "govern" }, { "code": "MAP-1.1", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics.", "fr": "Les finalités prévues, les usages potentiellement bénéfiques, les lois propres au contexte, les normes et attentes, ainsi que les cadres prospectifs dans lesquels le système d'IA sera déployé sont compris et documentés. Les considérations incluent : l'ensemble ou les types spécifiques d'utilisateurs et leurs attentes ; les impacts positifs et négatifs potentiels des usages du système pour les individus, les communautés, les organisations, la société et la planète ; les hypothèses et limites associées quant aux finalités, usages et risques du système d'IA tout au long du cycle de vie de développement ou de produit ; ainsi que les métriques TEVV et système associées." }, "desc": { "en": "Highly accurate and optimized systems can cause harm. Relatedly, organizations should expect broadly deployed AI tools to be reused, repurposed, and potentially misused regardless of intentions.", "fr": "Des systèmes hautement précis et optimisés peuvent causer des préjudices. De manière connexe, les organisations doivent s'attendre à ce que les outils d'IA largement déployés soient réutilisés, réaffectés et potentiellement détournés, indépendamment des intentions." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-USECASE-SCOPING" ], "newChecks": [], "category": "map" }, { "code": "MAP-1.2", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.", "fr": "Les acteurs, compétences, savoir-faire et capacités interdisciplinaires de l'IA mobilisés pour établir le contexte reflètent une diversité démographique et une large expertise du domaine et de l'expérience utilisateur, et leur participation est documentée. Les occasions de collaboration interdisciplinaire sont priorisées." }, "desc": { "en": "Successfully mapping context requires a team of AI actors with a diversity of experience, expertise, abilities and backgrounds, and with the resources and independence to engage in critical inquiry.", "fr": "Une cartographie réussie du contexte requiert une équipe d'acteurs de l'IA présentant une diversité d'expériences, d'expertises, de compétences et de parcours, et disposant des ressources et de l'indépendance nécessaires pour mener un questionnement critique." }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-TEAM-DIVERSE" ], "newChecks": [], "category": "map" }, { "code": "MAP-1.3", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "The organization's mission and relevant goals for AI technology are understood and documented.", "fr": "La mission de l'organisation et les objectifs pertinents pour la technologie d'IA sont compris et documentés." }, "desc": { "en": "Defining and documenting the specific business purpose of an AI system in a broader context of societal values helps teams to evaluate risks and increases the clarity of “go/no- go” decisions about whether to deploy.", "fr": "Définir et documenter la finalité commerciale spécifique d'un système d'IA dans un contexte plus large de valeurs sociétales aide les équipes à évaluer les risques et accroît la clarté des décisions de type « go/no-go » quant à l'opportunité de procéder au déploiement." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-USECASE-SCOPING" ], "newChecks": [], "category": "map" }, { "code": "MAP-1.4", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "The business value or context of business use has been clearly defined or - in the case of assessing existing AI systems - re-evaluated.", "fr": "La valeur métier ou le contexte d'usage métier a été clairement défini ou – dans le cas de l'évaluation de systèmes d'IA existants – réévalué." }, "desc": { "en": "Socio-technical AI risks emerge from the interplay between technical development decisions and how a system is used, who operates it, and the social context into which it is deployed. Addressing these risks is complex and requires a commitment to understanding how contextual factors may interact with AI lifecycle actions. One such contextual factor is how organizational mission and identified system purpose create incentives within AI system design, development, and deployment tasks that may result in positive and negative impacts. By establishing comprehensive and explicit enumeration of AI systems’ context of of business use and expectations, organizations can identify and manage these types of risks.", "fr": "Les risques socio-techniques de l'IA émergent de l'interaction entre les décisions de développement technique et la manière dont un système est utilisé, l'identité de ceux qui l'exploitent et le contexte social dans lequel il est déployé. La prise en compte de ces risques est complexe et exige un engagement à comprendre comment les facteurs contextuels peuvent interagir avec les actions du cycle de vie de l'IA. L'un de ces facteurs contextuels réside dans la manière dont la mission organisationnelle et la finalité identifiée du système créent, au sein des tâches de conception, de développement et de déploiement du système d'IA, des incitations susceptibles d'engendrer des impacts positifs et négatifs. En établissant une énumération exhaustive et explicite du contexte d'usage commercial et des attentes relatives aux systèmes d'IA, les organisations peuvent identifier et gérer ces types de risques." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-USECASE-SCOPING" ], "newChecks": [], "category": "map" }, { "code": "MAP-1.5", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Organizational risk tolerances are determined and documented.", "fr": "Les tolérances au risque de l'organisation sont déterminées et documentées." }, "desc": { "en": "Risk tolerance reflects the level and type of risk the organization is willing to accept while conducting its mission and carrying out its strategy.", "fr": "La tolérance au risque reflète le niveau et le type de risque que l'organisation est disposée à accepter dans l'accomplissement de sa mission et la mise en œuvre de sa stratégie." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-RISK-TOLERANCE" ], "newChecks": [], "category": "map" }, { "code": "MAP-1.6", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "System requirements (e.g., 'the system shall respect the privacy of its users') are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.", "fr": "Les exigences du système (p. ex. « le système doit respecter la vie privée de ses utilisateurs ») sont recueillies auprès des acteurs pertinents de l'IA et comprises par eux. Les décisions de conception tiennent compte des implications socio-techniques pour traiter les risques liés à l'IA." }, "desc": { "en": "AI system development requirements may outpace documentation processes for traditional software. When written requirements are unavailable or incomplete, AI actors may inadvertently overlook business and stakeholder needs, over-rely on implicit human biases such as confirmation bias and groupthink, and maintain exclusive focus on computational requirements.", "fr": "Les exigences de développement d'un système d'IA peuvent devancer les processus de documentation applicables aux logiciels traditionnels. Lorsque les exigences écrites sont indisponibles ou incomplètes, les acteurs de l'IA peuvent, par inadvertance, négliger les besoins commerciaux et ceux des parties prenantes, s'appuyer de manière excessive sur des biais humains implicites tels que le biais de confirmation et la pensée de groupe, et se concentrer exclusivement sur les exigences computationnelles." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-REQ-SPEC" ], "newChecks": [], "category": "map" }, { "code": "MAP-2.1", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).", "fr": "Les tâches spécifiques et les méthodes employées pour les mettre en œuvre, que le système d'IA prendra en charge, sont définies (p. ex. classifieurs, modèles génératifs, systèmes de recommandation)." }, "desc": { "en": "AI actors define the technical learning or decision-making task(s) an AI system is designed to accomplish, or the benefits that the system will provide. The clearer and narrower the task definition, the easier it is to map its benefits and risks, leading to more fulsome risk management.", "fr": "Les acteurs de l'IA définissent la ou les tâches techniques d'apprentissage ou de prise de décision qu'un système d'IA est conçu pour accomplir, ou les bénéfices que le système apportera. Plus la définition de la tâche est claire et circonscrite, plus il est aisé d'en cartographier les bénéfices et les risques, ce qui conduit à une gestion des risques plus complète." }, "roles": [], "levels": [], "themes": [ "INV" ], "checks": [ "CHK-CATEGORIZATION" ], "newChecks": [], "category": "map" }, { "code": "MAP-2.2", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.", "fr": "Les informations relatives aux limites de connaissance du système d'IA et à la manière dont ses sorties peuvent être utilisées et supervisées par des humains sont documentées. La documentation fournit des informations suffisantes pour aider les acteurs pertinents de l'IA à prendre des décisions et à mener les actions qui en découlent." }, "desc": { "en": "An AI lifecycle consists of many interdependent activities involving a diverse set of actors that often do not have full visibility or control over other parts of the lifecycle and its associated contexts or risks. The interdependencies between these activities, and among the relevant AI actors and organizations, can make it difficult to reliably anticipate potential impacts of AI systems. For example, early decisions in identifying the purpose and objective of an AI system can alter its behavior and capabilities, and the dynamics of deployment setting (such as end users or impacted individuals) can shape the positive or negative impacts of AI system decisions. As a result, the best intentions within one dimension of the AI lifecycle can be undermined via interactions with decisions and conditions in other, later activities. This complexity and varying levels of visibility can introduce uncertainty. And, once deployed and in use, AI systems may sometimes perform poorly, manifest unanticipated negative impacts, or violate legal or ethical norms. These risks and incidents can result from a variety of factors. For example, downstream decisions can be influenced by end user over-trust or under-trust, and other complexities related to AI-supported decision-making.", "fr": "Un cycle de vie de l'IA comporte de nombreuses activités interdépendantes impliquant un ensemble diversifié d'acteurs qui, souvent, n'ont pas une visibilité ou un contrôle complets sur les autres parties du cycle de vie et sur les contextes ou risques qui y sont associés. Les interdépendances entre ces activités, ainsi qu'entre les acteurs de l'IA et les organisations concernés, peuvent rendre difficile l'anticipation fiable des impacts potentiels des systèmes d'IA. Par exemple, les décisions prises précocement lors de l'identification de la finalité et de l'objectif d'un système d'IA peuvent altérer son comportement et ses capacités, et la dynamique du cadre de déploiement (tels que les utilisateurs finaux ou les personnes affectées) peut façonner les impacts positifs ou négatifs des décisions du système d'IA. Par conséquent, les meilleures intentions au sein d'une dimension du cycle de vie de l'IA peuvent être compromises par les interactions avec des décisions et des conditions relevant d'autres activités ultérieures. Cette complexité et ces niveaux de visibilité variables peuvent introduire de l'incertitude. Et, une fois déployés et en usage, les systèmes d'IA peuvent parfois présenter de piètres performances, manifester des impacts négatifs imprévus, ou enfreindre des normes juridiques ou éthiques. Ces risques et incidents peuvent résulter de divers facteurs. Par exemple, les décisions en aval peuvent être influencées par une confiance excessive ou insuffisante de l'utilisateur final, ainsi que par d'autres complexités liées à la prise de décision assistée par l'IA." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-DOC-TECH" ], "newChecks": [], "category": "map" }, { "code": "MAP-2.3", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.", "fr": "Les considérations d'intégrité scientifique et de TEVV sont identifiées et documentées, y compris celles relatives à la conception expérimentale, à la collecte et à la sélection des données (p. ex. disponibilité, représentativité, adéquation), à la fiabilité du système et à la validation des construits." }, "desc": { "en": "Standard testing and evaluation protocols provide a basis to confirm assurance in a system that it is operating as designed and claimed. AI systems’ complexities create challenges for traditional testing and evaluation methodologies, which tend to be designed for static or isolated system performance. Opportunities for risk continue well beyond design and deployment, into system operation and application of system-enabled decisions. Testing and evaluation methodologies and metrics therefore address a continuum of activities. TEVV is enhanced when key metrics for performance, safety, and reliability are interpreted in a socio-technical context and not confined to the boundaries of the AI system pipeline.", "fr": "Des protocoles de test et d'évaluation standardisés fournissent une base permettant de confirmer l'assurance qu'un système fonctionne tel qu'il a été conçu et tel qu'il est présenté. Les complexités des systèmes d'IA soulèvent des défis pour les méthodologies traditionnelles de test et d'évaluation, lesquelles tendent à être conçues pour évaluer la performance de systèmes statiques ou isolés. Les occasions de risque perdurent bien au-delà de la conception et du déploiement, jusqu'à l'exploitation du système et l'application des décisions rendues possibles par celui-ci. Les méthodologies et les métriques de test et d'évaluation portent donc sur un continuum d'activités. Le TEVV (test, évaluation, vérification et validation) est renforcé lorsque les métriques clés de performance, de sécurité et de fiabilité sont interprétées dans un contexte socio-technique et ne se limitent pas aux frontières du pipeline du système d'IA." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "CHK-TEVV" ], "newChecks": [], "category": "map" }, { "code": "MAP-3.1", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Potential benefits of intended AI system functionality and performance are examined and documented.", "fr": "Les bénéfices potentiels des fonctionnalités et performances prévues du système d'IA sont examinés et documentés." }, "desc": { "en": "AI systems have enormous potential to improve quality of life, enhance economic prosperity and security costs. Organizations are encouraged to define and document system purpose and utility, and its potential positive impacts and benefits beyond current known performance benchmarks.", "fr": "Les systèmes d'IA recèlent un potentiel considérable d'amélioration de la qualité de vie et de renforcement de la prospérité et de la sécurité économiques. Les organisations sont encouragées à définir et à documenter la finalité et l'utilité du système, ainsi que ses impacts positifs et bénéfices potentiels au-delà des référentiels de performance actuellement connus." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-USECASE-SCOPING" ], "newChecks": [], "category": "map" }, { "code": "MAP-3.2", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness - as connected to organizational risk tolerance - are examined and documented.", "fr": "Les coûts potentiels, y compris non monétaires, résultant d'erreurs d'IA attendues ou avérées ou de la fonctionnalité et de la fiabilité du système – en lien avec la tolérance au risque de l'organisation – sont examinés et documentés." }, "desc": { "en": "Anticipating negative impacts of AI systems is a difficult task. Negative impacts can be due to many factors, such as system non-functionality or use outside of its operational limits, and may range from minor annoyance to serious injury, financial losses, or regulatory enforcement actions. AI actors can work with a broad set of stakeholders to improve their capacity for understanding systems’ potential impacts – and subsequently – systems’ risks.", "fr": "Anticiper les impacts négatifs des systèmes d'IA est une tâche difficile. Les impacts négatifs peuvent découler de nombreux facteurs, tels qu'un dysfonctionnement du système ou une utilisation en dehors de ses limites opérationnelles, et peuvent aller d'un désagrément mineur à des blessures graves, des pertes financières ou des actions coercitives réglementaires. Les acteurs de l'IA peuvent collaborer avec un large ensemble de parties prenantes afin d'améliorer leur capacité à comprendre les impacts potentiels des systèmes — et, par voie de conséquence, les risques associés à ceux-ci." }, "roles": [], "levels": [], "themes": [ "IMPACT" ], "checks": [ "CHK-IMPACT-ASSESS" ], "newChecks": [], "category": "map" }, { "code": "MAP-3.3", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization.", "fr": "Le périmètre d'application visé est spécifié et documenté en fonction des capacités du système, du contexte établi et de la catégorisation du système d'IA." }, "desc": { "en": "Systems that function in a narrow scope tend to enable better mapping, measurement, and management of risks in the learning or decision-making tasks and the system context. A narrow application scope also helps ease TEVV functions and related resources within an organization.", "fr": "Les systèmes qui fonctionnent dans un périmètre restreint tendent à permettre une meilleure cartographie, mesure et gestion des risques relatifs aux tâches d'apprentissage ou de prise de décision et au contexte du système. Un périmètre d'application restreint contribue également à faciliter les fonctions de TEVV et la mobilisation des ressources connexes au sein d'une organisation." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-USECASE-SCOPING" ], "newChecks": [], "category": "map" }, { "code": "MAP-3.4", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Processes for operator and practitioner proficiency with AI system performance and trustworthiness - and relevant technical standards and certifications - are defined, assessed, and documented.", "fr": "Les processus relatifs à la maîtrise, par les opérateurs et praticiens, de la performance et de la fiabilité du système d'IA – ainsi que les normes techniques et certifications pertinentes – sont définis, évalués et documentés." }, "desc": { "en": "Human-AI configurations can span from fully autonomous to fully manual. AI systems can autonomously make decisions, defer decision-making to a human expert, or be used by a human decision-maker as an additional opinion. In some scenarios, professionals with expertise in a specific domain work in conjunction with an AI system towards a specific end goal—for example, a decision about another individual(s). Depending on the purpose of the system, the expert may interact with the AI system but is rarely part of the design or development of the system itself. These experts are not necessarily familiar with machine learning, data science, computer science, or other fields traditionally associated with AI design or development and - depending on the application - will likely not require such familiarity. For example, for AI systems that are deployed in health care delivery the experts are the physicians and bring their expertise about medicine—not data science, data modeling and engineering, or other computational factors. The challenge in these settings is not educating the end user about AI system capabilities, but rather leveraging, and not replacing, practitioner domain expertise.", "fr": "Les configurations humain-IA peuvent s'étendre d'un mode entièrement autonome à un mode entièrement manuel. Les systèmes d'IA peuvent prendre des décisions de manière autonome, déférer la prise de décision à un expert humain, ou être utilisés par un décideur humain à titre d'avis supplémentaire. Dans certains scénarios, des professionnels dotés d'une expertise dans un domaine spécifique travaillent conjointement avec un système d'IA en vue d'un objectif final déterminé — par exemple, une décision concernant une ou plusieurs autres personnes. Selon la finalité du système, l'expert peut interagir avec le système d'IA mais participe rarement à la conception ou au développement du système lui-même. Ces experts ne sont pas nécessairement familiers de l'apprentissage automatique, de la science des données, de l'informatique ou d'autres domaines traditionnellement associés à la conception ou au développement de l'IA et — selon l'application — n'auront vraisemblablement pas besoin d'une telle familiarité. Par exemple, pour les systèmes d'IA déployés dans la prestation de soins de santé, les experts sont les médecins et apportent leur expertise en médecine — et non en science des données, en modélisation et en ingénierie des données, ou en d'autres facteurs computationnels. Le défi dans ces contextes ne consiste pas à former l'utilisateur final aux capacités du système d'IA, mais plutôt à tirer parti de l'expertise métier du praticien, sans la remplacer." }, "roles": [], "levels": [], "themes": [ "LIT" ], "checks": [ "CHK-COMPETENCE" ], "newChecks": [], "category": "map" }, { "code": "MAP-3.5", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the govern function.", "fr": "Les processus de supervision humaine sont définis, évalués et documentés conformément aux politiques organisationnelles issues de la fonction govern." }, "desc": { "en": "As AI systems have evolved in accuracy and precision, computational systems have moved from being used purely for decision support—or for explicit use by and under the control of a human operator—to automated decision making with limited input from humans. Computational decision support systems augment another, typically human, system in making decisions.These types of configurations increase the likelihood of outputs being produced with little human involvement.", "fr": "À mesure que les systèmes d'IA ont gagné en exactitude et en précision, les systèmes computationnels sont passés d'une utilisation purement dédiée à l'aide à la décision — ou à un usage explicite par un opérateur humain et sous son contrôle — à une prise de décision automatisée avec une intervention humaine limitée. Les systèmes computationnels d'aide à la décision viennent renforcer un autre système, généralement humain, dans la prise de décisions. Ce type de configurations accroît la probabilité que des résultats soient produits avec une faible implication humaine." }, "roles": [], "levels": [], "themes": [ "HUMAN" ], "checks": [ "VER-008-03", "VER-008-01" ], "newChecks": [], "category": "map" }, { "code": "MAP-4.1", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Approaches for mapping AI technology and legal risks of its components - including the use of third-party data or software - are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights.", "fr": "Des approches de cartographie de la technologie d'IA et des risques juridiques de ses composants – y compris l'usage de données ou de logiciels tiers – sont en place, suivies et documentées, de même que les risques d'atteinte à la propriété intellectuelle ou à d'autres droits d'un tiers." }, "desc": { "en": "Technologies and personnel from third-parties are another potential sources of risk to consider during AI risk management activities. Such risks may be difficult to map since risk priorities or tolerances may not be the same as the deployer organization.", "fr": "Les technologies et le personnel provenant de tiers constituent une autre source potentielle de risque à prendre en compte lors des activités de gestion des risques de l'IA. De tels risques peuvent être difficiles à cartographier, dans la mesure où les priorités ou les tolérances au risque peuvent différer de celles de l'organisation déployant le système." }, "roles": [], "levels": [], "themes": [ "TPR" ], "checks": [ "CHK-THIRDPARTY-POL", "CHK-COMPONENTS" ], "newChecks": [], "category": "map" }, { "code": "MAP-4.2", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.", "fr": "Les contrôles de risque internes portant sur les composants du système d'IA, y compris les technologies d'IA tierces, sont identifiés et documentés." }, "desc": { "en": "In the course of their work, AI actors often utilize open-source, or otherwise freely available, third-party technologies – some of which may have privacy, bias, and security risks. Organizations may consider internal risk controls for these technology sources and build up practices for evaluating third-party material prior to deployment.", "fr": "Dans le cadre de leurs travaux, les acteurs de l'IA ont souvent recours à des technologies tierces open source, ou par ailleurs librement disponibles — dont certaines peuvent comporter des risques en matière de protection de la vie privée, de biais et de sécurité. Les organisations peuvent envisager des contrôles internes des risques pour ces sources technologiques et développer des pratiques d'évaluation du matériel provenant de tiers préalablement au déploiement." }, "roles": [], "levels": [], "themes": [ "TPR" ], "checks": [ "CHK-COMPONENTS" ], "newChecks": [], "category": "map" }, { "code": "MAP-5.1", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.", "fr": "La probabilité et l'ampleur de chaque impact identifié (potentiellement bénéfique comme néfaste), établies à partir de l'usage attendu, des usages passés de systèmes d'IA dans des contextes similaires, des rapports d'incidents publics, des retours de personnes extérieures à l'équipe ayant développé ou déployé le système d'IA, ou d'autres données, sont identifiées et documentées." }, "desc": { "en": "AI actors can evaluate, document and triage the likelihood of AI system impacts identified in Map 5.1 Likelihood estimates may then be assessed and judged for go/no-go decisions about deploying an AI system. If an organization decides to proceed with deploying the system, the likelihood and magnitude estimates can be used to assign TEVV resources appropriate for the risk level.", "fr": "Les acteurs de l'IA peuvent évaluer, documenter et hiérarchiser la probabilité des impacts des systèmes d'IA identifiés au point Map 5.1. Les estimations de probabilité peuvent ensuite être appréciées et évaluées en vue des décisions de type « go/no-go » concernant le déploiement d'un système d'IA. Si une organisation décide de procéder au déploiement du système, les estimations de probabilité et d'ampleur peuvent être utilisées pour affecter des ressources de TEVV appropriées au niveau de risque." }, "roles": [], "levels": [], "themes": [ "IMPACT" ], "checks": [ "CHK-IMPACT-ASSESS" ], "newChecks": [], "category": "map" }, { "code": "MAP-5.2", "art": { "fr": "MAP", "en": "MAP" }, "title": { "en": "Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.", "fr": "Des pratiques et des personnels destinés à soutenir un engagement régulier avec les acteurs pertinents de l'IA et à intégrer les retours sur les impacts positifs, négatifs et imprévus sont en place et documentés." }, "desc": { "en": "AI systems are socio-technical in nature and can have positive, neutral, or negative implications that extend beyond their stated purpose. Negative impacts can be wide- ranging and affect individuals, groups, communities, organizations, and society, as well as the environment and national security.", "fr": "Les systèmes d'IA sont de nature socio-technique et peuvent avoir des implications positives, neutres ou négatives qui s'étendent au-delà de leur finalité déclarée. Les impacts négatifs peuvent être de grande ampleur et affecter les individus, les groupes, les communautés, les organisations et la société, ainsi que l'environnement et la sécurité nationale." }, "roles": [], "levels": [], "themes": [ "CONTEST" ], "checks": [ "CHK-STAKEHOLDER-FEEDBACK" ], "newChecks": [], "category": "map" }, { "code": "MEASURE-1.1", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Approaches and metrics for measurement of AI risks enumerated during the map function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not - or cannot - be measured are properly documented.", "fr": "Les approches et métriques de mesure des risques d'IA recensés lors de la fonction map sont sélectionnées pour mise en œuvre, en commençant par les risques d'IA les plus significatifs. Les risques ou caractéristiques de fiabilité qui ne seront pas – ou ne peuvent pas – être mesurés sont dûment documentés." }, "desc": { "en": "The development and utility of trustworthy AI systems depends on reliable measurements and evaluations of underlying technologies and their use. Compared with traditional software systems, AI technologies bring new failure modes, inherent dependence on training data and methods which directly tie to data quality and representativeness. Additionally, AI systems are inherently socio-technical in nature, meaning they are influenced by societal dynamics and human behavior. AI risks – and benefits – can emerge from the interplay of technical aspects combined with societal factors related to how a system is used, its interactions with other AI systems, who operates it, and the social context in which it is deployed. In other words, What should be measured depends on the purpose, audience, and needs of the evaluations.", "fr": "Le développement et l'utilité des systèmes d'IA dignes de confiance dépendent de la fiabilité des mesures et des évaluations des technologies sous-jacentes et de leur utilisation. Comparées aux systèmes logiciels traditionnels, les technologies d'IA introduisent de nouveaux modes de défaillance, une dépendance intrinsèque aux données et aux méthodes d'entraînement, lesquelles sont directement liées à la qualité et à la représentativité des données. En outre, les systèmes d'IA sont de nature intrinsèquement sociotechnique, ce qui signifie qu'ils sont influencés par les dynamiques sociétales et le comportement humain. Les risques – et les bénéfices – liés à l'IA peuvent émerger de l'interaction entre les aspects techniques et les facteurs sociétaux relatifs à la manière dont un système est utilisé, à ses interactions avec d'autres systèmes d'IA, à qui l'exploite, et au contexte social dans lequel il est déployé. Autrement dit, ce qui doit être mesuré dépend de la finalité, du public et des besoins des évaluations." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-MEASURE-PLAN" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-1.2", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.", "fr": "La pertinence des métriques d'IA et l'efficacité des contrôles existants sont régulièrement évaluées et mises à jour, y compris les signalements d'erreurs et les impacts potentiels sur les communautés concernées." }, "desc": { "en": "Different AI tasks, such as neural networks or natural language processing, benefit from different evaluation techniques. Use-case and particular settings in which the AI system is used also affects appropriateness of the evaluation techniques. Changes in the operational settings, data drift, model drift are among factors that suggest regularly assessing and updating appropriateness of AI metrics and their effectiveness can enhance reliability of AI system measurements.", "fr": "Différentes tâches d'IA, telles que les réseaux de neurones ou le traitement du langage naturel, tirent parti de différentes techniques d'évaluation. Le cas d'usage et les contextes particuliers dans lesquels le système d'IA est utilisé influent également sur la pertinence des techniques d'évaluation. Les évolutions des contextes opérationnels, la dérive des données et la dérive du modèle figurent parmi les facteurs qui laissent penser que le fait d'évaluer et d'actualiser régulièrement la pertinence des métriques d'IA et leur efficacité peut améliorer la fiabilité des mesures des systèmes d'IA." }, "roles": [], "levels": [], "themes": [ "MONIT" ], "checks": [ "CHK-METRIC-REVIEW" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-1.3", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.", "fr": "Des experts internes n'ayant pas participé au développement de première ligne du système et/ou des évaluateurs indépendants sont associés aux évaluations et mises à jour régulières. Des experts du domaine, des utilisateurs, des acteurs de l'IA extérieurs à l'équipe ayant développé ou déployé le système, ainsi que les communautés concernées, sont consultés à l'appui des évaluations, selon les besoins et la tolérance au risque de l'organisation." }, "desc": { "en": "The current AI systems are brittle, the failure modes are not well described, and the systems are dependent on the context in which they were developed and do not transfer well outside of the training environment. A reliance on local evaluations will be necessary along with a continuous monitoring of these systems. Measurements that extend beyond classical measures (which average across test cases) or expand to focus on pockets of failures where there are potentially significant costs can improve the reliability of risk management activities. Feedback from affected communities about how AI systems are being used can make AI evaluation purposeful. Involving internal experts who did not serve as front-line developers for the system and/or independent assessors regular assessments of AI systems helps a fulsome characterization of AI systems’ performance and trustworthiness .", "fr": "Les systèmes d'IA actuels sont fragiles, leurs modes de défaillance ne sont pas bien décrits, et les systèmes sont dépendants du contexte dans lequel ils ont été développés et se transposent mal en dehors de l'environnement d'entraînement. Il sera nécessaire de s'appuyer sur des évaluations locales, ainsi que sur une surveillance continue de ces systèmes. Des mesures allant au-delà des mesures classiques (qui font la moyenne sur l'ensemble des cas de test) ou étendues afin de se concentrer sur des poches de défaillances où des coûts potentiellement significatifs existent peuvent améliorer la fiabilité des activités de gestion des risques. Les retours des communautés affectées sur la manière dont les systèmes d'IA sont utilisés peuvent donner un sens à l'évaluation de l'IA. Le fait d'impliquer des experts internes n'ayant pas participé en première ligne au développement du système et/ou des évaluateurs indépendants dans des évaluations régulières des systèmes d'IA contribue à une caractérisation complète des performances et de la fiabilité des systèmes d'IA." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "CHK-INDEP-ASSESS" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.1", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Test sets, metrics, and details about the tools used during TEVV are documented.", "fr": "Les jeux de test, les métriques et les détails relatifs aux outils utilisés lors du TEVV sont documentés." }, "desc": { "en": "Documenting measurement approaches, test sets, metrics, processes and materials used, and associated details builds foundation upon which to build a valid, reliable measurement process. Documentation enables repeatability and consistency, and can enhance AI risk management decisions.", "fr": "La documentation des approches de mesure, des jeux de test, des métriques, des processus et des matériels utilisés, ainsi que des détails associés, jette les bases sur lesquelles construire un processus de mesure valide et fiable. La documentation permet la reproductibilité et la cohérence, et peut améliorer les décisions de gestion des risques liés à l'IA." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "CHK-TEVV" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.2", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.", "fr": "Les évaluations impliquant des sujets humains respectent les exigences applicables (y compris la protection des sujets humains) et sont représentatives de la population concernée." }, "desc": { "en": "Measurement and evaluation of AI systems often involves testing with human subjects or using data captured from human subjects. Protection of human subjects is required by law when carrying out federally funded research, and is a domain specific requirement for some disciplines. Standard human subjects protection procedures include protecting the welfare and interests of human subjects, designing evaluations to minimize risks to subjects, and completion of mandatory training regarding legal requirements and expectations.", "fr": "La mesure et l'évaluation des systèmes d'IA impliquent souvent des essais menés avec des sujets humains ou l'utilisation de données recueillies auprès de sujets humains. La protection des sujets humains est requise par la loi lors de la réalisation de recherches financées par des fonds fédéraux, et constitue une exigence propre à certaines disciplines. Les procédures standard de protection des sujets humains comprennent la protection du bien-être et des intérêts des sujets humains, la conception d'évaluations visant à minimiser les risques pour les sujets, et la réalisation d'une formation obligatoire relative aux exigences et attentes légales." }, "roles": [], "levels": [], "themes": [ "PRIV" ], "checks": [ "CHK-HUMAN-SUBJECTS" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.3", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented.", "fr": "Les critères de performance ou d'assurance du système d'IA sont mesurés qualitativement ou quantitativement et démontrés pour des conditions similaires au(x) cadre(s) de déploiement. Les mesures sont documentées." }, "desc": { "en": "The current risk and impact environment suggests AI system performance estimates are insufficient and require a deeper understanding of deployment context of use. Computationally focused performance testing and evaluation schemes are restricted to test data sets and in silico techniques. These approaches do not directly evaluate risks and impacts in real world environments and can only predict what might create impact based on an approximation of expected AI use. To properly manage risks, more direct information is necessary to understand how and under what conditions deployed AI creates impacts, who is most likely to be impacted, and what that experience is like.", "fr": "L'environnement actuel des risques et des impacts laisse penser que les estimations de performance des systèmes d'IA sont insuffisantes et nécessitent une compréhension plus approfondie du contexte d'utilisation lors du déploiement. Les schémas de test et d'évaluation des performances axés sur le calcul se limitent aux jeux de données de test et aux techniques in silico. Ces approches n'évaluent pas directement les risques et les impacts dans des environnements réels et ne peuvent que prédire ce qui pourrait produire un impact sur la base d'une approximation de l'utilisation attendue de l'IA. Pour gérer correctement les risques, des informations plus directes sont nécessaires afin de comprendre comment et dans quelles conditions l'IA déployée produit des impacts, qui est le plus susceptible d'être impacté, et à quoi ressemble cette expérience." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "VER-009-02" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.4", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "The functionality and behavior of the AI system and its components - as identified in the map function - are monitored when in production.", "fr": "La fonctionnalité et le comportement du système d'IA et de ses composants – tels qu'identifiés dans la fonction map – font l'objet d'une surveillance en production." }, "desc": { "en": "AI systems may encounter new issues and risks while in production as the environment evolves over time. This effect, often referred to as “drift”, means AI systems no longer meet the assumptions and limitations of the original design. Regular monitoring allows AI Actors to monitor the functionality and behavior of the AI system and its components – as identified in the MAP function - and enhance the speed and efficacy of necessary system interventions.", "fr": "Les systèmes d'IA peuvent rencontrer de nouveaux problèmes et de nouveaux risques en production à mesure que l'environnement évolue dans le temps. Cet effet, souvent désigné par le terme « dérive », signifie que les systèmes d'IA ne satisfont plus aux hypothèses et aux limites de la conception initiale. Une surveillance régulière permet aux acteurs de l'IA de surveiller la fonctionnalité et le comportement du système d'IA et de ses composants – tels qu'identifiés dans la fonction MAP (cartographie) – et d'améliorer la rapidité et l'efficacité des interventions nécessaires sur le système." }, "roles": [], "levels": [], "themes": [ "MONIT" ], "checks": [ "VER-021-F-01" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.5", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented.", "fr": "Il est démontré que le système d'IA à déployer est valide et fiable. Les limites de généralisation au-delà des conditions dans lesquelles la technologie a été développée sont documentées." }, "desc": { "en": "An AI system that is not validated or that fails validation may be inaccurate or unreliable or may generalize poorly to data and settings beyond its training, creating and increasing AI risks and reducing trustworthiness. AI Actors can improve system validity by creating processes for exploring and documenting system limitations. This includes broad consideration of purposes and uses for which the system was not designed.", "fr": "Un système d'IA qui n'est pas validé ou qui échoue à la validation peut être inexact ou peu fiable, ou peut mal se généraliser à des données et à des contextes dépassant son entraînement, créant et accroissant les risques liés à l'IA et réduisant sa fiabilité. Les acteurs de l'IA peuvent améliorer la validité du système en créant des processus permettant d'explorer et de documenter les limites du système. Cela inclut une prise en compte large des finalités et des usages pour lesquels le système n'a pas été conçu." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "VER-009-02" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.6", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "The AI system is evaluated regularly for safety risks - as identified in the map function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.", "fr": "Le système d'IA est évalué régulièrement au regard des risques de sécurité (safety) – tels qu'identifiés dans la fonction map. Il est démontré que le système à déployer est sûr, que son risque négatif résiduel n'excède pas la tolérance au risque et qu'il peut défaillir de manière sûre, en particulier s'il est amené à fonctionner au-delà de ses limites de connaissance. Les métriques de sécurité reflètent la fiabilité et la robustesse du système, la surveillance en temps réel et les temps de réponse en cas de défaillance." }, "desc": { "en": "Many AI systems are being introduced into settings such as transportation, manufacturing or security, where failures may give rise to various physical or environmental harms. AI systems that may endanger human life, health, property or the environment are tested thoroughly prior to deployment, and are regularly evaluated to confirm the system is safe during normal operations, and in settings beyond its proposed use and knowledge limits.", "fr": "De nombreux systèmes d'IA sont introduits dans des contextes tels que les transports, la fabrication ou la sécurité, où des défaillances peuvent donner lieu à divers préjudices physiques ou environnementaux. Les systèmes d'IA susceptibles de mettre en danger la vie humaine, la santé, les biens ou l'environnement sont testés de manière approfondie avant leur déploiement, et sont régulièrement évalués afin de confirmer que le système est sûr en fonctionnement normal, ainsi que dans des contextes dépassant son utilisation prévue et ses limites de connaissance." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "CHK-SAFETY" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.7", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "AI system security and resilience - as identified in the map function - are evaluated and documented.", "fr": "La sécurité (security) et la résilience du système d'IA – telles qu'identifiées dans la fonction map – sont évaluées et documentées." }, "desc": { "en": "AI systems, as well as the ecosystems in which they are deployed, may be said to be resilient if they can withstand unexpected adverse events or unexpected changes in their environment or use – or if they can maintain their functions and structure in the face of internal and external change and degrade safely and gracefully when this is necessary. Common security concerns relate to adversarial examples, data poisoning, and the exfiltration of models, training data, or other intellectual property through AI system endpoints. AI systems that can maintain confidentiality, integrity, and availability through protection mechanisms that prevent unauthorized access and use may be said to be secure.", "fr": "Les systèmes d'IA, ainsi que les écosystèmes dans lesquels ils sont déployés, peuvent être qualifiés de résilients s'ils sont capables de résister à des événements indésirables inattendus ou à des changements inattendus de leur environnement ou de leur usage — ou s'ils peuvent maintenir leurs fonctions et leur structure face à des changements internes et externes et se dégrader de manière sûre et progressive lorsque cela est nécessaire. Les préoccupations de sécurité courantes concernent les exemples antagonistes, l'empoisonnement des données et l'exfiltration de modèles, de données d'entraînement ou d'autres éléments de propriété intellectuelle par le biais des points de terminaison du système d'IA. Les systèmes d'IA capables de maintenir la confidentialité, l'intégrité et la disponibilité au moyen de mécanismes de protection qui empêchent l'accès et l'utilisation non autorisés peuvent être qualifiés de sécurisés." }, "roles": [], "levels": [], "themes": [ "SEC" ], "checks": [ "CHK-SECURITY" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.8", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Risks associated with transparency and accountability - as identified in the map function - are examined and documented.", "fr": "Les risques associés à la transparence et à la redevabilité – tels qu'identifiés dans la fonction map – sont examinés et documentés." }, "desc": { "en": "Transparency enables meaningful visibility into entire AI pipelines, workflows, processes or organizations and decreases information asymmetry between AI developers and operators and other AI Actors and impacted communities. Transparency is a central element of effective AI risk management that enables insight into how an AI system is working, and the ability to address risks if and when they emerge. The ability for system users, individuals, or impacted communities to seek redress for incorrect or problematic AI system outcomes is one control for transparency and accountability. Higher level recourse processes are typically enabled by lower level implementation efforts directed at explainability and interpretability functionality. See Measure 2.9.", "fr": "La transparence permet une visibilité significative sur l'ensemble des chaînes de traitement, des flux de travail, des processus ou des organisations liés à l'IA et réduit l'asymétrie d'information entre les développeurs et exploitants d'IA d'une part, et les autres acteurs de l'IA et les communautés impactées d'autre part. La transparence est un élément central d'une gestion des risques efficace de l'IA, qui permet de comprendre le fonctionnement d'un système d'IA et de traiter les risques dès lors qu'ils apparaissent. La possibilité, pour les utilisateurs du système, les individus ou les communautés impactées, de demander réparation face à des résultats incorrects ou problématiques d'un système d'IA constitue l'un des moyens de contrôle de la transparence et de la responsabilité. Les processus de recours de haut niveau reposent généralement sur des efforts de mise en œuvre de bas niveau consacrés aux fonctionnalités d'explicabilité et d'interprétabilité. Voir Measure 2.9." }, "roles": [], "levels": [], "themes": [ "TRANS" ], "checks": [ "CHK-TRANSPARENCY" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.9", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "The AI model is explained, validated, and documented, and AI system output is interpreted within its context - as identified in the map function - to inform responsible use and governance.", "fr": "Le modèle d'IA est expliqué, validé et documenté, et les sorties du système d'IA sont interprétées dans leur contexte – tel qu'identifié dans la fonction map – afin d'éclairer un usage et une gouvernance responsables." }, "desc": { "en": "Explainability and interpretability assist those operating or overseeing an AI system, as well as users of an AI system, to gain deeper insights into the functionality and trustworthiness of the system, including its outputs.", "fr": "L'explicabilité et l'interprétabilité aident les personnes qui exploitent ou supervisent un système d'IA, ainsi que les utilisateurs d'un système d'IA, à acquérir une compréhension plus approfondie de la fonctionnalité et de la fiabilité du système, y compris de ses résultats." }, "roles": [], "levels": [], "themes": [ "DOC" ], "checks": [ "CHK-MODEL-CARD" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.10", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Privacy risk of the AI system - as identified in the map function - is examined and documented.", "fr": "Le risque d'atteinte à la vie privée du système d'IA – tel qu'identifié dans la fonction map – est examiné et documenté." }, "desc": { "en": "Privacy refers generally to the norms and practices that help to safeguard human autonomy, identity, and dignity. These norms and practices typically address freedom from intrusion, limiting observation, or individuals’ agency to consent to disclosure or control of facets of their identities (e.g., body, data, reputation).", "fr": "La confidentialité désigne de manière générale les normes et les pratiques qui contribuent à préserver l'autonomie, l'identité et la dignité humaines. Ces normes et pratiques portent généralement sur l'absence d'intrusion, la limitation de l'observation, ou la faculté des individus à consentir à la divulgation ou au contrôle de certaines facettes de leur identité (par exemple, le corps, les données, la réputation)." }, "roles": [], "levels": [], "themes": [ "IMPACT", "PRIV" ], "checks": [ "VER-019-D-01" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.11", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Fairness and bias - as identified in the map function - are evaluated and results are documented.", "fr": "L'équité et les biais – tels qu'identifiés dans la fonction map – sont évalués et les résultats sont documentés." }, "desc": { "en": "Fairness in AI includes concerns for equality and equity by addressing issues such as harmful bias and discrimination. Standards of fairness can be complex and difficult to define because perceptions of fairness differ among cultures and may shift depending on application. Organizations’ risk management efforts will be enhanced by recognizing and considering these differences. Systems in which harmful biases are mitigated are not necessarily fair. For example, systems in which predictions are somewhat balanced across demographic groups may still be inaccessible to individuals with disabilities or affected by the digital divide or may exacerbate existing disparities or systemic biases.", "fr": "L'équité en matière d'IA englobe des préoccupations d'égalité et d'équité en traitant des enjeux tels que les biais préjudiciables et la discrimination. Les critères d'équité peuvent être complexes et difficiles à définir, car les perceptions de l'équité diffèrent selon les cultures et peuvent évoluer selon l'application. Les efforts de gestion des risques des organisations seront améliorés par la reconnaissance et la prise en compte de ces différences. Les systèmes dans lesquels les biais préjudiciables sont atténués ne sont pas nécessairement équitables. Par exemple, des systèmes dont les prédictions sont relativement équilibrées entre les groupes démographiques peuvent néanmoins rester inaccessibles aux personnes en situation de handicap ou affectées par la fracture numérique, ou peuvent exacerber les disparités existantes ou les biais systémiques." }, "roles": [], "levels": [], "themes": [ "FAIR" ], "checks": [ "CHK-BIAS" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.12", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Environmental impact and sustainability of AI model training and management activities - as identified in the map function - are assessed and documented.", "fr": "L'impact environnemental et la durabilité des activités d'entraînement et de gestion du modèle d'IA – tels qu'identifiés dans la fonction map – sont évalués et documentés." }, "desc": { "en": "Large-scale, high-performance computational resources used by AI systems for training and operation can contribute to environmental impacts. Direct negative impacts to the environment from these processes are related to energy consumption, water consumption, and greenhouse gas (GHG) emissions. The OECD has identified metrics for each type of negative direct impact.", "fr": "Les ressources computationnelles à grande échelle et à haute performance utilisées par les systèmes d'IA pour l'entraînement et l'exploitation peuvent contribuer à des impacts environnementaux. Les impacts négatifs directs sur l'environnement résultant de ces processus sont liés à la consommation d'énergie, à la consommation d'eau et aux émissions de gaz à effet de serre (GES). L'OCDE a défini des métriques pour chaque type d'impact direct négatif." }, "roles": [], "levels": [], "themes": [ "ENV" ], "checks": [ "CHK-ENV" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-2.13", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Effectiveness of the employed TEVV metrics and processes in the measure function are evaluated and documented.", "fr": "L'efficacité des métriques et processus TEVV employés dans la fonction measure est évaluée et documentée." }, "desc": { "en": "The development of metrics is a process often considered to be objective but, as a human and organization driven endeavor, can reflect implicit and systemic biases, and may inadvertently reflect factors unrelated to the target function. Measurement approaches can be oversimplified, gamed, lack critical nuance, become used and relied upon in unexpected ways, fail to account for differences in affected groups and contexts.", "fr": "L'élaboration de métriques est un processus souvent considéré comme objectif mais qui, en tant qu'entreprise menée par des humains et des organisations, peut refléter des biais implicites et systémiques, et peut refléter par inadvertance des facteurs sans rapport avec la fonction visée. Les approches de mesure peuvent être simplifiées à l'excès, détournées, manquer de nuances essentielles, être utilisées et invoquées de manière inattendue, ou ne pas tenir compte des différences entre les groupes affectés et les contextes." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "CHK-TEVV" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-3.1", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.", "fr": "Des approches, des personnels et une documentation sont en place pour identifier et suivre régulièrement les risques d'IA existants, imprévus et émergents, à partir de facteurs tels que la performance prévue et réelle dans les contextes de déploiement." }, "desc": { "en": "For trustworthy AI systems, regular system monitoring is carried out in accordance with organizational governance policies, AI actor roles and responsibilities, and within a culture of continual improvement. If and when emergent or complex risks arise, it may be necessary to adapt internal risk management procedures, such as regular monitoring, to stay on course. Documentation, resources, and training are part of an overall strategy to support AI actors as they investigate and respond to AI system errors, incidents or negative impacts.", "fr": "Pour des systèmes d'IA dignes de confiance, une surveillance régulière du système est effectuée conformément aux politiques de gouvernance de l'organisation, aux rôles et responsabilités des acteurs de l'IA, et au sein d'une culture d'amélioration continue. Si et lorsque des risques émergents ou complexes apparaissent, il peut être nécessaire d'adapter les procédures internes de gestion des risques, telles que la surveillance régulière, afin de rester sur la bonne voie. La documentation, les ressources et la formation font partie d'une stratégie globale visant à soutenir les acteurs de l'IA lorsqu'ils enquêtent sur les erreurs, incidents ou impacts négatifs des systèmes d'IA et y répondent." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "VER-003-01" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-3.2", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.", "fr": "Des approches de suivi des risques sont envisagées pour les situations où les risques d'IA sont difficiles à évaluer avec les techniques de mesure actuellement disponibles ou pour lesquelles les métriques ne sont pas encore disponibles." }, "desc": { "en": "Risks identified in the Map function may be complex, emerge over time, or difficult to measure. Systematic methods for risk tracking, including novel measurement approaches, can be established as part of regular monitoring and improvement processes.", "fr": "Les risques identifiés dans la fonction MAP (cartographie) peuvent être complexes, émerger au fil du temps, ou être difficiles à mesurer. Des méthodes systématiques de suivi des risques, y compris des approches de mesure novatrices, peuvent être établies dans le cadre des processus réguliers de surveillance et d'amélioration." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "VER-003-01" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-3.3", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.", "fr": "Des processus de retour permettant aux utilisateurs finaux et aux communautés impactées de signaler des problèmes et de contester les résultats du système sont établis et intégrés aux métriques d'évaluation du système d'IA." }, "desc": { "en": "Assessing impact is a two-way effort. Many AI system outcomes and impacts may not be visible or recognizable to AI actors across the development and deployment dimensions of the AI lifecycle, and may require direct feedback about system outcomes from the perspective of end users and impacted groups.", "fr": "L'évaluation de l'impact est un effort à double sens. De nombreux résultats et impacts des systèmes d'IA peuvent ne pas être visibles ou reconnaissables par les acteurs de l'IA dans les dimensions de développement et de déploiement du cycle de vie de l'IA, et peuvent nécessiter un retour direct sur les résultats du système du point de vue des utilisateurs finaux et des groupes impactés." }, "roles": [], "levels": [], "themes": [ "CONTEST" ], "checks": [ "CHK-STAKEHOLDER-FEEDBACK" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-4.1", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.", "fr": "Les approches de mesure servant à identifier les risques d'IA sont reliées au(x) contexte(s) de déploiement et éclairées par la consultation d'experts du domaine et d'autres utilisateurs finaux. Les approches sont documentées." }, "desc": { "en": "AI Actors carrying out TEVV tasks may have difficulty evaluating impacts within the system context of use. AI system risks and impacts are often best described by end users and others who may be affected by output and subsequent decisions. AI Actors can elicit feedback from impacted individuals and communities via participatory engagement processes established in Govern 5.1 and 5.2, and carried out in Map 1.6, 5.1, and 5.2.", "fr": "Les acteurs de l'IA qui réalisent des tâches TEVV peuvent avoir des difficultés à évaluer les impacts dans le contexte d'utilisation du système. Les risques et les impacts des systèmes d'IA sont souvent le mieux décrits par les utilisateurs finaux et par d'autres personnes susceptibles d'être affectées par les résultats et les décisions qui en découlent. Les acteurs de l'IA peuvent recueillir les retours des individus et des communautés impactés au moyen des processus d'engagement participatif établis dans Govern 5.1 et 5.2, et mis en œuvre dans Map 1.6, 5.1 et 5.2." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-MEASURE-PLAN" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-4.2", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. Results are documented.", "fr": "Les résultats de mesure relatifs à la fiabilité du système d'IA dans le(s) contexte(s) de déploiement et tout au long du cycle de vie de l'IA sont éclairés par les contributions d'experts du domaine et d'acteurs pertinents de l'IA afin de valider que le système fonctionne de manière constante et conforme aux intentions. Les résultats sont documentés." }, "desc": { "en": "Feedback captured from relevant AI Actors can be evaluated in combination with output from Measure 2.5 to 2.11 to determine if the AI system is performing within pre-defined operational limits for validity and reliability, safety, security and resilience, privacy, bias and fairness, explainability and interpretability, and transparency and accountability. This feedback provides an additional layer of insight about AI system performance, including potential misuse or reuse outside of intended settings.", "fr": "Les retours recueillis auprès des acteurs de l'IA concernés peuvent être évalués en combinaison avec les résultats des mesures Measure 2.5 à 2.11 afin de déterminer si le système d'IA fonctionne dans les limites opérationnelles prédéfinies en matière de validité et de fiabilité, de sûreté, de sécurité et de résilience, de confidentialité, de biais et d'équité, d'explicabilité et d'interprétabilité, ainsi que de transparence et de responsabilité. Ces retours apportent une strate supplémentaire d'éclairage sur les performances du système d'IA, y compris une éventuelle mauvaise utilisation ou réutilisation en dehors des contextes prévus." }, "roles": [], "levels": [], "themes": [ "ROBUST" ], "checks": [ "CHK-INDEP-ASSESS" ], "newChecks": [], "category": "measure" }, { "code": "MEASURE-4.3", "art": { "fr": "MEASURE", "en": "MEASURE" }, "title": { "en": "Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented.", "fr": "Les améliorations ou dégradations mesurables de performance, fondées sur les consultations avec les acteurs pertinents de l'IA, y compris les communautés concernées, et sur les données de terrain relatives aux risques pertinents du contexte et aux caractéristiques de fiabilité, sont identifiées et documentées." }, "desc": { "en": "TEVV activities conducted throughout the AI system lifecycle can provide baseline quantitative measures for trustworthy characteristics. When combined with results from Measure 2.5 to 2.11 and Measure 4.1 and 4.2, TEVV actors can maintain a comprehensive view of system performance. These measures can be augmented through participatory engagement with potentially impacted communities or other forms of stakeholder elicitation about AI systems’ impacts. These sources of information can allow AI actors to explore potential adjustments to system components, adapt operating conditions, or institute performance improvements.", "fr": "Les activités TEVV menées tout au long du cycle de vie du système d'IA peuvent fournir des mesures quantitatives de référence pour les caractéristiques dignes de confiance. Combinées aux résultats des mesures Measure 2.5 à 2.11 ainsi que Measure 4.1 et 4.2, les acteurs TEVV peuvent maintenir une vue d'ensemble des performances du système. Ces mesures peuvent être enrichies par un engagement participatif avec les communautés potentiellement impactées ou par d'autres formes de recueil des retours des parties prenantes sur les impacts des systèmes d'IA. Ces sources d'information peuvent permettre aux acteurs de l'IA d'explorer d'éventuels ajustements des composants du système, d'adapter les conditions d'exploitation, ou de mettre en place des améliorations des performances." }, "roles": [], "levels": [], "themes": [ "ROBUST", "MONIT" ], "checks": [ "VER-AUTO-05" ], "newChecks": [], "category": "measure" }, { "code": "MANAGE-1.1", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.", "fr": "Une décision est prise quant à savoir si le système d'IA atteint ses finalités prévues et objectifs déclarés, et si son développement ou son déploiement doit se poursuivre." }, "desc": { "en": "AI systems may not necessarily be the right solution for a given business task or problem. A standard risk management practice is to formally weigh an AI system’s negative risks against its benefits, and to determine if the AI system is an appropriate solution. Tradeoffs among trustworthiness characteristics —such as deciding to deploy a system based on system performance vs system transparency–may require regular assessment throughout the AI lifecycle.", "fr": "Les systèmes d'IA ne constituent pas nécessairement la solution appropriée à une tâche ou à un problème métier donné. Une pratique courante de gestion des risques consiste à mettre formellement en balance les risques négatifs d'un système d'IA et ses bénéfices, et à déterminer si le système d'IA représente une solution appropriée. Les arbitrages entre les caractéristiques de fiabilité — par exemple, la décision de déployer un système en fonction de ses performances ou de sa transparence — peuvent nécessiter une évaluation régulière tout au long du cycle de vie de l'IA." }, "roles": [], "levels": [], "themes": [ "IMPACT", "GOV" ], "checks": [ "CHK-IMPACT-ASSESS", "CHK-GO-NOGO" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-1.2", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.", "fr": "Le traitement des risques d'IA documentés est priorisé en fonction de l'impact, de la probabilité et des ressources ou méthodes disponibles." }, "desc": { "en": "Risk refers to the composite measure of an event’s probability of occurring and the magnitude (or degree) of the consequences of the corresponding events. The impacts, or consequences, of AI systems can be positive, negative, or both and can result in opportunities or risks.", "fr": "Le risque désigne la mesure composite de la probabilité de survenue d'un événement et de l'ampleur (ou du degré) des conséquences des événements correspondants. Les impacts, ou conséquences, des systèmes d'IA peuvent être positifs, négatifs, ou les deux, et peuvent se traduire par des opportunités ou par des risques." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-RISK-TOLERANCE", "CHK-RISK-RESPONSE" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-1.3", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Responses to the AI risks deemed high priority, as identified by the map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.", "fr": "Les réponses aux risques d'IA jugés hautement prioritaires, tels qu'identifiés par la fonction map, sont élaborées, planifiées et documentées. Les options de réponse au risque peuvent inclure l'atténuation, le transfert, l'évitement ou l'acceptation." }, "desc": { "en": "Outcomes from GOVERN-1, MAP-5 and MEASURE-2, can be used to address and document identified risks based on established risk tolerances. Organizations can follow existing regulations and guidelines for risk criteria, tolerances and responses established by organizational, domain, discipline, sector, or professional requirements. In lieu of such guidance, organizations can develop risk response plans based on strategies such as accepted model risk management, enterprise risk management, and information sharing and disclosure practices.", "fr": "Les résultats de GOVERN-1, MAP-5 et MEASURE-2 peuvent être utilisés pour traiter et documenter les risques identifiés en fonction des seuils de tolérance au risque établis. Les organisations peuvent suivre les réglementations et lignes directrices existantes relatives aux critères, aux seuils de tolérance et aux réponses en matière de risque, établis par des exigences organisationnelles, propres à un domaine, à une discipline, à un secteur ou à une profession. À défaut de telles orientations, les organisations peuvent élaborer des plans de réponse aux risques fondés sur des stratégies telles que la gestion reconnue du risque de modèle, la gestion des risques d'entreprise, ainsi que les pratiques de partage et de divulgation de l'information." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-RISK-TOLERANCE", "CHK-RISK-RESPONSE" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-1.4", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.", "fr": "Les risques résiduels négatifs (définis comme la somme de tous les risques non atténués) pesant à la fois sur les acquéreurs en aval des systèmes d'IA et sur les utilisateurs finaux sont documentés." }, "desc": { "en": "Organizations may choose to accept or transfer some of the documented risks from MAP and MANAGE 1.3 and 2.1. Such risks, known as residual risk, may affect downstream AI actors such as those engaged in system procurement or use. Transparent monitoring and managing residual risks enables cost benefit analysis and the examination of potential values of AI systems versus its potential negative impacts.", "fr": "Les organisations peuvent choisir d'accepter ou de transférer une partie des risques documentés issus de MAP et de MANAGE 1.3 et 2.1. De tels risques, appelés risques résiduels, peuvent affecter les acteurs de l'IA situés en aval, tels que ceux engagés dans l'acquisition ou l'utilisation du système. Le suivi et la gestion transparents des risques résiduels permettent une analyse coûts-bénéfices ainsi que l'examen des valeurs potentielles des systèmes d'IA au regard de leurs impacts négatifs potentiels." }, "roles": [], "levels": [], "themes": [ "GOV", "IMPACT" ], "checks": [ "CHK-ROLES-CLARIFIED", "CHK-IMPACT-ASSESS" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-2.1", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Resources required to manage AI risks are taken into account - along with viable non-AI alternative systems, approaches, or methods - to reduce the magnitude or likelihood of potential impacts.", "fr": "Les ressources nécessaires à la gestion des risques d'IA sont prises en compte – de même que des systèmes, approches ou méthodes alternatifs viables non fondés sur l'IA – afin de réduire l'ampleur ou la probabilité des impacts potentiels." }, "desc": { "en": "Organizational risk response may entail identifying and analyzing alternative approaches, methods, processes or systems, and balancing tradeoffs between trustworthiness characteristics and how they relate to organizational principles and societal values. Analysis of these tradeoffs is informed by consulting with interdisciplinary organizational teams, independent domain experts, and engaging with individuals or community groups. These processes require sufficient resource allocation.", "fr": "La réponse au risque à l'échelle de l'organisation peut impliquer d'identifier et d'analyser des approches, méthodes, processus ou systèmes alternatifs, et d'équilibrer les arbitrages entre les caractéristiques de fiabilité et la manière dont elles se rapportent aux principes de l'organisation et aux valeurs sociétales. L'analyse de ces arbitrages s'appuie sur la consultation d'équipes organisationnelles interdisciplinaires et d'experts indépendants du domaine, ainsi que sur la mobilisation de personnes ou de groupes communautaires. Ces processus nécessitent une allocation de ressources suffisante." }, "roles": [], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-ALT" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-2.2", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Mechanisms are in place and applied to sustain the value of deployed AI systems.", "fr": "Des mécanismes sont en place et appliqués pour maintenir la valeur des systèmes d'IA déployés." }, "desc": { "en": "System performance and trustworthiness may evolve and shift over time, once an AI system is deployed and put into operation. This phenomenon, generally known as drift, can degrade the value of the AI system to the organization and increase the likelihood of negative impacts. Regular monitoring of AI systems’ performance and trustworthiness enhances organizations’ ability to detect and respond to drift, and thus sustain an AI system’s value once deployed. Processes and mechanisms for regular monitoring address system functionality and behavior - as well as impacts and alignment with the values and norms within the specific context of use. For example, considerations regarding impacts on personal or public safety or privacy may include limiting high speeds when operating autonomous vehicles or restricting illicit content recommendations for minors.", "fr": "Les performances et la fiabilité d'un système peuvent évoluer et se modifier au fil du temps, une fois le système d'IA déployé et mis en exploitation. Ce phénomène, généralement connu sous le nom de dérive, peut dégrader la valeur du système d'IA pour l'organisation et accroître la probabilité d'impacts négatifs. Le suivi régulier des performances et de la fiabilité des systèmes d'IA renforce la capacité des organisations à détecter la dérive et à y répondre, et ainsi à maintenir la valeur d'un système d'IA une fois déployé. Les processus et mécanismes de suivi régulier portent sur la fonctionnalité et le comportement du système, ainsi que sur les impacts et l'alignement avec les valeurs et les normes propres au contexte d'utilisation spécifique. Par exemple, les considérations relatives aux impacts sur la sécurité personnelle ou publique ou sur la vie privée peuvent inclure la limitation des vitesses élevées lors de l'exploitation de véhicules autonomes ou la restriction des recommandations de contenus illicites destinés aux mineurs." }, "roles": [], "levels": [], "themes": [ "MONIT" ], "checks": [ "VER-021-F-01" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-2.3", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Procedures are followed to respond to and recover from a previously unknown risk when it is identified.", "fr": "Des procédures sont suivies pour répondre à un risque jusqu'alors inconnu lorsqu'il est identifié et pour s'en rétablir." }, "desc": { "en": "AI systems – like any technology – can demonstrate non-functionality or failure or unexpected and unusual behavior. They also can be subject to attacks, incidents, or other misuse or abuse – which their sources are not always known apriori. Organizations can establish, document, communicate and maintain treatment procedures to recognize and counter, mitigate and manage risks that were not previously identified.", "fr": "Les systèmes d'IA — comme toute technologie — peuvent présenter un dysfonctionnement, une défaillance ou un comportement inattendu et inhabituel. Ils peuvent également faire l'objet d'attaques, d'incidents, ou d'autres formes de mauvais usage ou d'abus, dont les sources ne sont pas toujours connues a priori. Les organisations peuvent établir, documenter, communiquer et maintenir des procédures de traitement afin de reconnaître et de contrer, d'atténuer et de gérer les risques qui n'avaient pas été précédemment identifiés." }, "roles": [], "levels": [], "themes": [ "INCID" ], "checks": [ "VER-022-F-01", "VER-022-D-01" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-2.4", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.", "fr": "Des mécanismes sont en place et appliqués, et des responsabilités sont attribuées et comprises, pour remplacer, désengager ou désactiver les systèmes d'IA présentant des performances ou des résultats non conformes à l'usage prévu." }, "desc": { "en": "Performance inconsistent with intended use does not always increase risk or lead to negative impacts. Rigorous TEVV practices are useful for protecting against negative impacts regardless of intended use. When negative impacts do arise, superseding (bypassing), disengaging, or deactivating/decommissioning a model, AI system component(s), or the entire AI system may be necessary, such as when:", "fr": "Des performances non conformes à l'utilisation prévue n'accroissent pas toujours le risque ni ne conduisent à des impacts négatifs. Des pratiques rigoureuses de TEVV sont utiles pour se prémunir contre les impacts négatifs, indépendamment de l'utilisation prévue. Lorsque des impacts négatifs surviennent, il peut être nécessaire de contourner, de désengager, ou de désactiver/mettre hors service un modèle, un ou plusieurs composants d'un système d'IA, ou l'ensemble du système d'IA, notamment lorsque :" }, "roles": [], "levels": [], "themes": [ "HUMAN" ], "checks": [ "VER-008-02" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-3.1", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.", "fr": "Les risques et bénéfices liés à l'IA provenant de ressources tierces font l'objet d'une surveillance régulière, et des contrôles de risque sont appliqués et documentés." }, "desc": { "en": "AI systems may depend on external resources and associated processes, including third- party data, software or hardware systems. Third parties’ supplying organizations with components and services, including tools, software, and expertise for AI system design, development, deployment or use can improve efficiency and scalability. It can also increase complexity and opacity, and, in-turn, risk. Documenting third-party technologies, personnel, and resources that were employed can help manage risks. Focusing first and foremost on risks involving physical safety, legal liabilities, regulatory compliance, and negative impacts on individuals, groups, or society is recommended.", "fr": "Les systèmes d'IA peuvent dépendre de ressources externes et des processus qui leur sont associés, y compris des données, des logiciels ou des systèmes matériels de tiers. Le fait que des tiers fournissent aux organisations des composants et des services, notamment des outils, des logiciels et une expertise pour la conception, le développement, le déploiement ou l'utilisation de systèmes d'IA, peut améliorer l'efficacité et la capacité de montée en charge. Cela peut également accroître la complexité et l'opacité, et, par conséquent, le risque. La documentation des technologies, du personnel et des ressources de tiers ayant été employés peut contribuer à gérer les risques. Il est recommandé de se concentrer avant tout sur les risques touchant à la sécurité physique, aux responsabilités juridiques, à la conformité réglementaire et aux impacts négatifs sur les individus, les groupes ou la société." }, "roles": [], "levels": [], "themes": [ "TPR" ], "checks": [ "CHK-THIRDPARTY-CONTINGENCY" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-3.2", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.", "fr": "Les modèles pré-entraînés utilisés pour le développement font l'objet d'une surveillance dans le cadre de la surveillance et de la maintenance régulières du système d'IA." }, "desc": { "en": "A common approach in AI development is transfer learning, whereby an existing pre- trained model is adapted for use in a different, but related application. AI actors in development tasks often use pre-trained models from third-party entities for tasks such as image classification, language prediction, and entity recognition, because the resources to build such models may not be readily available to most organizations. Pre-trained models are typically trained to address various classification or prediction problems, using exceedingly large datasets and computationally intensive resources. The use of pre-trained models can make it difficult to anticipate negative system outcomes or impacts. Lack of documentation or transparency tools increases the difficulty and general complexity when deploying pre-trained models and hinders root cause analyses.", "fr": "Une approche courante dans le développement de l'IA est l'apprentissage par transfert, par lequel un modèle pré-entraîné existant est adapté en vue d'une utilisation dans une application différente, mais connexe. Les acteurs de l'IA affectés à des tâches de développement utilisent souvent des modèles pré-entraînés provenant d'entités tierces pour des tâches telles que la classification d'images, la prédiction linguistique et la reconnaissance d'entités, car les ressources nécessaires à la construction de tels modèles ne sont pas toujours aisément disponibles pour la plupart des organisations. Les modèles pré-entraînés sont généralement entraînés pour traiter divers problèmes de classification ou de prédiction, en utilisant des jeux de données extrêmement volumineux et des ressources exigeantes en calcul. L'utilisation de modèles pré-entraînés peut rendre difficile l'anticipation des résultats ou des impacts négatifs du système. L'absence d'outils de documentation ou de transparence accroît la difficulté et la complexité générale lors du déploiement de modèles pré-entraînés et entrave les analyses des causes profondes." }, "roles": [], "levels": [], "themes": [ "MONIT" ], "checks": [ "CHK-MODEL-MONITORING" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-4.1", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.", "fr": "Des plans de surveillance post-déploiement du système d'IA sont mis en œuvre, comprenant des mécanismes de recueil et d'évaluation des retours des utilisateurs et des autres acteurs pertinents de l'IA, de contestation et de neutralisation (override), de mise hors service, de réponse aux incidents, de rétablissement et de gestion du changement." }, "desc": { "en": "AI system performance and trustworthiness can change due to a variety of factors. Regular AI system monitoring can help deployers identify performance degradations, adversarial attacks, unexpected and unusual behavior, near-misses, and impacts. Including pre- and post-deployment external feedback about AI system performance can enhance organizational awareness about positive and negative impacts, and reduce the time to respond to risks and harms.", "fr": "Les performances et la fiabilité d'un système d'IA peuvent évoluer en raison de divers facteurs. Le suivi régulier des systèmes d'IA peut aider les déployeurs à identifier les dégradations de performances, les attaques adverses, les comportements inattendus et inhabituels, les quasi-incidents et les impacts. L'intégration de retours externes, avant et après le déploiement, concernant les performances du système d'IA peut renforcer la connaissance qu'a l'organisation des impacts positifs et négatifs, et réduire le délai de réponse aux risques et aux préjudices." }, "roles": [], "levels": [], "themes": [ "MONIT", "INCID" ], "checks": [ "CHK-DECOMM", "VER-022-F-01", "VER-022-D-01", "VER-021-F-01" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-4.2", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.", "fr": "Des activités mesurables d'amélioration continue sont intégrées aux mises à jour du système d'IA et comprennent un engagement régulier avec les parties intéressées, y compris les acteurs pertinents de l'IA." }, "desc": { "en": "Regular monitoring processes enable system updates to enhance performance and functionality in accordance with regulatory and legal frameworks, and organizational and contextual values and norms. These processes also facilitate analyses of root causes, system degradation, drift, near-misses, and failures, and incident response and documentation.", "fr": "Les processus de suivi régulier permettent des mises à jour du système afin d'en améliorer les performances et la fonctionnalité conformément aux cadres réglementaires et juridiques, ainsi qu'aux valeurs et normes organisationnelles et contextuelles. Ces processus facilitent également les analyses des causes profondes, de la dégradation du système, de la dérive, des quasi-incidents et des défaillances, ainsi que la réponse aux incidents et leur documentation." }, "roles": [], "levels": [], "themes": [ "MONIT" ], "checks": [ "CHK-CONTINUAL-IMPROVE" ], "newChecks": [], "category": "manage" }, { "code": "MANAGE-4.3", "art": { "fr": "MANAGE", "en": "MANAGE" }, "title": { "en": "Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.", "fr": "Les incidents et erreurs sont communiqués aux acteurs pertinents de l'IA, y compris les communautés concernées. Les processus de suivi, de réponse et de rétablissement face aux incidents et erreurs sont suivis et documentés." }, "desc": { "en": "Regularly documenting an accurate and transparent account of identified and reported errors can enhance AI risk management activities., Examples include:", "fr": "La documentation régulière d'un compte rendu exact et transparent des erreurs identifiées et signalées peut renforcer les activités de gestion des risques liés à l'IA. En voici des exemples :" }, "roles": [], "levels": [], "themes": [ "INCID" ], "checks": [ "VER-022-F-01", "VER-022-D-01" ], "newChecks": [], "category": "manage" } ], "seeded": true, "stats": { "requirements": 72, "coveredByExisting": 72, "existingChecks": 49, "reusedFromOthers": 10, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/nist-ai-rmf/", "en": "https://atlas.trustflow.ai/en/nist-ai-rmf/" } }, { "id": "ISO42001", "short": "ISO 42001", "name": { "fr": "ISO/IEC 42001:2023, système de management de l'IA", "en": "ISO/IEC 42001:2023, AI management system" }, "jurisdiction": "INTL", "kind": "standard", "status": "voluntary", "binding": false, "object": "org", "summary": { "fr": "Norme certifiable de système de management de l'IA (SMIA), sur le modèle de l'ISO 27001. Clauses 4 à 10 et 38 mesures en Annexe A. Référence des acheteurs et valeur refuge au Colorado.", "en": "Certifiable AI management system (AIMS) standard, modelled on ISO 27001. Clauses 4 to 10 and 38 Annex A controls. Buyer reference and a Colorado safe harbour." }, "scope": { "fr": "Organisations qui fournissent ou utilisent des systèmes d'IA.", "en": "Organisations providing or using AI systems." }, "territorial": { "fr": "Internationale.", "en": "International." }, "axes": [ { "key": "iso_impact", "label": { "fr": "Niveau d'impact du système (Cl. 6.1.4)", "en": "System impact level (Cl. 6.1.4)" }, "scale": "ordinal", "verdicts": [ [ "significant", { "fr": "Impact significatif", "en": "Significant impact" }, "orange" ], [ "limited", { "fr": "Impact limité", "en": "Limited impact" }, "green" ] ] } ], "roles": [ [ "provider", { "fr": "Fournisseur", "en": "Provider" } ], [ "user", { "fr": "Utilisateur", "en": "User" } ], [ "producer", { "fr": "Producteur", "en": "Producer" } ] ], "penalties": { "fr": "Aucune ; perte ou refus de certification.", "en": "None; certification lost or refused." }, "milestones": [ [ "2023-12-18", { "fr": "Publication ISO/IEC 42001", "en": "ISO/IEC 42001 published" }, "done" ], [ "2025-05", { "fr": "ISO/IEC 42005 (analyse d'impact)", "en": "ISO/IEC 42005 (impact assessment)" }, "done" ], [ "2025-07", { "fr": "ISO/IEC 42006 (organismes de certification)", "en": "ISO/IEC 42006 (certification bodies)" }, "done" ], [ "2026-12", { "fr": "Normes harmonisées CEN-CENELEC JTC 21 pour l'AI Act (prEN 18286 SMQ)", "en": "CEN-CENELEC JTC 21 harmonised standards for the AI Act (prEN 18286 QMS)" }, "potential" ] ], "requirements": [ { "code": "ISO-4.3", "art": { "fr": "Cl. 4.3, 4.4", "en": "Cl. 4.3, 4.4" }, "title": { "fr": "Périmètre du SMIA", "en": "Scope of the AIMS" }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-LEGAL-MAP" ], "newChecks": [ "NEW-ISO42001-01" ] }, { "code": "ISO-5.2", "art": { "fr": "Cl. 5.2, A.2", "en": "Cl. 5.2, A.2" }, "title": { "fr": "Politique IA", "en": "AI policy" }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-POL-TRUST" ], "newChecks": [] }, { "code": "ISO-5.3", "art": { "fr": "Cl. 5.3, A.3", "en": "Cl. 5.3, A.3" }, "title": { "fr": "Rôles, responsabilités, signalement des préoccupations", "en": "Roles, responsibilities, reporting of concerns" }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-ROLES-CLARIFIED", "CHK-EXEC-ACCOUNT" ], "newChecks": [] }, { "code": "ISO-6.1.2", "art": { "fr": "Cl. 6.1.2, 6.1.3", "en": "Cl. 6.1.2, 6.1.3" }, "title": { "fr": "Appréciation et traitement des risques IA, déclaration d'applicabilité", "en": "AI risk assessment and treatment, Statement of Applicability" }, "roles": [], "levels": [], "themes": [ "RISK", "QMS" ], "checks": [ "CHK-POL-RISK", "VER-003-01", "CHK-RISK-RESPONSE" ], "newChecks": [ "NEW-ISO42001-02" ] }, { "code": "ISO-6.1.4", "art": { "fr": "Cl. 6.1.4, A.5", "en": "Cl. 6.1.4, A.5" }, "title": { "fr": "Analyse d'impact des systèmes d'IA", "en": "AI system impact assessment" }, "roles": [], "levels": [], "themes": [ "IMPACT" ], "checks": [ "CHK-IMPACT-ASSESS", "VER-020-D-01" ], "newChecks": [] }, { "code": "ISO-7.2", "art": { "fr": "Cl. 7.2, A.4", "en": "Cl. 7.2, A.4" }, "title": { "fr": "Compétences et ressources", "en": "Competence and resources" }, "roles": [], "levels": [], "themes": [ "LIT" ], "checks": [ "CHK-TRAINING", "VER-001-F-01" ], "newChecks": [] }, { "code": "ISO-A.6", "art": { "fr": "A.6", "en": "A.6" }, "title": { "fr": "Cycle de vie : conception, vérification, déploiement, exploitation, journaux", "en": "Lifecycle: design, verification, deployment, operation, event logs" }, "roles": [], "levels": [], "themes": [ "DOC", "LOG", "ROBUST", "MONIT" ], "checks": [ "VER-005-01", "VER-006-02", "CHK-TEVV", "VER-021-F-01" ], "newChecks": [] }, { "code": "ISO-A.7", "art": { "fr": "A.7", "en": "A.7" }, "title": { "fr": "Données des systèmes d'IA : acquisition, qualité, provenance", "en": "Data for AI systems: acquisition, quality, provenance" }, "roles": [], "levels": [], "themes": [ "DATA" ], "checks": [ "VER-004-01", "VER-004-02" ], "newChecks": [] }, { "code": "ISO-A.8", "art": { "fr": "A.8", "en": "A.8" }, "title": { "fr": "Information des parties intéressées, communication des incidents", "en": "Information for interested parties, incident communication" }, "roles": [], "levels": [], "themes": [ "TRANS", "INCID" ], "checks": [ "VER-007-01", "VER-022-F-01" ], "newChecks": [] }, { "code": "ISO-A.9", "art": { "fr": "A.9", "en": "A.9" }, "title": { "fr": "Usage responsable des systèmes d'IA", "en": "Responsible use of AI systems" }, "roles": [], "levels": [], "themes": [ "HUMAN" ], "checks": [ "VER-027-D-01", "VER-008-03" ], "newChecks": [] }, { "code": "ISO-A.10", "art": { "fr": "A.10", "en": "A.10" }, "title": { "fr": "Relations avec les tiers et les clients", "en": "Third-party and customer relationships" }, "roles": [], "levels": [], "themes": [ "TPR" ], "checks": [ "CHK-THIRDPARTY-POL", "VER-026-F-01" ], "newChecks": [] }, { "code": "ISO-9", "art": { "fr": "Cl. 9.2, 9.3", "en": "Cl. 9.2, 9.3" }, "title": { "fr": "Audit interne et revue de direction", "en": "Internal audit and management review" }, "roles": [], "levels": [], "themes": [ "QMS" ], "checks": [ "CHK-REVIEW-PLAN" ], "newChecks": [ "NEW-ISO42001-03" ] }, { "code": "ISO-10", "art": { "fr": "Cl. 10", "en": "Cl. 10" }, "title": { "fr": "Non-conformités et amélioration continue", "en": "Nonconformity and continual improvement" }, "roles": [], "levels": [], "themes": [ "QMS", "MONIT" ], "checks": [ "VER-013-F-01", "CHK-CONTINUAL-IMPROVE" ], "newChecks": [] } ], "related": [ "NISTRMF", "AIACT", "US-CO" ], "sources": [ [ "ISO/IEC 42001", "https://www.iso.org/standard/81230.html" ] ], "seeded": false, "stats": { "requirements": 13, "coveredByExisting": 13, "existingChecks": 26, "reusedFromOthers": 26, "newChecks": 3 }, "url": { "fr": "https://atlas.trustflow.ai/fr/iso-42001/", "en": "https://atlas.trustflow.ai/en/iso-42001/" } }, { "id": "BRPL2338", "short": "PL 2338", "name": { "fr": "Projet de loi brésilien sur l'IA (PL 2338/2023)", "en": "Brazil AI Bill (PL 2338/2023)" }, "jurisdiction": "BR", "kind": "bill", "status": "draft", "binding": false, "object": "system", "summary": { "fr": "Texte adopté par le Sénat le 10/12/2024, proche de l'AI Act : risque excessif, haut risque (Art. 14), IA à usage général, évaluation préliminaire et analyse d'impact algorithmique.", "en": "Senate text approved on 10/12/2024, close to the AI Act: excessive risk, high risk (Art. 14), general-purpose AI, preliminary assessment and algorithmic impact assessment." }, "scope": { "fr": "Développeurs, distributeurs et applicateurs de systèmes d'IA.", "en": "Developers, distributors and appliers of AI systems." }, "territorial": { "fr": "Systèmes fournis ou utilisés au Brésil.", "en": "Systems provided or used in Brazil." }, "axes": [ { "key": "br_pl2338", "label": { "fr": "Niveau de risque PL 2338", "en": "PL 2338 risk level" }, "scale": "ordinal", "verdicts": [ [ "excessive", { "fr": "Risque excessif (Art. 13)", "en": "Excessive risk (Art. 13)" }, "red" ], [ "high", { "fr": "Haut risque (Art. 14)", "en": "High risk (Art. 14)" }, "orange" ], [ "general_purpose_systemic", { "fr": "Usage général à risque systémique", "en": "General-purpose, systemic risk" }, "orange" ], [ "general_purpose", { "fr": "Usage général ou génératif", "en": "General-purpose or generative" }, "amber" ], [ "other", { "fr": "Autre", "en": "Other" }, "green" ], [ "out_of_scope", { "fr": "Hors champ", "en": "Out of scope" }, "slate" ] ] }, { "key": "br_role", "label": { "fr": "Rôle (Art. 4)", "en": "Role (Art. 4)" }, "scale": "categorical", "verdicts": [ [ "developer", { "fr": "Développeur", "en": "Developer" }, "indigo" ], [ "distributor", { "fr": "Distributeur", "en": "Distributor" }, "slate" ], [ "applier", { "fr": "Applicateur", "en": "Applier" }, "violet" ] ] } ], "roles": [ [ "developer", { "fr": "Développeur", "en": "Developer" } ], [ "distributor", { "fr": "Distributeur", "en": "Distributor" } ], [ "applier", { "fr": "Applicateur", "en": "Applier" } ] ], "penalties": { "fr": "Texte Sénat : jusqu'à 50 M BRL ou 2 % du CA par infraction ; suspension.", "en": "Senate text: up to BRL 50M or 2% of turnover per infringement; suspension." }, "milestones": [ [ "2023-05-03", { "fr": "Dépôt au Sénat", "en": "Filed in the Senate" }, "done" ], [ "2024-12-10", { "fr": "Adoption par le Sénat", "en": "Senate approval" }, "done" ], [ "2025-05", { "fr": "Commission spéciale à la Chambre des députés", "en": "Special committee in the Chamber of Deputies" }, "done" ], [ "2026-10", { "fr": "Vote reporté après les élections d'octobre 2026", "en": "Vote pushed past the October 2026 elections" }, "potential" ], [ "2027-06", { "fr": "Adoption possible et début de la vacatio legis", "en": "Possible adoption and start of the vacatio legis" }, "potential" ] ], "related": [ "AIACT" ], "sources": [ [ "Senado PL 2338/2023", "https://www25.senado.leg.br/web/atividade/materias/-/materia/157233" ] ], "requirements": [ { "code": "BR-01", "art": { "fr": "Arts. 12, 29", "en": "Arts. 12, 29" }, "title": { "en": "Preliminary assessment", "fr": "Évaluation préliminaire" }, "desc": { "en": "Classify the system's risk before placing it on the market or using it. Optional for most agents but mitigates sanctions (Art. 50 §1); mandatory for developers of general-purpose and generative AI (Art. 29).", "fr": "Classer le risque du système avant sa mise sur le marché ou son utilisation. Facultative pour la plupart des agents mais atténue les sanctions (art. 50 §1) ; obligatoire pour les développeurs d'IA à usage général et générative (art. 29)." }, "roles": [ "developer", "distributor", "applier" ], "levels": [], "themes": [ "RISK", "INV" ], "checks": [ "CHK-BR-PRELIM" ], "newChecks": [], "category": "gestion_des_risques" }, { "code": "BR-02", "art": { "fr": "Art. 13", "en": "Art. 13" }, "title": { "en": "Excessive-risk practices", "fr": "Pratiques à risque excessif" }, "desc": { "en": "No development, implementation or use of an excessive-risk system; developers take measures to prevent such uses (Art. 13 §1).", "fr": "Aucun développement, déploiement ni usage d'un système à risque excessif ; les développeurs prennent des mesures pour empêcher ces usages (art. 13 §1)." }, "roles": [ "developer", "distributor", "applier" ], "levels": [], "themes": [ "PROHIB" ], "checks": [ "VER-002-01", "VER-002-02", "VER-002-03" ], "newChecks": [], "category": "pratiques_interdites" }, { "code": "BR-03", "art": { "fr": "Art. 5 I", "en": "Art. 5 I" }, "title": { "en": "Information on interaction with AI", "fr": "Information sur l'interaction avec une IA" }, "desc": { "en": "Everyone has the right to prior information that they are interacting with an AI system, through standard icons where relevant, in plain language for vulnerable groups (Art. 5 §§1 and 2).", "fr": "Toute personne a droit à une information préalable indiquant qu'elle interagit avec un système d'IA, par des icônes standardisées le cas échéant, en langage simple pour les publics vulnérables (art. 5 §§1 et 2)." }, "roles": [ "developer", "distributor", "applier" ], "levels": [], "themes": [ "TRANS" ], "checks": [ "VER-018-D-01", "VER-029-D-01" ], "newChecks": [], "category": "transparence_utilisateur" }, { "code": "BR-04", "art": { "fr": "Art. 19", "en": "Art. 19" }, "title": { "en": "Synthetic content identifier", "fr": "Identification du contenu synthétique" }, "desc": { "en": "Synthetic content generated or modified by the system carries an identifier that allows its authenticity or origin to be verified.", "fr": "Le contenu synthétique généré ou modifié par le système porte un identifiant permettant d'en vérifier l'authenticité ou l'origine." }, "roles": [ "developer", "applier" ], "levels": [ "general_purpose" ], "themes": [ "CONTENT" ], "checks": [ "VER-018-D-03" ], "newChecks": [], "category": "transparence_utilisateur" }, { "code": "BR-05", "art": { "fr": "Arts. 5 III, 18", "en": "Arts. 5 III, 18" }, "title": { "en": "Non-discrimination and bias mitigation", "fr": "Non-discrimination et correction des biais" }, "desc": { "en": "Measures to prevent, mitigate and correct discriminatory bias, including on the data used (Art. 18 I.e and II.e).", "fr": "Mesures pour prévenir, atténuer et corriger les biais discriminatoires, y compris sur les données utilisées (art. 18 I.e et II.e)." }, "roles": [ "developer", "applier" ], "levels": [ "high" ], "themes": [ "DATA", "FAIR" ], "checks": [ "VER-004-01", "VER-004-02", "VER-028-D-03" ], "newChecks": [], "category": "gouvernance_donnees" }, { "code": "BR-06", "art": { "fr": "Arts. 6 I, 7", "en": "Arts. 6 I, 7" }, "title": { "en": "Right to explanation", "fr": "Droit à l'explication" }, "desc": { "en": "A person affected by a high-risk system may obtain, free of charge and in plain language, an explanation of the decision, recommendation or prediction made about them.", "fr": "Une personne concernée par un système à haut risque peut obtenir, gratuitement et en langage simple, une explication de la décision, recommandation ou prédiction qui la concerne." }, "roles": [ "applier" ], "levels": [ "high" ], "themes": [ "CONTEST" ], "checks": [ "VER-033-D-01", "VER-033-D-02", "VER-033-D-03" ], "newChecks": [], "category": "affected_persons_rights" }, { "code": "BR-07", "art": { "fr": "Arts. 6 II, 6 III, 9", "en": "Arts. 6 II, 6 III, 9" }, "title": { "en": "Contestation and human review", "fr": "Contestation et révision humaine" }, "desc": { "en": "Affected persons may contest decisions and request human review; the procedures to exercise these rights are published.", "fr": "Les personnes concernées peuvent contester les décisions et demander une révision humaine ; les procédures d'exercice de ces droits sont publiées." }, "roles": [ "applier" ], "levels": [ "high" ], "themes": [ "CONTEST", "HUMAN" ], "checks": [ "CHK-BR-CONTEST" ], "newChecks": [], "category": "affected_persons_rights" }, { "code": "BR-08", "art": { "fr": "Arts. 8, 18 I.d", "en": "Arts. 8, 18 I.d" }, "title": { "en": "Human oversight", "fr": "Supervision humaine" }, "desc": { "en": "Human oversight allowing people to understand, interpret, decide on and intervene in the system; the degree of human oversight in the results is documented.", "fr": "Une supervision humaine permettant de comprendre, interpréter, décider et intervenir sur le système ; le degré de supervision humaine des résultats est documenté." }, "roles": [ "developer", "applier" ], "levels": [ "high" ], "themes": [ "HUMAN" ], "checks": [ "VER-008-01", "VER-008-02", "VER-008-03" ], "newChecks": [], "category": "supervision_humaine" }, { "code": "BR-09", "art": { "fr": "Art. 18 I.a, I.c, I.f", "en": "Art. 18 I.a, I.c, I.f" }, "title": { "en": "Applier documentation", "fr": "Documentation de l'utilisateur (aplicador)" }, "desc": { "en": "The applier documents the system across its lifecycle, the reliability and safety tests performed, and the information that makes results interpretable.", "fr": "L'aplicador documente le système sur tout son cycle de vie, les tests de fiabilité et de sécurité réalisés et les informations qui rendent les résultats interprétables." }, "roles": [ "applier" ], "levels": [ "high" ], "themes": [ "DOC", "ROBUST" ], "checks": [ "VER-005-02", "VER-005-03", "VER-009-02" ], "newChecks": [], "category": "documentation_technique" }, { "code": "BR-10", "art": { "fr": "Art. 18 II.a, II.d", "en": "Art. 18 II.a, II.d" }, "title": { "en": "Developer documentation and explainability", "fr": "Documentation et explicabilité du développeur" }, "desc": { "en": "The developer keeps a record of its governance measures to inform the applier, and implements explainability measures.", "fr": "Le développeur tient un registre de ses mesures de gouvernance pour informer l'aplicador et met en œuvre des mesures d'explicabilité." }, "roles": [ "developer" ], "levels": [ "high" ], "themes": [ "DOC", "TRANS" ], "checks": [ "VER-005-01", "VER-007-01" ], "newChecks": [], "category": "documentation_technique" }, { "code": "BR-11", "art": { "fr": "Art. 18 II.b", "en": "Art. 18 II.b" }, "title": { "en": "Operation logging", "fr": "Journalisation du fonctionnement" }, "desc": { "en": "The system automatically logs its operation so that its accuracy and robustness can be assessed.", "fr": "Le système journalise automatiquement son fonctionnement afin que son exactitude et sa robustesse puissent être évaluées." }, "roles": [ "developer", "applier" ], "levels": [ "high" ], "themes": [ "LOG" ], "checks": [ "VER-006-01", "VER-006-02", "VER-006-03" ], "newChecks": [], "category": "logs_tracabilite" }, { "code": "BR-12", "art": { "fr": "Art. 18 II.c", "en": "Art. 18 II.c" }, "title": { "en": "Security testing", "fr": "Tests de sécurité" }, "desc": { "en": "Tests to assess appropriate levels of security, including of the environment the system runs in.", "fr": "Des tests pour évaluer des niveaux de sécurité appropriés, y compris de l'environnement dans lequel le système fonctionne." }, "roles": [ "developer" ], "levels": [ "high" ], "themes": [ "SEC" ], "checks": [ "VER-009-01", "VER-009-03" ], "newChecks": [], "category": "cybersecurite" }, { "code": "BR-13", "art": { "fr": "Art. 18 I.b", "en": "Art. 18 I.b" }, "title": { "en": "Monitoring of results", "fr": "Surveillance des résultats" }, "desc": { "en": "The applier monitors the system's outputs for accuracy, robustness and discrimination, and mitigates what it finds.", "fr": "L'aplicador surveille les résultats du système (exactitude, robustesse, discrimination) et atténue ce qu'il constate." }, "roles": [ "applier" ], "levels": [ "high" ], "themes": [ "MONIT", "ROBUST" ], "checks": [ "VER-021-D-03", "VER-AUTO-05" ], "newChecks": [], "category": "incidents_surveillance" }, { "code": "BR-14", "art": { "fr": "Arts. 25-28", "en": "Arts. 25-28" }, "title": { "en": "Algorithmic impact assessment", "fr": "Étude d'impact algorithmique" }, "desc": { "en": "An algorithmic impact assessment before placing on the market, kept up to date across the lifecycle. It may be carried out together with the LGPD data protection impact report (Art. 27), and its conclusions are published (Art. 28).", "fr": "Une étude d'impact algorithmique avant la mise sur le marché, tenue à jour tout au long du cycle de vie. Elle peut être menée avec le rapport d'impact LGPD (art. 27) et ses conclusions sont publiées (art. 28)." }, "roles": [ "developer", "applier" ], "levels": [ "high" ], "themes": [ "IMPACT", "PRIV", "TRANS" ], "checks": [ "VER-020-D-01", "VER-019-D-02", "CHK-BR-AIA-PUBLISHED" ], "newChecks": [], "category": "droits_fondamentaux" }, { "code": "BR-15", "art": { "fr": "Arts. 25 §7, 42", "en": "Arts. 25 §7, 42" }, "title": { "en": "Serious incidents", "fr": "Incidents graves" }, "desc": { "en": "A serious risk discovered after release is reported immediately to the authority and the value chain, and serious incidents are reported to the sector authority.", "fr": "Un risque grave découvert après la mise sur le marché est signalé immédiatement à l'autorité et à la chaîne de valeur, et les incidents graves sont déclarés à l'autorité sectorielle." }, "roles": [ "developer", "distributor", "applier" ], "levels": [ "high" ], "themes": [ "INCID" ], "checks": [ "VER-022-D-01", "VER-022-F-01", "VER-013-F-04" ], "newChecks": [], "category": "incidents_surveillance" }, { "code": "BR-16", "art": { "fr": "Arts. 18 §3, 32", "en": "Arts. 18 §3, 32" }, "title": { "en": "Value-chain cooperation", "fr": "Coopération dans la chaîne de valeur" }, "desc": { "en": "Agents cooperate and share the information the others need to meet their obligations; a distributor checks the governance measures before placing on the market (Art. 16 §3).", "fr": "Les agents coopèrent et partagent les informations dont les autres ont besoin pour remplir leurs obligations ; un distributeur vérifie les mesures de gouvernance avant la mise sur le marché (art. 16 §3)." }, "roles": [ "developer", "distributor", "applier" ], "levels": [], "themes": [ "TPR", "RISK" ], "checks": [ "VER-026-F-01", "VER-003-02" ], "newChecks": [], "category": "supply_chain" }, { "code": "BR-17", "art": { "fr": "Arts. 29, 30", "en": "Arts. 29, 30" }, "title": { "en": "General-purpose and generative AI", "fr": "IA à usage général et générative" }, "desc": { "en": "The developer documents development. With systemic risk, before release: model description, test documentation, residual risks, lawful data governance, energy efficiency and downstream documentation (Art. 30 I to VII).", "fr": "Le développeur documente le développement. En cas de risque systémique, avant la mise sur le marché : description du modèle, documentation des tests, risques résiduels, gouvernance licite des données, efficacité énergétique et documentation pour l'aval (art. 30 I à VII)." }, "roles": [ "developer" ], "levels": [ "general_purpose" ], "themes": [ "DOC", "TPR", "RISK", "ENV" ], "checks": [ "VER-031-G-01", "VER-031-G-02", "VER-032-G-02", "CHK-BR-ENERGY" ], "newChecks": [], "category": "gpai" }, { "code": "BR-18", "art": { "fr": "Arts. 62, 64", "en": "Arts. 62, 64" }, "title": { "en": "Training content and opt-out", "fr": "Contenus d'entraînement et opposition" }, "desc": { "en": "A summary of the copyright-protected content used in development is published, and rights holders' opt-out is honoured.", "fr": "Un résumé des contenus protégés par le droit d'auteur utilisés pour le développement est publié et l'opposition des ayants droit est respectée." }, "roles": [ "developer" ], "levels": [], "themes": [ "IP" ], "checks": [ "VER-031-G-04", "VER-031-G-03" ], "newChecks": [], "category": "copyright" }, { "code": "BR-19", "art": { "fr": "Arts. 22, 23", "en": "Arts. 22, 23" }, "title": { "en": "Public-sector duties", "fr": "Obligations du secteur public" }, "desc": { "en": "Public bodies and operators of a public service using a high-risk system keep usage logs (who, which case, which purpose) and publish their preliminary assessments.", "fr": "Les organismes publics et les opérateurs d'un service public qui utilisent un système à haut risque tiennent des journaux d'usage (qui, quel dossier, quelle finalité) et publient leurs évaluations préliminaires." }, "roles": [ "applier" ], "levels": [ "high" ], "themes": [ "LOG", "TRANS" ], "checks": [ "CHK-BR-PUBLIC-LOGS", "CHK-BR-PUBLIC-PRELIM" ], "newChecks": [], "category": "public_sector" }, { "code": "BR-20", "art": { "fr": "Art. 65", "en": "Art. 65" }, "title": { "en": "Remuneration of rights holders", "fr": "Rémunération des ayants droit" }, "desc": { "en": "Rights holders whose content was used for training are remunerated. This chapter may be removed by the Chamber of Deputies.", "fr": "Les ayants droit dont les contenus ont servi à l'entraînement sont rémunérés. Ce chapitre pourrait être supprimé par la Chambre des députés." }, "roles": [ "developer", "applier" ], "levels": [], "themes": [ "IP" ], "checks": [ "CHK-BR-REMUNERATION" ], "newChecks": [], "category": "copyright" } ], "seeded": true, "stats": { "requirements": 20, "coveredByExisting": 20, "existingChecks": 46, "reusedFromOthers": 39, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/bresil-pl-2338/", "en": "https://atlas.trustflow.ai/en/brazil-pl-2338/" } }, { "id": "US-CO", "short": "Colorado AI Act", "name": { "fr": "Colorado AI Act (SB 24-205)", "en": "Colorado AI Act (SB 24-205)" }, "jurisdiction": "US-CO", "kind": "law", "status": "in_force", "binding": true, "object": "decision", "summary": { "fr": "Première loi d'État américaine sur l'IA à haut risque : devoir de diligence contre la discrimination algorithmique pour les décisions importantes (emploi, crédit, logement, santé, éducation, assurance, services publics, juridique).", "en": "First US state law on high-risk AI: duty of care against algorithmic discrimination in consequential decisions (employment, credit, housing, health, education, insurance, public services, legal)." }, "scope": { "fr": "Développeurs et déployeurs de systèmes d'IA à haut risque opérant au Colorado.", "en": "Developers and deployers of high-risk AI systems doing business in Colorado." }, "territorial": { "fr": "Activité au Colorado, décisions concernant des résidents.", "en": "Doing business in Colorado, decisions about residents." }, "axes": [ { "key": "co_high_risk", "label": { "fr": "Système à haut risque (décision importante)", "en": "High-risk system (consequential decision)" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "Facteur substantiel d'une décision importante", "en": "Substantial factor in a consequential decision" }, "orange" ], [ "out_of_scope", { "fr": "Hors champ", "en": "Out of scope" }, "green" ] ] } ], "roles": [ [ "developer", { "fr": "Développeur", "en": "Developer" } ], [ "deployer", { "fr": "Déployeur", "en": "Deployer" } ] ], "penalties": { "fr": "Pratique commerciale déloyale ; action exclusive du procureur général. Défense affirmative si alignement NIST AI RMF ou ISO 42001.", "en": "Unfair trade practice; Attorney General enforcement only. Affirmative defence when aligned with NIST AI RMF or ISO 42001." }, "milestones": [ [ "2024-05-17", { "fr": "Promulgation", "en": "Signed into law" }, "done" ], [ "2025-08-28", { "fr": "SB 25B-004 : report au 30 juin 2026", "en": "SB 25B-004: delay to 30 June 2026" }, "done" ], [ "2026-06-30", { "fr": "Date d'effet (amendements de la session 2026 à vérifier)", "en": "Effective date (2026 session amendments to verify)" }, "verify" ] ], "requirements": [ { "code": "CO-01", "art": { "fr": "§6-1-1702(1)", "en": "§6-1-1702(1)" }, "title": { "fr": "Diligence raisonnable contre la discrimination algorithmique", "en": "Reasonable care against algorithmic discrimination" }, "roles": [ "developer", "deployer" ], "levels": [ "co_high_risk" ], "themes": [ "FAIR" ], "checks": [ "CHK-BIAS", "VER-004-01" ], "newChecks": [] }, { "code": "CO-02", "art": { "fr": "§6-1-1702(2)", "en": "§6-1-1702(2)" }, "title": { "fr": "Documentation remise aux déployeurs (risques, données, évaluations)", "en": "Documentation to deployers (risks, data, evaluations)" }, "roles": [ "developer" ], "levels": [ "co_high_risk" ], "themes": [ "DOC", "TPR" ], "checks": [ "VER-007-01", "VER-003-02" ], "newChecks": [] }, { "code": "CO-03", "art": { "fr": "§6-1-1702(4)", "en": "§6-1-1702(4)" }, "title": { "fr": "Déclaration publique des systèmes à haut risque", "en": "Public statement of high-risk systems" }, "roles": [ "developer", "deployer" ], "levels": [ "co_high_risk" ], "themes": [ "TRANS" ], "checks": [], "newChecks": [ "NEW-US-CO-01" ] }, { "code": "CO-04", "art": { "fr": "§6-1-1702(5), 1703(7)", "en": "§6-1-1702(5), 1703(7)" }, "title": { "fr": "Signalement au procureur général sous 90 jours", "en": "Report to the Attorney General within 90 days" }, "roles": [ "developer", "deployer" ], "levels": [ "co_high_risk" ], "themes": [ "INCID", "REG" ], "checks": [ "VER-013-F-04" ], "newChecks": [ "NEW-US-CO-02" ] }, { "code": "CO-05", "art": { "fr": "§6-1-1703(2)", "en": "§6-1-1703(2)" }, "title": { "fr": "Politique et programme de gestion des risques", "en": "Risk management policy and programme" }, "roles": [ "deployer" ], "levels": [ "co_high_risk" ], "themes": [ "RISK", "GOV" ], "checks": [ "CHK-POL-RISK", "VER-003-01" ], "newChecks": [] }, { "code": "CO-06", "art": { "fr": "§6-1-1703(3)", "en": "§6-1-1703(3)" }, "title": { "fr": "Analyse d'impact annuelle et à chaque modification", "en": "Annual impact assessment and on each modification" }, "roles": [ "deployer" ], "levels": [ "co_high_risk" ], "themes": [ "IMPACT" ], "checks": [ "CHK-IMPACT-ASSESS" ], "newChecks": [] }, { "code": "CO-07", "art": { "fr": "§6-1-1703(4)", "en": "§6-1-1703(4)" }, "title": { "fr": "Avis au consommateur, explication d'une décision défavorable, correction et recours humain", "en": "Consumer notice, adverse decision explanation, correction and human appeal" }, "roles": [ "deployer" ], "levels": [ "co_high_risk" ], "themes": [ "TRANS", "CONTEST", "HUMAN" ], "checks": [ "VER-029-D-01", "VER-033-D-01", "CHK-BR-CONTEST" ], "newChecks": [] }, { "code": "CO-08", "art": { "fr": "§6-1-1704", "en": "§6-1-1704" }, "title": { "fr": "Informer de l'interaction avec une IA", "en": "Disclose interaction with an AI system" }, "roles": [ "deployer" ], "levels": [], "themes": [ "TRANS" ], "checks": [ "VER-018-D-01" ], "newChecks": [] } ], "related": [ "NISTRMF", "ISO42001", "US-TX" ], "sources": [ [ "Colorado SB 24-205", "https://leg.colorado.gov/bills/sb24-205" ] ], "seeded": false, "stats": { "requirements": 8, "coveredByExisting": 7, "existingChecks": 12, "reusedFromOthers": 12, "newChecks": 2 }, "url": { "fr": "https://atlas.trustflow.ai/fr/colorado-ai-act/", "en": "https://atlas.trustflow.ai/en/colorado-ai-act/" } }, { "id": "US-TX", "short": "TRAIGA", "name": { "fr": "Texas Responsible AI Governance Act (HB 149)", "en": "Texas Responsible AI Governance Act (HB 149)" }, "jurisdiction": "US-TX", "kind": "law", "status": "in_force", "binding": true, "object": "system", "summary": { "fr": "Loi texane centrée sur les intentions interdites et le secteur public. Bac à sable réglementaire de 36 mois, période de correction de 60 jours.", "en": "Texas law focused on prohibited intents and the public sector. 36-month regulatory sandbox, 60-day cure period." }, "scope": { "fr": "Développeurs et déployeurs au Texas ; obligations renforcées pour les entités publiques.", "en": "Developers and deployers in Texas; stronger duties for government entities." }, "territorial": { "fr": "Activité au Texas ou produits utilisés par des résidents.", "en": "Doing business in Texas or products used by residents." }, "axes": [ { "key": "tx_scope", "label": { "fr": "Champ TRAIGA", "en": "TRAIGA scope" }, "scale": "ordinal", "verdicts": [ [ "prohibited_intent", { "fr": "Intention interdite", "en": "Prohibited intent" }, "red" ], [ "government", { "fr": "Entité publique ou santé", "en": "Government entity or healthcare" }, "amber" ], [ "other", { "fr": "Autre usage", "en": "Other use" }, "green" ] ] } ], "roles": [ [ "developer", { "fr": "Développeur", "en": "Developer" } ], [ "deployer", { "fr": "Déployeur", "en": "Deployer" } ], [ "government", { "fr": "Entité publique", "en": "Government entity" } ] ], "penalties": { "fr": "10 000 à 200 000 $ par violation, plus astreinte ; action exclusive du procureur général.", "en": "$10,000 to $200,000 per violation, plus daily penalties; Attorney General enforcement only." }, "milestones": [ [ "2025-06-22", { "fr": "Promulgation", "en": "Signed into law" }, "done" ], [ "2026-01-01", { "fr": "Entrée en vigueur", "en": "Effective date" }, "done" ] ], "requirements": [ { "code": "TX-01", "art": { "fr": "§552.052-056", "en": "§552.052-056" }, "title": { "fr": "Intentions interdites : manipulation, notation sociale publique, discrimination illégale, deepfakes sexuels", "en": "Prohibited intents: manipulation, government social scoring, unlawful discrimination, sexual deepfakes" }, "roles": [ "developer", "deployer" ], "levels": [ "prohibited_intent" ], "themes": [ "PROHIB" ], "checks": [ "VER-002-01", "VER-002-02" ], "newChecks": [] }, { "code": "TX-02", "art": { "fr": "§552.051", "en": "§552.051" }, "title": { "fr": "Informer le consommateur d'une interaction avec une IA (entités publiques, santé)", "en": "Disclose AI interaction to consumers (government, healthcare)" }, "roles": [ "government" ], "levels": [ "government" ], "themes": [ "TRANS" ], "checks": [ "VER-018-D-01" ], "newChecks": [] }, { "code": "TX-03", "art": { "fr": "§552.103", "en": "§552.103" }, "title": { "fr": "Répondre à une demande d'enquête du procureur (finalité, données, métriques, limites, suivi)", "en": "Answer an AG civil investigative demand (purpose, data, metrics, limits, monitoring)" }, "roles": [ "developer", "deployer" ], "levels": [], "themes": [ "DOC", "REG" ], "checks": [ "VER-005-01", "VER-AUTO-02" ], "newChecks": [] }, { "code": "TX-04", "art": { "fr": "§552.105", "en": "§552.105" }, "title": { "fr": "Valeur refuge : alignement sur le NIST AI RMF", "en": "Safe harbour: alignment with NIST AI RMF" }, "roles": [ "developer", "deployer" ], "levels": [], "themes": [ "RISK" ], "checks": [ "CHK-POL-RISK" ], "newChecks": [] } ], "related": [ "US-CO", "NISTRMF" ], "sources": [ [ "Texas HB 149", "https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149" ] ], "seeded": false, "stats": { "requirements": 4, "coveredByExisting": 4, "existingChecks": 6, "reusedFromOthers": 6, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/texas-traiga/", "en": "https://atlas.trustflow.ai/en/texas-traiga/" } }, { "id": "US-CA-SB53", "short": "SB 53", "name": { "fr": "Californie : Transparency in Frontier AI Act (SB 53)", "en": "California Transparency in Frontier AI Act (SB 53)" }, "jurisdiction": "US-CA", "kind": "law", "status": "in_force", "binding": true, "object": "model", "summary": { "fr": "Transparence et sûreté des modèles de frontière : cadre de sûreté publié, rapports de transparence, signalement des incidents critiques, protection des lanceurs d'alerte.", "en": "Transparency and safety for frontier models: published safety framework, transparency reports, critical incident reporting, whistleblower protection." }, "scope": { "fr": "Développeurs de modèles de frontière (> 10^26 FLOP) ; obligations renforcées au-delà de 500 M$ de CA.", "en": "Frontier developers (> 10^26 FLOP); stronger duties above $500M revenue." }, "territorial": { "fr": "Modèles mis à disposition en Californie.", "en": "Models made available in California." }, "axes": [ { "key": "sb53_scope", "label": { "fr": "Statut du développeur", "en": "Developer status" }, "scale": "ordinal", "verdicts": [ [ "large_frontier", { "fr": "Grand développeur de frontière", "en": "Large frontier developer" }, "red" ], [ "frontier", { "fr": "Développeur de frontière", "en": "Frontier developer" }, "orange" ], [ "out_of_scope", { "fr": "Hors champ", "en": "Out of scope" }, "green" ] ] } ], "roles": [ [ "frontier_developer", { "fr": "Développeur de frontière", "en": "Frontier developer" } ] ], "penalties": { "fr": "Jusqu'à 1 M$ par violation ; action du procureur général.", "en": "Up to $1M per violation; Attorney General enforcement." }, "milestones": [ [ "2025-09-29", { "fr": "Promulgation", "en": "Signed into law" }, "done" ], [ "2026-01-01", { "fr": "Entrée en vigueur", "en": "Effective date" }, "done" ], [ "2027-01-01", { "fr": "Premiers rapports annuels anonymisés de l'OES", "en": "First anonymised annual OES reports" }, "scheduled" ] ], "requirements": [ { "code": "SB53-01", "art": { "fr": "§22757.12(a)", "en": "§22757.12(a)" }, "title": { "fr": "Publier un cadre de sûreté de frontière (seuils, mesures, gouvernance, sécurité des poids)", "en": "Publish a frontier AI framework (thresholds, mitigations, governance, weight security)" }, "roles": [ "frontier_developer" ], "levels": [ "large_frontier" ], "themes": [ "RISK", "GOV", "SEC" ], "checks": [ "VER-032-G-02", "VER-032-G-04" ], "newChecks": [ "NEW-US-CA-SB53-01" ] }, { "code": "SB53-02", "art": { "fr": "§22757.12(c)", "en": "§22757.12(c)" }, "title": { "fr": "Rapport de transparence avant tout nouveau modèle", "en": "Transparency report before each new model" }, "roles": [ "frontier_developer" ], "levels": [ "large_frontier", "frontier" ], "themes": [ "TRANS", "DOC" ], "checks": [ "VER-031-G-02" ], "newChecks": [] }, { "code": "SB53-03", "art": { "fr": "§22757.13", "en": "§22757.13" }, "title": { "fr": "Signaler un incident critique à l'OES sous 15 jours (24 h si danger imminent)", "en": "Report critical safety incidents to OES within 15 days (24h if imminent)" }, "roles": [ "frontier_developer" ], "levels": [ "large_frontier", "frontier" ], "themes": [ "INCID" ], "checks": [ "VER-032-G-03" ], "newChecks": [] }, { "code": "SB53-04", "art": { "fr": "§22757.12(d)", "en": "§22757.12(d)" }, "title": { "fr": "Résumé trimestriel des évaluations de risque catastrophique", "en": "Quarterly summary of catastrophic risk assessments" }, "roles": [ "frontier_developer" ], "levels": [ "large_frontier" ], "themes": [ "REG" ], "checks": [], "newChecks": [ "NEW-US-CA-SB53-02" ] }, { "code": "SB53-05", "art": { "fr": "Lab. Code §1107", "en": "Lab. Code §1107" }, "title": { "fr": "Lanceurs d'alerte : protection et canal interne anonyme", "en": "Whistleblowers: protection and anonymous internal channel" }, "roles": [ "frontier_developer" ], "levels": [ "large_frontier" ], "themes": [ "GOV" ], "checks": [], "newChecks": [ "NEW-US-CA-SB53-03" ] } ], "related": [ "AIACT", "US-CA-ADMT" ], "sources": [ [ "California SB 53", "https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53" ] ], "seeded": false, "stats": { "requirements": 5, "coveredByExisting": 3, "existingChecks": 4, "reusedFromOthers": 4, "newChecks": 3 }, "url": { "fr": "https://atlas.trustflow.ai/fr/californie-sb-53/", "en": "https://atlas.trustflow.ai/en/california-sb-53/" } }, { "id": "US-CA-ADMT", "short": "CCPA ADMT", "name": { "fr": "Californie : règles CCPA sur les décisions automatisées (ADMT)", "en": "California CCPA automated decision-making (ADMT) regulations" }, "jurisdiction": "US-CA", "kind": "rule", "status": "phased", "binding": true, "object": "decision", "summary": { "fr": "Règles de la CPPA : avis préalable, droit d'opposition et d'accès pour les décisions importantes automatisées, analyses de risque, audits de cybersécurité.", "en": "CPPA rules: pre-use notice, opt-out and access rights for automated significant decisions, risk assessments, cybersecurity audits." }, "scope": { "fr": "Entreprises soumises au CCPA utilisant l'ADMT pour des décisions importantes.", "en": "CCPA-covered businesses using ADMT for significant decisions." }, "territorial": { "fr": "Consommateurs résidant en Californie.", "en": "California resident consumers." }, "axes": [ { "key": "ca_admt", "label": { "fr": "ADMT pour une décision importante", "en": "ADMT for a significant decision" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "Décision importante automatisée", "en": "Automated significant decision" }, "orange" ], [ "out_of_scope", { "fr": "Hors champ", "en": "Out of scope" }, "green" ] ] } ], "roles": [ [ "business", { "fr": "Entreprise", "en": "Business" } ] ], "penalties": { "fr": "2 663 $ à 7 988 $ par violation (montants indexés).", "en": "$2,663 to $7,988 per violation (indexed amounts)." }, "milestones": [ [ "2025-09-23", { "fr": "Approbation par l'OAL", "en": "Approved by OAL" }, "done" ], [ "2026-01-01", { "fr": "Entrée en vigueur", "en": "Effective date" }, "done" ], [ "2027-01-01", { "fr": "Conformité ADMT exigée", "en": "ADMT compliance required" }, "scheduled" ], [ "2028-04-01", { "fr": "Premières attestations d'analyses de risque", "en": "First risk-assessment attestations" }, "scheduled" ] ], "requirements": [ { "code": "ADMT-01", "art": { "fr": "§7220", "en": "§7220" }, "title": { "fr": "Avis préalable à l'utilisation de l'ADMT", "en": "Pre-use notice for ADMT" }, "roles": [ "business" ], "levels": [ "ca_admt" ], "themes": [ "TRANS" ], "checks": [ "VER-029-D-01" ], "newChecks": [] }, { "code": "ADMT-02", "art": { "fr": "§7221", "en": "§7221" }, "title": { "fr": "Droit d'opposition ou recours humain", "en": "Right to opt out or human appeal" }, "roles": [ "business" ], "levels": [ "ca_admt" ], "themes": [ "CONTEST", "HUMAN" ], "checks": [ "CHK-BR-CONTEST" ], "newChecks": [] }, { "code": "ADMT-03", "art": { "fr": "§7222", "en": "§7222" }, "title": { "fr": "Droit d'accès à la logique et au résultat", "en": "Right to access logic and outcome" }, "roles": [ "business" ], "levels": [ "ca_admt" ], "themes": [ "CONTEST" ], "checks": [ "VER-033-D-03" ], "newChecks": [] }, { "code": "ADMT-04", "art": { "fr": "§7150-7157", "en": "§7150-7157" }, "title": { "fr": "Analyse de risque avant le traitement", "en": "Risk assessment before processing" }, "roles": [ "business" ], "levels": [ "ca_admt" ], "themes": [ "IMPACT", "PRIV" ], "checks": [ "VER-019-D-02" ], "newChecks": [] } ], "related": [ "GDPR", "US-CA-SB53" ], "sources": [ [ "CPPA regulations", "https://cppa.ca.gov/regulations/" ] ], "seeded": false, "stats": { "requirements": 4, "coveredByExisting": 4, "existingChecks": 4, "reusedFromOthers": 4, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/californie-ccpa-admt/", "en": "https://atlas.trustflow.ai/en/california-ccpa-admt/" } }, { "id": "US-NYC", "short": "NYC LL 144", "name": { "fr": "New York : Local Law 144 (outils de décision automatisée à l'embauche)", "en": "NYC Local Law 144 (automated employment decision tools)" }, "jurisdiction": "US-NY", "kind": "law", "status": "in_force", "binding": true, "object": "decision", "summary": { "fr": "Audit de biais indépendant annuel et information des candidats pour tout outil automatisé utilisé dans le recrutement ou la promotion à New York.", "en": "Annual independent bias audit and candidate notice for any automated tool used in hiring or promotion in New York City." }, "scope": { "fr": "Employeurs et agences de recrutement.", "en": "Employers and employment agencies." }, "territorial": { "fr": "Candidats et salariés à New York.", "en": "Candidates and employees in New York City." }, "axes": [ { "key": "nyc_aedt", "label": { "fr": "Outil AEDT", "en": "AEDT tool" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "Outil qui aide substantiellement la décision", "en": "Tool that substantially assists the decision" }, "orange" ], [ "out_of_scope", { "fr": "Hors champ", "en": "Out of scope" }, "green" ] ] } ], "roles": [ [ "employer", { "fr": "Employeur", "en": "Employer" } ] ], "penalties": { "fr": "500 $ à 1 500 $ par violation et par jour.", "en": "$500 to $1,500 per violation per day." }, "milestones": [ [ "2021-12-11", { "fr": "Adoption", "en": "Enacted" }, "done" ], [ "2023-07-05", { "fr": "Début du contrôle", "en": "Enforcement begins" }, "done" ], [ "2025-12-02", { "fr": "Audit critique du contrôleur de l'État de New York", "en": "Critical audit by the NY State Comptroller" }, "done" ] ], "requirements": [ { "code": "NYC-01", "art": { "fr": "§20-871(a)(1)", "en": "§20-871(a)(1)" }, "title": { "fr": "Audit de biais indépendant de moins d'un an (ratios d'impact)", "en": "Independent bias audit less than one year old (impact ratios)" }, "roles": [ "employer" ], "levels": [ "nyc_aedt" ], "themes": [ "FAIR" ], "checks": [ "CHK-BIAS" ], "newChecks": [ "NEW-US-NYC-01" ] }, { "code": "NYC-02", "art": { "fr": "§20-871(a)(2)", "en": "§20-871(a)(2)" }, "title": { "fr": "Publication du résumé de l'audit", "en": "Publish the audit summary" }, "roles": [ "employer" ], "levels": [ "nyc_aedt" ], "themes": [ "TRANS" ], "checks": [], "newChecks": [ "NEW-US-NYC-02" ] }, { "code": "NYC-03", "art": { "fr": "§20-871(b)", "en": "§20-871(b)" }, "title": { "fr": "Avis aux candidats 10 jours ouvrés avant, procédure alternative", "en": "Candidate notice 10 business days before, alternative process" }, "roles": [ "employer" ], "levels": [ "nyc_aedt" ], "themes": [ "TRANS", "CONTEST" ], "checks": [ "VER-029-D-01" ], "newChecks": [] } ], "related": [ "US-IL", "US-CO" ], "sources": [ [ "NYC DCWP AEDT", "https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page" ] ], "seeded": false, "stats": { "requirements": 3, "coveredByExisting": 2, "existingChecks": 2, "reusedFromOthers": 2, "newChecks": 2 }, "url": { "fr": "https://atlas.trustflow.ai/fr/new-york-local-law-144/", "en": "https://atlas.trustflow.ai/en/nyc-local-law-144/" } }, { "id": "US-IL", "short": "IL HB 3773", "name": { "fr": "Illinois : HB 3773 (IA dans les décisions d'emploi)", "en": "Illinois HB 3773 (AI in employment decisions)" }, "jurisdiction": "US-IL", "kind": "law", "status": "in_force", "binding": true, "object": "decision", "summary": { "fr": "Amende l'Illinois Human Rights Act : interdit l'usage discriminatoire de l'IA dans l'emploi (y compris via le code postal) et impose d'informer les salariés.", "en": "Amends the Illinois Human Rights Act: bans discriminatory use of AI in employment (including zip-code proxies) and requires notice to employees." }, "scope": { "fr": "Employeurs.", "en": "Employers." }, "territorial": { "fr": "Illinois.", "en": "Illinois." }, "axes": [ { "key": "il_employment", "label": { "fr": "IA dans une décision d'emploi", "en": "AI in an employment decision" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "Recrutement, promotion, discipline, licenciement", "en": "Hiring, promotion, discipline, discharge" }, "orange" ], [ "out_of_scope", { "fr": "Hors champ", "en": "Out of scope" }, "green" ] ] } ], "roles": [ [ "employer", { "fr": "Employeur", "en": "Employer" } ] ], "penalties": { "fr": "Recours devant le Department of Human Rights.", "en": "Claims before the Department of Human Rights." }, "milestones": [ [ "2024-08-09", { "fr": "Promulgation", "en": "Signed into law" }, "done" ], [ "2026-01-01", { "fr": "Entrée en vigueur", "en": "Effective date" }, "done" ] ], "requirements": [ { "code": "IL-01", "art": { "fr": "775 ILCS 5/2-102(L)(1)", "en": "775 ILCS 5/2-102(L)(1)" }, "title": { "fr": "Pas d'effet discriminatoire, y compris par variable de substitution", "en": "No discriminatory effect, including through proxies" }, "roles": [ "employer" ], "levels": [ "il_employment" ], "themes": [ "FAIR" ], "checks": [ "CHK-BIAS", "VER-028-D-03" ], "newChecks": [] }, { "code": "IL-02", "art": { "fr": "775 ILCS 5/2-102(L)(2)", "en": "775 ILCS 5/2-102(L)(2)" }, "title": { "fr": "Informer les salariés de l'usage de l'IA", "en": "Notify employees of AI use" }, "roles": [ "employer" ], "levels": [ "il_employment" ], "themes": [ "TRANS" ], "checks": [ "VER-030-D-01" ], "newChecks": [] } ], "related": [ "US-NYC" ], "sources": [ [ "Illinois HB 3773", "https://www.ilga.gov/legislation/BillStatus.asp?DocNum=3773&GAID=17&DocTypeID=HB&SessionID=112" ] ], "seeded": false, "stats": { "requirements": 2, "coveredByExisting": 2, "existingChecks": 3, "reusedFromOthers": 3, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/illinois-hb-3773/", "en": "https://atlas.trustflow.ai/en/illinois-hb-3773/" } }, { "id": "US-FED", "short": "US federal", "name": { "fr": "États-Unis : politique fédérale IA (EO 14179, AI Action Plan, OMB M-25-21/22)", "en": "US federal AI policy (EO 14179, AI Action Plan, OMB M-25-21/22)" }, "jurisdiction": "US", "kind": "executive", "status": "in_force", "binding": true, "object": "system", "summary": { "fr": "Pas de loi fédérale. Politique de dérégulation depuis janvier 2025 ; obligations limitées aux agences fédérales (IA à fort impact) et à leurs achats. Tentative de préemption des lois d'États.", "en": "No federal statute. Deregulatory policy since January 2025; duties limited to federal agencies (high-impact AI) and their procurement. Push to pre-empt state laws." }, "scope": { "fr": "Agences fédérales et leurs fournisseurs.", "en": "Federal agencies and their vendors." }, "territorial": { "fr": "Gouvernement fédéral.", "en": "Federal government." }, "axes": [ { "key": "us_high_impact", "label": { "fr": "IA à fort impact (OMB M-25-21)", "en": "High-impact AI (OMB M-25-21)" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "Fort impact sur les droits ou la sûreté", "en": "High impact on rights or safety" }, "orange" ], [ "out_of_scope", { "fr": "Autre usage", "en": "Other use" }, "green" ] ] } ], "roles": [ [ "agency", { "fr": "Agence fédérale", "en": "Federal agency" } ], [ "vendor", { "fr": "Fournisseur", "en": "Vendor" } ] ], "penalties": { "fr": "Aucune sanction directe ; conditions contractuelles et budgétaires.", "en": "No direct penalty; contractual and budget conditions." }, "milestones": [ [ "2023-10-30", { "fr": "EO 14110 (sûreté de l'IA)", "en": "EO 14110 (safe AI)" }, "done" ], [ "2025-01-20", { "fr": "EO 14110 révoqué", "en": "EO 14110 revoked" }, "done" ], [ "2025-01-23", { "fr": "EO 14179 : lever les obstacles à l'IA", "en": "EO 14179: removing barriers to AI" }, "done" ], [ "2025-04-03", { "fr": "Mémos OMB M-25-21 (usage) et M-25-22 (achats)", "en": "OMB memos M-25-21 (use) and M-25-22 (procurement)" }, "done" ], [ "2025-07-23", { "fr": "America's AI Action Plan", "en": "America's AI Action Plan" }, "done" ], [ "2025-12-11", { "fr": "EO sur un cadre national : contestation des lois d'États", "en": "EO on a national framework: challenge to state laws" }, "done" ], [ "2027", { "fr": "Loi fédérale de préemption", "en": "Federal pre-emption statute" }, "potential" ] ], "requirements": [ { "code": "USF-01", "art": { "fr": "M-25-21 §3", "en": "M-25-21 §3" }, "title": { "fr": "Chief AI Officer et comité de gouvernance IA", "en": "Chief AI Officer and AI governance board" }, "roles": [ "agency" ], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-EXEC-ACCOUNT", "CHK-ROLES-CLARIFIED" ], "newChecks": [] }, { "code": "USF-02", "art": { "fr": "M-25-21 §3(b)", "en": "M-25-21 §3(b)" }, "title": { "fr": "Inventaire annuel des cas d'usage IA", "en": "Annual AI use case inventory" }, "roles": [ "agency" ], "levels": [], "themes": [ "INV" ], "checks": [ "CHK-INVENTORY" ], "newChecks": [] }, { "code": "USF-03", "art": { "fr": "M-25-21 §4", "en": "M-25-21 §4" }, "title": { "fr": "Pratiques minimales pour l'IA à fort impact : tests, analyse d'impact, supervision, suivi, recours", "en": "Minimum practices for high-impact AI: testing, impact assessment, oversight, monitoring, appeal" }, "roles": [ "agency" ], "levels": [ "us_high_impact" ], "themes": [ "IMPACT", "ROBUST", "HUMAN", "MONIT", "CONTEST" ], "checks": [ "CHK-IMPACT-ASSESS", "CHK-TEVV", "VER-008-02", "VER-021-F-01", "CHK-BR-CONTEST" ], "newChecks": [] }, { "code": "USF-04", "art": { "fr": "M-25-22", "en": "M-25-22" }, "title": { "fr": "Achats : droits sur les données, anti-verrouillage, performance", "en": "Procurement: data rights, lock-in prevention, performance" }, "roles": [ "agency", "vendor" ], "levels": [], "themes": [ "TPR" ], "checks": [ "CHK-THIRDPARTY-POL" ], "newChecks": [] } ], "related": [ "NISTRMF", "US-CO", "US-TX" ], "sources": [ [ "AI Action Plan", "https://www.whitehouse.gov/articles/2025/07/white-house-unveils-americas-ai-action-plan/" ], [ "OMB M-25-21", "https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf" ] ], "seeded": false, "stats": { "requirements": 4, "coveredByExisting": 4, "existingChecks": 9, "reusedFromOthers": 9, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/etats-unis-politique-federale-ia/", "en": "https://atlas.trustflow.ai/en/us-federal-ai-policy/" } }, { "id": "CAN", "short": "Canada", "name": { "fr": "Canada : AIDA (abandonné), Directive sur la prise de décision automatisée, Loi 25 (Québec)", "en": "Canada: AIDA (withdrawn), Directive on Automated Decision-Making, Law 25 (Quebec)" }, "jurisdiction": "CAN", "kind": "bill", "status": "withdrawn", "binding": false, "object": "decision", "summary": { "fr": "La loi fédérale AIDA est morte au feuilleton en janvier 2025. Restent la Directive fédérale (secteur public, évaluation d'impact algorithmique à 4 niveaux) et la Loi 25 du Québec sur les décisions automatisées.", "en": "The federal AIDA died on the order paper in January 2025. What remains: the federal Directive (public sector, 4-level Algorithmic Impact Assessment) and Quebec Law 25 on automated decisions." }, "scope": { "fr": "Institutions fédérales ; entreprises traitant des données de résidents du Québec.", "en": "Federal institutions; businesses processing Quebec residents' data." }, "territorial": { "fr": "Canada, Québec.", "en": "Canada, Quebec." }, "axes": [ { "key": "can_aia", "label": { "fr": "Niveau d'impact (Directive DPDA)", "en": "Impact level (DADM)" }, "scale": "ordinal", "verdicts": [ [ "level_4", { "fr": "Niveau IV", "en": "Level IV" }, "red" ], [ "level_3", { "fr": "Niveau III", "en": "Level III" }, "orange" ], [ "level_2", { "fr": "Niveau II", "en": "Level II" }, "amber" ], [ "level_1", { "fr": "Niveau I", "en": "Level I" }, "green" ] ] } ], "roles": [ [ "institution", { "fr": "Institution fédérale", "en": "Federal institution" } ], [ "enterprise", { "fr": "Entreprise", "en": "Enterprise" } ] ], "penalties": { "fr": "Loi 25 : jusqu'à 25 M CAD ou 4 % du CA mondial.", "en": "Law 25: up to CAD 25M or 4% of worldwide turnover." }, "milestones": [ [ "2019-04-01", { "fr": "Directive sur la prise de décision automatisée", "en": "Directive on Automated Decision-Making" }, "done" ], [ "2022-06-16", { "fr": "Dépôt du projet C-27 (AIDA)", "en": "Bill C-27 (AIDA) introduced" }, "done" ], [ "2023-09-22", { "fr": "Loi 25 : décisions automatisées (art. 12.1)", "en": "Law 25: automated decisions (s. 12.1)" }, "done" ], [ "2023-09-27", { "fr": "Code de conduite volontaire IA générative", "en": "Voluntary code of conduct on generative AI" }, "done" ], [ "2025-01-06", { "fr": "Prorogation : AIDA meurt au feuilleton", "en": "Prorogation: AIDA dies on the order paper" }, "done" ], [ "2027", { "fr": "Nouveau projet fédéral sur l'IA", "en": "New federal AI bill" }, "potential" ] ], "requirements": [ { "code": "CAN-01", "art": { "fr": "DADM §6.1", "en": "DADM §6.1" }, "title": { "fr": "Évaluation d'impact algorithmique (EIA) avant la production", "en": "Algorithmic Impact Assessment (AIA) before production" }, "roles": [ "institution" ], "levels": [], "themes": [ "IMPACT" ], "checks": [ "CHK-IMPACT-ASSESS" ], "newChecks": [] }, { "code": "CAN-02", "art": { "fr": "DADM §6.3", "en": "DADM §6.3" }, "title": { "fr": "Assurance qualité, tests de biais et intervention humaine selon le niveau", "en": "Quality assurance, bias testing and human intervention by level" }, "roles": [ "institution" ], "levels": [ "level_3", "level_4" ], "themes": [ "ROBUST", "FAIR", "HUMAN" ], "checks": [ "CHK-TEVV", "CHK-BIAS", "VER-008-02" ], "newChecks": [] }, { "code": "CAN-03", "art": { "fr": "Loi 25, art. 12.1", "en": "Loi 25, art. 12.1" }, "title": { "fr": "Informer d'une décision entièrement automatisée et permettre des observations à un humain", "en": "Inform of a fully automated decision and allow submissions to a human" }, "roles": [ "enterprise" ], "levels": [], "themes": [ "TRANS", "CONTEST" ], "checks": [ "VER-029-D-01", "VER-033-D-01" ], "newChecks": [] } ], "related": [ "GDPR" ], "sources": [ [ "Directive DADM", "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592" ] ], "seeded": false, "stats": { "requirements": 3, "coveredByExisting": 3, "existingChecks": 6, "reusedFromOthers": 6, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/canada/", "en": "https://atlas.trustflow.ai/en/canada/" } }, { "id": "KR", "short": "AI Basic Act", "name": { "fr": "Corée du Sud : loi-cadre sur l'IA", "en": "South Korea AI Basic Act" }, "jurisdiction": "KR", "kind": "law", "status": "in_force", "binding": true, "object": "system", "summary": { "fr": "Deuxième loi horizontale après l'UE. IA à fort impact, étiquetage de l'IA générative, représentant local pour les acteurs étrangers, sûreté des modèles à forte puissance de calcul.", "en": "Second horizontal law after the EU. High-impact AI, generative AI labelling, local representative for foreign operators, safety of high-compute models." }, "scope": { "fr": "Opérateurs développant ou utilisant de l'IA, y compris étrangers au-delà de seuils.", "en": "Operators developing or using AI, including foreign ones above thresholds." }, "territorial": { "fr": "Activités affectant le marché ou les utilisateurs coréens.", "en": "Activities affecting the Korean market or users." }, "axes": [ { "key": "kr_scope", "label": { "fr": "Catégorie", "en": "Category" }, "scale": "ordinal", "verdicts": [ [ "high_impact", { "fr": "IA à fort impact", "en": "High-impact AI" }, "orange" ], [ "generative", { "fr": "IA générative", "en": "Generative AI" }, "amber" ], [ "other", { "fr": "Autre", "en": "Other" }, "green" ] ] } ], "roles": [ [ "developer", { "fr": "Opérateur développeur", "en": "Developing operator" } ], [ "user_operator", { "fr": "Opérateur utilisateur", "en": "Using operator" } ] ], "penalties": { "fr": "Amende administrative jusqu'à 30 M KRW ; période de grâce d'au moins un an sur les amendes.", "en": "Administrative fine up to KRW 30M; grace period of at least one year on fines." }, "milestones": [ [ "2024-12-26", { "fr": "Adoption par l'Assemblée nationale", "en": "Passed by the National Assembly" }, "done" ], [ "2025-01-21", { "fr": "Promulgation", "en": "Promulgated" }, "done" ], [ "2026-01-22", { "fr": "Entrée en vigueur", "en": "Entry into force" }, "done" ], [ "2027-01", { "fr": "Fin annoncée de la période de grâce sur les amendes", "en": "Announced end of the fine grace period" }, "potential" ] ], "requirements": [ { "code": "KR-01", "art": { "fr": "Art. 31(1)", "en": "Art. 31(1)" }, "title": { "fr": "Informer à l'avance de l'usage d'une IA à fort impact ou générative", "en": "Notify in advance of high-impact or generative AI use" }, "roles": [ "developer", "user_operator" ], "levels": [ "high_impact", "generative" ], "themes": [ "TRANS" ], "checks": [ "VER-018-D-01" ], "newChecks": [] }, { "code": "KR-02", "art": { "fr": "Art. 31(2), (3)", "en": "Art. 31(2), (3)" }, "title": { "fr": "Étiqueter les contenus générés et signaler les deepfakes", "en": "Label generated content and flag deepfakes" }, "roles": [ "developer", "user_operator" ], "levels": [ "generative" ], "themes": [ "CONTENT" ], "checks": [ "VER-018-D-03" ], "newChecks": [] }, { "code": "KR-03", "art": { "fr": "Art. 33", "en": "Art. 33" }, "title": { "fr": "Auto-évaluer si le système est à fort impact", "en": "Self-assess whether the system is high-impact" }, "roles": [ "developer", "user_operator" ], "levels": [], "themes": [ "INV", "RISK" ], "checks": [ "CHK-CATEGORIZATION" ], "newChecks": [] }, { "code": "KR-04", "art": { "fr": "Art. 34", "en": "Art. 34" }, "title": { "fr": "Mesures pour l'IA à fort impact : gestion des risques, explicabilité, protection des utilisateurs, supervision, documentation", "en": "High-impact measures: risk management, explainability, user protection, oversight, documentation" }, "roles": [ "developer", "user_operator" ], "levels": [ "high_impact" ], "themes": [ "RISK", "CONTEST", "HUMAN", "DOC" ], "checks": [ "VER-003-01", "VER-033-D-02", "VER-008-02", "VER-005-01" ], "newChecks": [] }, { "code": "KR-05", "art": { "fr": "Art. 35", "en": "Art. 35" }, "title": { "fr": "Analyse d'impact sur les droits fondamentaux (obligation de moyens)", "en": "Fundamental rights impact assessment (best effort)" }, "roles": [ "user_operator" ], "levels": [ "high_impact" ], "themes": [ "IMPACT" ], "checks": [ "VER-020-D-01" ], "newChecks": [] }, { "code": "KR-06", "art": { "fr": "Art. 32", "en": "Art. 32" }, "title": { "fr": "Sûreté des modèles à forte puissance de calcul", "en": "Safety of high-compute models" }, "roles": [ "developer" ], "levels": [], "themes": [ "RISK", "INCID" ], "checks": [ "VER-032-G-02", "VER-032-G-03" ], "newChecks": [] }, { "code": "KR-07", "art": { "fr": "Art. 36", "en": "Art. 36" }, "title": { "fr": "Représentant local pour les opérateurs étrangers", "en": "Domestic representative for foreign operators" }, "roles": [ "developer", "user_operator" ], "levels": [], "themes": [ "REG" ], "checks": [ "VER-025-F-01" ], "newChecks": [] } ], "related": [ "AIACT", "JP", "CN" ], "sources": [ [ "MSIT", "https://www.msit.go.kr/eng/" ] ], "seeded": false, "stats": { "requirements": 7, "coveredByExisting": 7, "existingChecks": 11, "reusedFromOthers": 11, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/coree-du-sud-ai-basic-act/", "en": "https://atlas.trustflow.ai/en/south-korea-ai-basic-act/" } }, { "id": "JP", "short": "AI Promotion Act", "name": { "fr": "Japon : loi sur la promotion de l'IA et lignes directrices AI Business", "en": "Japan AI Promotion Act and AI Business Guidelines" }, "jurisdiction": "JP", "kind": "law", "status": "in_force", "binding": false, "object": "org", "summary": { "fr": "Loi-cadre de promotion, sans sanction. Crée le quartier général stratégique de l'IA et un plan de base. Les obligations concrètes passent par les lignes directrices METI/MIC.", "en": "Promotion framework law, no penalties. Creates the AI Strategy Headquarters and a basic plan. Concrete expectations come from the METI/MIC guidelines." }, "scope": { "fr": "Entreprises utilisant l'IA (obligation de coopération).", "en": "Businesses using AI (duty to cooperate)." }, "territorial": { "fr": "Japon.", "en": "Japan." }, "axes": [], "roles": [ [ "business", { "fr": "Entreprise", "en": "Business" } ] ], "penalties": { "fr": "Aucune ; publication possible des noms en cas d'usage abusif.", "en": "None; names may be published in case of misuse." }, "milestones": [ [ "2024-04-19", { "fr": "Lignes directrices AI Business v1.0", "en": "AI Business Guidelines v1.0" }, "done" ], [ "2025-05-28", { "fr": "Adoption de la loi", "en": "Act passed" }, "done" ], [ "2025-09-01", { "fr": "Pleine entrée en vigueur", "en": "Full entry into force" }, "done" ], [ "2025-12", { "fr": "Plan de base sur l'IA adopté", "en": "AI Basic Plan adopted" }, "done" ] ], "requirements": [ { "code": "JP-01", "art": { "fr": "Art. 7", "en": "Art. 7" }, "title": { "fr": "Coopérer aux mesures nationales et suivre les lignes directrices", "en": "Cooperate with national measures and follow the guidelines" }, "roles": [ "business" ], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-LEGAL-MAP", "CHK-POL-TRUST" ], "newChecks": [] }, { "code": "JP-02", "art": { "fr": "Lignes directrices, partie 2", "en": "Guidelines, part 2" }, "title": { "fr": "Principes communs : centré sur l'humain, sûreté, équité, vie privée, sécurité, transparence, responsabilité", "en": "Common principles: human-centric, safety, fairness, privacy, security, transparency, accountability" }, "roles": [ "business" ], "levels": [], "themes": [ "GOV", "RISK", "FAIR", "TRANS" ], "checks": [ "CHK-POL-RISK", "CHK-BIAS", "CHK-TRANSPARENCY" ], "newChecks": [] } ], "related": [ "KR", "OECD" ], "sources": [ [ "METI AI Guidelines", "https://www.meti.go.jp/english/press/2024/0419_002.html" ] ], "seeded": false, "stats": { "requirements": 2, "coveredByExisting": 2, "existingChecks": 5, "reusedFromOthers": 5, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/japon-ai-promotion-act/", "en": "https://atlas.trustflow.ai/en/japan-ai-promotion-act/" } }, { "id": "CN", "short": "China GenAI", "name": { "fr": "Chine : mesures sur l'IA générative, synthèse profonde, algorithmes et étiquetage", "en": "China: generative AI, deep synthesis, algorithm and labelling measures" }, "jurisdiction": "CN", "kind": "rule", "status": "in_force", "binding": true, "object": "system", "summary": { "fr": "Empilement de règles de la CAC : dépôt des algorithmes, évaluation de sécurité avant lancement public, légalité des données d'entraînement, étiquetage explicite et implicite des contenus.", "en": "Stack of CAC rules: algorithm filing, security assessment before public launch, lawful training data, explicit and implicit content labelling." }, "scope": { "fr": "Fournisseurs de services d'IA générative, de synthèse profonde ou de recommandation au public en Chine.", "en": "Providers of generative AI, deep synthesis or recommendation services to the public in China." }, "territorial": { "fr": "Services accessibles au public en Chine continentale.", "en": "Services available to the public in mainland China." }, "axes": [ { "key": "cn_service", "label": { "fr": "Type de service", "en": "Service type" }, "scale": "categorical", "verdicts": [ [ "genai_public", { "fr": "IA générative grand public", "en": "Public generative AI" }, "orange" ], [ "deep_synthesis", { "fr": "Synthèse profonde", "en": "Deep synthesis" }, "amber" ], [ "recommendation", { "fr": "Recommandation algorithmique", "en": "Algorithmic recommendation" }, "amber" ], [ "enterprise_only", { "fr": "Usage interne entreprise", "en": "Enterprise internal use" }, "green" ] ] } ], "roles": [ [ "service_provider", { "fr": "Fournisseur de service", "en": "Service provider" } ] ], "penalties": { "fr": "Sanctions au titre des lois cybersécurité, données et PIPL ; suspension du service.", "en": "Penalties under the cybersecurity, data and PIPL laws; service suspension." }, "milestones": [ [ "2022-03-01", { "fr": "Règles sur la recommandation algorithmique", "en": "Algorithmic recommendation provisions" }, "done" ], [ "2023-01-10", { "fr": "Règles sur la synthèse profonde", "en": "Deep synthesis provisions" }, "done" ], [ "2023-08-15", { "fr": "Mesures provisoires sur l'IA générative", "en": "Interim measures on generative AI" }, "done" ], [ "2025-09-01", { "fr": "Mesures d'étiquetage et norme GB 45438-2025", "en": "Labelling measures and GB 45438-2025 standard" }, "done" ], [ "2026-01-01", { "fr": "Loi cybersécurité amendée avec des dispositions IA", "en": "Amended Cybersecurity Law with AI provisions" }, "done" ], [ "2027", { "fr": "Loi générale sur l'IA (plan législatif du Conseil d'État)", "en": "Comprehensive AI Law (State Council legislative plan)" }, "potential" ] ], "requirements": [ { "code": "CN-01", "art": { "fr": "Recommandation Art. 24", "en": "Recommendation Art. 24" }, "title": { "fr": "Dépôt de l'algorithme auprès de la CAC", "en": "Algorithm filing with the CAC" }, "roles": [ "service_provider" ], "levels": [ "genai_public", "deep_synthesis", "recommendation" ], "themes": [ "REG" ], "checks": [], "newChecks": [ "NEW-CN-01" ] }, { "code": "CN-02", "art": { "fr": "IAG Art. 17", "en": "GenAI Art. 17" }, "title": { "fr": "Évaluation de sécurité avant lancement public", "en": "Security assessment before public launch" }, "roles": [ "service_provider" ], "levels": [ "genai_public" ], "themes": [ "RISK", "ROBUST" ], "checks": [ "VER-009-02" ], "newChecks": [ "NEW-CN-02" ] }, { "code": "CN-03", "art": { "fr": "IAG Art. 7, 8", "en": "GenAI Art. 7, 8" }, "title": { "fr": "Légalité, qualité et propriété intellectuelle des données d'entraînement", "en": "Lawfulness, quality and IP of training data" }, "roles": [ "service_provider" ], "levels": [ "genai_public" ], "themes": [ "DATA", "IP" ], "checks": [ "VER-004-01", "VER-031-G-03" ], "newChecks": [] }, { "code": "CN-04", "art": { "fr": "Étiquetage Art. 4, 5", "en": "Labelling Art. 4, 5" }, "title": { "fr": "Étiquetage explicite et implicite (métadonnées) des contenus générés", "en": "Explicit and implicit (metadata) labelling of generated content" }, "roles": [ "service_provider" ], "levels": [ "genai_public", "deep_synthesis" ], "themes": [ "CONTENT" ], "checks": [ "VER-018-D-03" ], "newChecks": [] }, { "code": "CN-05", "art": { "fr": "IAG Art. 14", "en": "GenAI Art. 14" }, "title": { "fr": "Traitement des contenus illicites et correction du modèle", "en": "Handle illegal content and correct the model" }, "roles": [ "service_provider" ], "levels": [ "genai_public" ], "themes": [ "MONIT", "INCID" ], "checks": [ "VER-021-D-03" ], "newChecks": [] }, { "code": "CN-06", "art": { "fr": "IAG Art. 10, 15", "en": "GenAI Art. 10, 15" }, "title": { "fr": "Protection des utilisateurs : mineurs, plaintes, signalement", "en": "User protection: minors, complaints, reporting" }, "roles": [ "service_provider" ], "levels": [ "genai_public" ], "themes": [ "CONTEST" ], "checks": [ "CHK-STAKEHOLDER-FEEDBACK" ], "newChecks": [] } ], "related": [ "KR", "AIACT" ], "sources": [ [ "CAC", "https://www.cac.gov.cn/" ] ], "seeded": false, "stats": { "requirements": 6, "coveredByExisting": 5, "existingChecks": 6, "reusedFromOthers": 6, "newChecks": 2 }, "url": { "fr": "https://atlas.trustflow.ai/fr/chine-ia-generative/", "en": "https://atlas.trustflow.ai/en/china-generative-ai/" } }, { "id": "UK", "short": "UK principles", "name": { "fr": "Royaume-Uni : principes pro-innovation et Data (Use and Access) Act 2025", "en": "UK pro-innovation principles and Data (Use and Access) Act 2025" }, "jurisdiction": "UK", "kind": "principles", "status": "in_force", "binding": false, "object": "system", "summary": { "fr": "Pas de loi IA horizontale : 5 principes appliqués par les régulateurs sectoriels (ICO, FCA, CMA…). Le DUAA 2025 assouplit l'encadrement des décisions automatisées tout en gardant des garanties.", "en": "No horizontal AI law: 5 principles applied by sector regulators (ICO, FCA, CMA…). The DUAA 2025 relaxes the rules on automated decisions while keeping safeguards." }, "scope": { "fr": "Toute organisation, via les régulateurs sectoriels.", "en": "Any organisation, through sector regulators." }, "territorial": { "fr": "Royaume-Uni.", "en": "United Kingdom." }, "axes": [], "roles": [ [ "organisation", { "fr": "Organisation", "en": "Organisation" } ] ], "penalties": { "fr": "Selon le régulateur sectoriel ; UK GDPR jusqu'à 17,5 M£ ou 4 %.", "en": "Depends on the sector regulator; UK GDPR up to £17.5M or 4%." }, "milestones": [ [ "2023-03-29", { "fr": "Livre blanc pro-innovation", "en": "Pro-innovation white paper" }, "done" ], [ "2024-02-06", { "fr": "Réponse du gouvernement", "en": "Government response" }, "done" ], [ "2025-01-13", { "fr": "AI Opportunities Action Plan", "en": "AI Opportunities Action Plan" }, "done" ], [ "2025-06-19", { "fr": "Data (Use and Access) Act 2025", "en": "Data (Use and Access) Act 2025" }, "done" ], [ "2027", { "fr": "Projet de loi sur l'IA de frontière", "en": "Frontier AI bill" }, "potential" ] ], "requirements": [ { "code": "UK-01", "art": { "fr": "Principe 1", "en": "Principle 1" }, "title": { "fr": "Sûreté, sécurité et robustesse", "en": "Safety, security and robustness" }, "roles": [], "levels": [], "themes": [ "ROBUST", "SEC" ], "checks": [ "VER-009-02", "VER-009-03" ], "newChecks": [] }, { "code": "UK-02", "art": { "fr": "Principe 2", "en": "Principle 2" }, "title": { "fr": "Transparence et explicabilité appropriées", "en": "Appropriate transparency and explainability" }, "roles": [], "levels": [], "themes": [ "TRANS", "CONTEST" ], "checks": [ "VER-033-D-02", "CHK-TRANSPARENCY" ], "newChecks": [] }, { "code": "UK-03", "art": { "fr": "Principe 3", "en": "Principle 3" }, "title": { "fr": "Équité", "en": "Fairness" }, "roles": [], "levels": [], "themes": [ "FAIR" ], "checks": [ "CHK-BIAS" ], "newChecks": [] }, { "code": "UK-04", "art": { "fr": "Principe 4", "en": "Principle 4" }, "title": { "fr": "Responsabilité et gouvernance", "en": "Accountability and governance" }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-ROLES-CLARIFIED" ], "newChecks": [] }, { "code": "UK-05", "art": { "fr": "Principe 5", "en": "Principle 5" }, "title": { "fr": "Contestabilité et recours", "en": "Contestability and redress" }, "roles": [], "levels": [], "themes": [ "CONTEST" ], "checks": [ "CHK-BR-CONTEST" ], "newChecks": [] }, { "code": "UK-06", "art": { "fr": "UK GDPR Art. 22A-22D", "en": "UK GDPR Art. 22A-22D" }, "title": { "fr": "Garanties sur les décisions automatisées significatives", "en": "Safeguards on significant automated decisions" }, "roles": [], "levels": [], "themes": [ "HUMAN", "CONTEST" ], "checks": [ "VER-008-02", "VER-033-D-01" ], "newChecks": [] } ], "related": [ "GDPR", "OECD" ], "sources": [ [ "UK white paper", "https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach" ] ], "seeded": false, "stats": { "requirements": 6, "coveredByExisting": 6, "existingChecks": 9, "reusedFromOthers": 9, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/royaume-uni/", "en": "https://atlas.trustflow.ai/en/uk-ai-regulation/" } }, { "id": "COE", "short": "CoE Convention", "name": { "fr": "Convention-cadre du Conseil de l'Europe sur l'IA (STCE 225)", "en": "Council of Europe Framework Convention on AI (CETS 225)" }, "jurisdiction": "COE", "kind": "convention", "status": "pending", "binding": true, "object": "system", "summary": { "fr": "Premier traité international contraignant sur l'IA, droits humains, démocratie et État de droit. Signé par l'UE, le Royaume-Uni et les États-Unis. Méthodologie HUDERIA pour l'analyse d'impact.", "en": "First binding international AI treaty: human rights, democracy and rule of law. Signed by the EU, UK and US. HUDERIA methodology for impact assessment." }, "scope": { "fr": "Autorités publiques ; secteur privé selon le choix de chaque État.", "en": "Public authorities; private sector at each state's choice." }, "territorial": { "fr": "États parties.", "en": "State parties." }, "axes": [ { "key": "coe_sector", "label": { "fr": "Secteur", "en": "Sector" }, "scale": "categorical", "verdicts": [ [ "public", { "fr": "Autorité publique", "en": "Public authority" }, "indigo" ], [ "private", { "fr": "Acteur privé", "en": "Private actor" }, "slate" ] ] } ], "roles": [ [ "public_authority", { "fr": "Autorité publique", "en": "Public authority" } ], [ "private_actor", { "fr": "Acteur privé", "en": "Private actor" } ] ], "penalties": { "fr": "Selon la transposition nationale.", "en": "Depends on national implementation." }, "milestones": [ [ "2024-05-17", { "fr": "Adoption par le Comité des ministres", "en": "Adopted by the Committee of Ministers" }, "done" ], [ "2024-09-05", { "fr": "Ouverture à la signature (Vilnius)", "en": "Opened for signature (Vilnius)" }, "done" ], [ "2024-11-28", { "fr": "Méthodologie HUDERIA adoptée", "en": "HUDERIA methodology adopted" }, "done" ], [ "2027", { "fr": "Entrée en vigueur après 5 ratifications dont 3 États membres", "en": "Entry into force after 5 ratifications incl. 3 member states" }, "potential" ] ], "requirements": [ { "code": "COE-08", "art": { "fr": "Art. 8", "en": "Art. 8" }, "title": { "fr": "Transparence et contrôle, dont identification des contenus générés", "en": "Transparency and oversight, incl. identification of generated content" }, "roles": [], "levels": [], "themes": [ "TRANS", "CONTENT" ], "checks": [ "VER-018-D-01", "VER-018-D-03" ], "newChecks": [] }, { "code": "COE-10", "art": { "fr": "Art. 10", "en": "Art. 10" }, "title": { "fr": "Égalité et non-discrimination", "en": "Equality and non-discrimination" }, "roles": [], "levels": [], "themes": [ "FAIR" ], "checks": [ "CHK-BIAS" ], "newChecks": [] }, { "code": "COE-11", "art": { "fr": "Art. 11", "en": "Art. 11" }, "title": { "fr": "Vie privée et protection des données", "en": "Privacy and data protection" }, "roles": [], "levels": [], "themes": [ "PRIV" ], "checks": [ "VER-019-D-02" ], "newChecks": [] }, { "code": "COE-14", "art": { "fr": "Art. 14, 15", "en": "Art. 14, 15" }, "title": { "fr": "Recours effectifs et garanties procédurales", "en": "Effective remedies and procedural safeguards" }, "roles": [], "levels": [], "themes": [ "CONTEST" ], "checks": [ "VER-033-D-01", "CHK-BR-CONTEST" ], "newChecks": [] }, { "code": "COE-16", "art": { "fr": "Art. 16", "en": "Art. 16" }, "title": { "fr": "Cadre de gestion des risques et des impacts (HUDERIA)", "en": "Risk and impact management framework (HUDERIA)" }, "roles": [ "public_authority" ], "levels": [], "themes": [ "IMPACT", "RISK" ], "checks": [ "VER-020-D-01", "VER-003-01" ], "newChecks": [] } ], "related": [ "AIACT", "OECD" ], "sources": [ [ "CETS 225", "https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence" ] ], "seeded": false, "stats": { "requirements": 5, "coveredByExisting": 5, "existingChecks": 8, "reusedFromOthers": 8, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/convention-conseil-europe-ia/", "en": "https://atlas.trustflow.ai/en/council-of-europe-ai-convention/" } }, { "id": "OECD", "short": "OECD AI", "name": { "fr": "Principes de l'OCDE sur l'IA (révisés 2024)", "en": "OECD AI Principles (revised 2024)" }, "jurisdiction": "INTL", "kind": "principles", "status": "voluntary", "binding": false, "object": "system", "summary": { "fr": "Socle commun adopté par 47 pays, source des définitions de l'AI Act et du NIST. 5 principes fondés sur des valeurs et 5 recommandations aux États.", "en": "Common baseline adopted by 47 countries, source of the AI Act and NIST definitions. 5 values-based principles and 5 recommendations to governments." }, "scope": { "fr": "Acteurs de l'IA.", "en": "AI actors." }, "territorial": { "fr": "Pays adhérents.", "en": "Adherent countries." }, "axes": [], "roles": [ [ "ai_actor", { "fr": "Acteur IA", "en": "AI actor" } ] ], "penalties": { "fr": "Aucune.", "en": "None." }, "milestones": [ [ "2019-05-22", { "fr": "Adoption", "en": "Adoption" }, "done" ], [ "2023-10-30", { "fr": "Code de conduite du processus d'Hiroshima (G7)", "en": "Hiroshima Process Code of Conduct (G7)" }, "done" ], [ "2024-05-03", { "fr": "Révision (définition du système d'IA)", "en": "Revision (AI system definition)" }, "done" ], [ "2025-02-07", { "fr": "Cadre de reporting du processus d'Hiroshima", "en": "Hiroshima Process reporting framework" }, "done" ] ], "requirements": [ { "code": "OECD-1.1", "art": { "fr": "1.1", "en": "1.1" }, "title": { "fr": "Croissance inclusive, développement durable, bien-être", "en": "Inclusive growth, sustainable development, well-being" }, "roles": [], "levels": [], "themes": [ "ENV" ], "checks": [ "CHK-ENV" ], "newChecks": [] }, { "code": "OECD-1.2", "art": { "fr": "1.2", "en": "1.2" }, "title": { "fr": "Droits humains, valeurs démocratiques, équité, vie privée", "en": "Human rights, democratic values, fairness, privacy" }, "roles": [], "levels": [], "themes": [ "FAIR", "PRIV" ], "checks": [ "CHK-BIAS", "VER-019-D-01" ], "newChecks": [] }, { "code": "OECD-1.3", "art": { "fr": "1.3", "en": "1.3" }, "title": { "fr": "Transparence et explicabilité", "en": "Transparency and explainability" }, "roles": [], "levels": [], "themes": [ "TRANS" ], "checks": [ "CHK-TRANSPARENCY" ], "newChecks": [] }, { "code": "OECD-1.4", "art": { "fr": "1.4", "en": "1.4" }, "title": { "fr": "Robustesse, sécurité et sûreté", "en": "Robustness, security and safety" }, "roles": [], "levels": [], "themes": [ "ROBUST", "SEC" ], "checks": [ "CHK-SAFETY", "CHK-SECURITY" ], "newChecks": [] }, { "code": "OECD-1.5", "art": { "fr": "1.5", "en": "1.5" }, "title": { "fr": "Responsabilité", "en": "Accountability" }, "roles": [], "levels": [], "themes": [ "GOV" ], "checks": [ "CHK-ROLES-CLARIFIED" ], "newChecks": [] } ], "related": [ "NISTRMF", "COE", "RAI" ], "sources": [ [ "OECD.AI", "https://oecd.ai/en/ai-principles" ] ], "seeded": false, "stats": { "requirements": 5, "coveredByExisting": 5, "existingChecks": 7, "reusedFromOthers": 7, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/principes-ocde-ia/", "en": "https://atlas.trustflow.ai/en/oecd-ai-principles/" } }, { "id": "DORA", "short": "DORA", "name": { "fr": "DORA, résilience opérationnelle numérique (UE) 2022/2554", "en": "DORA, Digital Operational Resilience Act (EU) 2022/2554" }, "jurisdiction": "EU", "kind": "regulation", "status": "in_force", "binding": true, "object": "org", "summary": { "fr": "Pour le secteur financier, un système d'IA est un actif TIC : gestion des risques TIC, incidents majeurs, tests de résilience et risque des prestataires tiers (fournisseurs de modèles et de cloud).", "en": "For the financial sector an AI system is an ICT asset: ICT risk management, major incidents, resilience testing and third-party provider risk (model and cloud vendors)." }, "scope": { "fr": "Entités financières et prestataires TIC critiques.", "en": "Financial entities and critical ICT third-party providers." }, "territorial": { "fr": "Union européenne.", "en": "European Union." }, "axes": [ { "key": "dora_cif", "label": { "fr": "Soutient une fonction critique ou importante", "en": "Supports a critical or important function" }, "scale": "ordinal", "verdicts": [ [ "in_scope", { "fr": "Fonction critique ou importante", "en": "Critical or important function" }, "orange" ], [ "out_of_scope", { "fr": "Autre fonction", "en": "Other function" }, "green" ] ] } ], "roles": [ [ "financial_entity", { "fr": "Entité financière", "en": "Financial entity" } ], [ "ict_provider", { "fr": "Prestataire TIC", "en": "ICT provider" } ] ], "penalties": { "fr": "Fixées par les États membres ; jusqu'à 1 % du CA quotidien mondial en astreinte pour les prestataires critiques.", "en": "Set by member states; up to 1% of average daily worldwide turnover as periodic penalty for critical providers." }, "milestones": [ [ "2023-01-16", { "fr": "Entrée en vigueur", "en": "Entry into force" }, "done" ], [ "2025-01-17", { "fr": "Entrée en application", "en": "Application date" }, "done" ], [ "2025-04-30", { "fr": "Premier registre d'information remis", "en": "First register of information submitted" }, "done" ], [ "2025-11-18", { "fr": "Désignation des premiers prestataires TIC critiques", "en": "First critical ICT providers designated" }, "done" ] ], "requirements": [ { "code": "DORA-05", "art": { "fr": "Art. 5, 6", "en": "Art. 5, 6" }, "title": { "fr": "Cadre de gestion du risque TIC sous la responsabilité de l'organe de direction", "en": "ICT risk framework under the management body's responsibility" }, "roles": [ "financial_entity" ], "levels": [], "themes": [ "RISK", "GOV" ], "checks": [ "CHK-POL-RISK", "CHK-EXEC-ACCOUNT" ], "newChecks": [] }, { "code": "DORA-08", "art": { "fr": "Art. 8", "en": "Art. 8" }, "title": { "fr": "Identification et inventaire des actifs et fonctions TIC", "en": "Identification and inventory of ICT assets and functions" }, "roles": [ "financial_entity" ], "levels": [], "themes": [ "INV" ], "checks": [ "CHK-INVENTORY" ], "newChecks": [] }, { "code": "DORA-17", "art": { "fr": "Art. 17-19", "en": "Art. 17-19" }, "title": { "fr": "Classification et notification des incidents majeurs (4 h / 72 h / 1 mois)", "en": "Classification and reporting of major incidents (4h / 72h / 1 month)" }, "roles": [ "financial_entity" ], "levels": [], "themes": [ "INCID" ], "checks": [ "VER-022-F-01" ], "newChecks": [ "NEW-DORA-01" ] }, { "code": "DORA-24", "art": { "fr": "Art. 24-27", "en": "Art. 24-27" }, "title": { "fr": "Tests de résilience opérationnelle, TLPT pour les entités significatives", "en": "Operational resilience testing, TLPT for significant entities" }, "roles": [ "financial_entity" ], "levels": [ "in_scope" ], "themes": [ "ROBUST", "SEC" ], "checks": [ "VER-009-F-04", "CHK-SECURITY" ], "newChecks": [] }, { "code": "DORA-28", "art": { "fr": "Art. 28-30", "en": "Art. 28-30" }, "title": { "fr": "Risque des prestataires TIC : registre d'information, clauses, stratégie de sortie", "en": "ICT third-party risk: register of information, clauses, exit strategy" }, "roles": [ "financial_entity" ], "levels": [], "themes": [ "TPR" ], "checks": [ "CHK-THIRDPARTY-POL", "CHK-THIRDPARTY-CONTINGENCY" ], "newChecks": [ "NEW-DORA-02" ] }, { "code": "DORA-11", "art": { "fr": "Art. 11", "en": "Art. 11" }, "title": { "fr": "Continuité, réponse et rétablissement", "en": "Continuity, response and recovery" }, "roles": [ "financial_entity" ], "levels": [ "in_scope" ], "themes": [ "INCID", "SEC" ], "checks": [ "VER-AUTO-01" ], "newChecks": [] } ], "related": [ "NIS2", "AIACT" ], "sources": [ [ "EUR-Lex 2022/2554", "https://eur-lex.europa.eu/eli/reg/2022/2554/oj" ] ], "seeded": false, "stats": { "requirements": 6, "coveredByExisting": 6, "existingChecks": 9, "reusedFromOthers": 9, "newChecks": 2 }, "url": { "fr": "https://atlas.trustflow.ai/fr/dora/", "en": "https://atlas.trustflow.ai/en/dora/" } }, { "id": "NIS2", "short": "NIS2", "name": { "fr": "Directive NIS2 (UE) 2022/2555", "en": "NIS2 Directive (EU) 2022/2555" }, "jurisdiction": "EU", "kind": "directive", "status": "phased", "binding": true, "object": "org", "summary": { "fr": "Mesures de cybersécurité pour les entités essentielles et importantes ; les systèmes d'IA entrent dans le périmètre des mesures de gestion des risques et de la chaîne d'approvisionnement.", "en": "Cybersecurity measures for essential and important entities; AI systems fall within the risk management and supply-chain measures." }, "scope": { "fr": "Entités essentielles et importantes de 18 secteurs.", "en": "Essential and important entities in 18 sectors." }, "territorial": { "fr": "Union européenne, via transposition nationale.", "en": "European Union, via national transposition." }, "axes": [ { "key": "nis2_entity", "label": { "fr": "Catégorie d'entité", "en": "Entity category" }, "scale": "ordinal", "verdicts": [ [ "essential", { "fr": "Entité essentielle", "en": "Essential entity" }, "orange" ], [ "important", { "fr": "Entité importante", "en": "Important entity" }, "amber" ], [ "out_of_scope", { "fr": "Hors champ", "en": "Out of scope" }, "green" ] ] } ], "roles": [ [ "entity", { "fr": "Entité", "en": "Entity" } ] ], "penalties": { "fr": "Essentielles : 10 M€ ou 2 % du CA ; importantes : 7 M€ ou 1,4 %.", "en": "Essential: €10M or 2% of turnover; important: €7M or 1.4%." }, "milestones": [ [ "2023-01-16", { "fr": "Entrée en vigueur", "en": "Entry into force" }, "done" ], [ "2024-10-17", { "fr": "Date limite de transposition", "en": "Transposition deadline" }, "done" ], [ "2026", { "fr": "Transposition française (loi résilience) : adoption définitive à vérifier", "en": "French transposition (resilience law): final adoption to verify" }, "verify" ] ], "requirements": [ { "code": "NIS2-20", "art": { "fr": "Art. 20", "en": "Art. 20" }, "title": { "fr": "Approbation et formation de l'organe de direction", "en": "Management body approval and training" }, "roles": [ "entity" ], "levels": [ "essential", "important" ], "themes": [ "GOV", "LIT" ], "checks": [ "CHK-EXEC-ACCOUNT", "CHK-TRAINING" ], "newChecks": [] }, { "code": "NIS2-21", "art": { "fr": "Art. 21", "en": "Art. 21" }, "title": { "fr": "Mesures de gestion des risques cyber, dont la chaîne d'approvisionnement", "en": "Cyber risk-management measures, incl. supply chain" }, "roles": [ "entity" ], "levels": [ "essential", "important" ], "themes": [ "SEC", "TPR" ], "checks": [ "VER-009-01", "CHK-THIRDPARTY-POL" ], "newChecks": [] }, { "code": "NIS2-23", "art": { "fr": "Art. 23", "en": "Art. 23" }, "title": { "fr": "Notification des incidents (24 h / 72 h / 1 mois)", "en": "Incident reporting (24h / 72h / 1 month)" }, "roles": [ "entity" ], "levels": [ "essential", "important" ], "themes": [ "INCID" ], "checks": [ "VER-022-F-01" ], "newChecks": [] }, { "code": "NIS2-27", "art": { "fr": "Art. 3, 27", "en": "Art. 3, 27" }, "title": { "fr": "Enregistrement auprès de l'autorité (ANSSI)", "en": "Registration with the authority (ANSSI)" }, "roles": [ "entity" ], "levels": [ "essential", "important" ], "themes": [ "REG" ], "checks": [], "newChecks": [ "NEW-NIS2-01" ] } ], "related": [ "DORA", "CRA" ], "sources": [ [ "EUR-Lex 2022/2555", "https://eur-lex.europa.eu/eli/dir/2022/2555/oj" ] ], "seeded": false, "stats": { "requirements": 4, "coveredByExisting": 3, "existingChecks": 5, "reusedFromOthers": 5, "newChecks": 1 }, "url": { "fr": "https://atlas.trustflow.ai/fr/nis2/", "en": "https://atlas.trustflow.ai/en/nis2/" } }, { "id": "CRA", "short": "CRA", "name": { "fr": "Cyber Resilience Act (UE) 2024/2847", "en": "Cyber Resilience Act (EU) 2024/2847" }, "jurisdiction": "EU", "kind": "regulation", "status": "phased", "binding": true, "object": "product", "summary": { "fr": "Exigences de cybersécurité pour les produits comportant des éléments numériques, dont les systèmes d'IA. Un système à haut risque conforme au CRA est présumé conforme à l'Art. 15 AI Act.", "en": "Cybersecurity requirements for products with digital elements, including AI systems. A high-risk system meeting the CRA is presumed compliant with AI Act Art. 15." }, "scope": { "fr": "Fabricants, importateurs, distributeurs de produits numériques.", "en": "Manufacturers, importers, distributors of digital products." }, "territorial": { "fr": "Produits mis sur le marché de l'UE.", "en": "Products placed on the EU market." }, "axes": [ { "key": "cra_class", "label": { "fr": "Classe du produit", "en": "Product class" }, "scale": "ordinal", "verdicts": [ [ "critical", { "fr": "Critique", "en": "Critical" }, "red" ], [ "important_2", { "fr": "Important classe II", "en": "Important class II" }, "orange" ], [ "important_1", { "fr": "Important classe I", "en": "Important class I" }, "amber" ], [ "default", { "fr": "Par défaut", "en": "Default" }, "green" ] ] } ], "roles": [ [ "manufacturer", { "fr": "Fabricant", "en": "Manufacturer" } ], [ "importer", { "fr": "Importateur", "en": "Importer" } ] ], "penalties": { "fr": "Jusqu'à 15 M€ ou 2,5 % du CA mondial.", "en": "Up to €15M or 2.5% of worldwide turnover." }, "milestones": [ [ "2024-12-10", { "fr": "Entrée en vigueur", "en": "Entry into force" }, "done" ], [ "2026-06-11", { "fr": "Organismes d'évaluation de la conformité", "en": "Conformity assessment bodies" }, "done" ], [ "2026-09-11", { "fr": "Obligations de signalement (vulnérabilités, incidents)", "en": "Reporting obligations (vulnerabilities, incidents)" }, "done" ], [ "2027-12-11", { "fr": "Application complète", "en": "Full application" }, "scheduled" ] ], "requirements": [ { "code": "CRA-I.1", "art": { "fr": "Annexe I partie I", "en": "Annex I part I" }, "title": { "fr": "Exigences essentielles : sécurité dès la conception, aucune vulnérabilité exploitable connue", "en": "Essential requirements: secure by design, no known exploitable vulnerabilities" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "SEC" ], "checks": [ "VER-009-03", "VER-009-F-04" ], "newChecks": [] }, { "code": "CRA-I.2", "art": { "fr": "Annexe I partie II", "en": "Annex I part II" }, "title": { "fr": "Gestion des vulnérabilités : SBOM, mises à jour sur la période de support", "en": "Vulnerability handling: SBOM, updates over the support period" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "SEC", "MONIT" ], "checks": [], "newChecks": [ "NEW-CRA-01" ] }, { "code": "CRA-14", "art": { "fr": "Art. 14", "en": "Art. 14" }, "title": { "fr": "Signaler vulnérabilités activement exploitées et incidents graves (24 h / 72 h / 14 j)", "en": "Report actively exploited vulnerabilities and severe incidents (24h / 72h / 14d)" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "INCID" ], "checks": [ "VER-022-F-01" ], "newChecks": [] }, { "code": "CRA-28", "art": { "fr": "Art. 28, 30, 32", "en": "Art. 28, 30, 32" }, "title": { "fr": "Évaluation de conformité, déclaration UE, marquage CE", "en": "Conformity assessment, EU declaration, CE marking" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "QMS" ], "checks": [ "VER-024-F-01", "VER-AUTO-03", "VER-016-F-01" ], "newChecks": [] }, { "code": "CRA-31", "art": { "fr": "Art. 31, Annexe VII", "en": "Art. 31, Annex VII" }, "title": { "fr": "Documentation technique et information des utilisateurs", "en": "Technical documentation and user information" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "DOC" ], "checks": [ "VER-005-01", "VER-007-01" ], "newChecks": [] } ], "related": [ "AIACT", "NIS2", "PLD" ], "sources": [ [ "EUR-Lex 2024/2847", "https://eur-lex.europa.eu/eli/reg/2024/2847/oj" ] ], "seeded": false, "stats": { "requirements": 5, "coveredByExisting": 4, "existingChecks": 8, "reusedFromOthers": 8, "newChecks": 1 }, "url": { "fr": "https://atlas.trustflow.ai/fr/cyber-resilience-act/", "en": "https://atlas.trustflow.ai/en/cyber-resilience-act/" } }, { "id": "PLD", "short": "PLD", "name": { "fr": "Directive responsabilité du fait des produits défectueux (UE) 2024/2853", "en": "Product Liability Directive (EU) 2024/2853" }, "jurisdiction": "EU", "kind": "directive", "status": "pending", "binding": true, "object": "product", "summary": { "fr": "Le logiciel et les systèmes d'IA deviennent des produits. Responsabilité sans faute, présomptions de défectuosité pour les systèmes complexes, obligation de divulguer les preuves. La directive responsabilité IA a été retirée.", "en": "Software and AI systems become products. Strict liability, presumptions of defect for complex systems, duty to disclose evidence. The AI Liability Directive was withdrawn." }, "scope": { "fr": "Fabricants, y compris ceux qui modifient substantiellement un produit.", "en": "Manufacturers, including those who substantially modify a product." }, "territorial": { "fr": "Produits mis sur le marché de l'UE.", "en": "Products placed on the EU market." }, "axes": [], "roles": [ [ "manufacturer", { "fr": "Fabricant", "en": "Manufacturer" } ], [ "modifier", { "fr": "Modificateur substantiel", "en": "Substantial modifier" } ] ], "penalties": { "fr": "Indemnisation civile, sans plafond.", "en": "Civil compensation, uncapped." }, "milestones": [ [ "2024-12-08", { "fr": "Entrée en vigueur", "en": "Entry into force" }, "done" ], [ "2025-02-11", { "fr": "Retrait annoncé de la directive responsabilité IA", "en": "AI Liability Directive withdrawal announced" }, "done" ], [ "2026-12-09", { "fr": "Transposition et application aux produits mis sur le marché", "en": "Transposition and application to products placed on the market" }, "scheduled" ] ], "requirements": [ { "code": "PLD-07", "art": { "fr": "Art. 7", "en": "Art. 7" }, "title": { "fr": "Défectuosité : autoapprentissage, cybersécurité, mises à jour", "en": "Defectiveness: self-learning, cybersecurity, updates" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "ROBUST", "SEC" ], "checks": [ "VER-009-02", "VER-009-03" ], "newChecks": [] }, { "code": "PLD-09", "art": { "fr": "Art. 9, 10", "en": "Art. 9, 10" }, "title": { "fr": "Divulgation des preuves et présomptions : conserver documentation et journaux", "en": "Evidence disclosure and presumptions: keep documentation and logs" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "DOC", "LOG" ], "checks": [ "VER-005-01", "VER-006-01", "VER-011-01" ], "newChecks": [] }, { "code": "PLD-08", "art": { "fr": "Art. 8(2)", "en": "Art. 8(2)" }, "title": { "fr": "Modification substantielle (réentraînement, fine-tuning) : devenir fabricant", "en": "Substantial modification (retraining, fine-tuning): becoming a manufacturer" }, "roles": [ "modifier" ], "levels": [], "themes": [ "TPR" ], "checks": [ "VER-026-D-01", "VER-026-F-01" ], "newChecks": [] }, { "code": "PLD-11", "art": { "fr": "Art. 11", "en": "Art. 11" }, "title": { "fr": "Maîtrise après mise sur le marché : mises à jour de sécurité", "en": "Post-market control: security updates" }, "roles": [ "manufacturer" ], "levels": [], "themes": [ "MONIT" ], "checks": [ "VER-021-F-01" ], "newChecks": [] } ], "related": [ "AIACT", "CRA" ], "sources": [ [ "EUR-Lex 2024/2853", "https://eur-lex.europa.eu/eli/dir/2024/2853/oj" ] ], "seeded": false, "stats": { "requirements": 4, "coveredByExisting": 4, "existingChecks": 8, "reusedFromOthers": 8, "newChecks": 0 }, "url": { "fr": "https://atlas.trustflow.ai/fr/responsabilite-produits-defectueux/", "en": "https://atlas.trustflow.ai/en/product-liability-directive/" } } ], "rai": { "key": "rai_risk", "name": { "fr": "Taxonomie TrustFlow des risques IA responsable", "en": "TrustFlow responsible AI risk taxonomy" }, "summary": { "fr": "Proposition de référentiel de catégories de risques, indépendant des juridictions. Chaque catégorie devient un groupe de sous-qualifications, chaque risque une sous-qualification notée sur l'échelle ci-dessous. Les correspondances relient chaque catégorie aux thèmes de contrôle, donc aux vérifications.", "en": "Proposed referential of risk categories, independent of jurisdictions. Each category becomes a group of sub-qualifications, each risk a sub-qualification rated on the scale below. The mappings link each category to control themes, hence to checks." }, "scale": [ [ "na", { "fr": "Non pertinent", "en": "Not relevant" }, "slate" ], [ "low", { "fr": "Faible", "en": "Low" }, "green" ], [ "moderate", { "fr": "Modéré", "en": "Moderate" }, "amber" ], [ "high", { "fr": "Élevé", "en": "High" }, "orange" ], [ "critical", { "fr": "Critique", "en": "Critical" }, "red" ] ], "rule": { "fr": "Verdict global = pire note des sous-qualifications, « Critique » bloquant. Un « Élevé » exige une mesure d'atténuation documentée.", "en": "Overall verdict = worst sub-qualification rating, « Critical » blocking. A « High » requires a documented mitigation." }, "categories": [ { "key": "fairness", "label": { "fr": "Équité & non-discrimination", "en": "Fairness & non-discrimination" }, "themes": [ "FAIR", "DATA" ], "refs": { "nist": "Fair, with harmful bias managed", "oecd": "1.2", "iso": "A.5, A.7", "aiact": "Art. 10(2)(f)" }, "risks": [ [ "data_bias", { "fr": "Biais dans les données d'entraînement", "en": "Training data bias" } ], [ "disparate_impact", { "fr": "Impact disparate sur des groupes protégés", "en": "Disparate impact on protected groups" } ], [ "proxy", { "fr": "Variables de substitution (code postal, prénom)", "en": "Proxy variables (zip code, first name)" } ], [ "representational", { "fr": "Préjudice de représentation (stéréotypes)", "en": "Representational harm (stereotypes)" } ] ] }, { "key": "transparency", "label": { "fr": "Transparence & explicabilité", "en": "Transparency & explainability" }, "themes": [ "TRANS", "CONTEST", "DOC" ], "refs": { "nist": "Accountable and transparent; Explainable and interpretable", "oecd": "1.3", "iso": "A.8", "aiact": "Art. 13, 50, 86" }, "risks": [ [ "undisclosed", { "fr": "Interaction IA non signalée", "en": "Undisclosed AI interaction" } ], [ "opacity", { "fr": "Décision inexplicable", "en": "Unexplainable decision" } ], [ "documentation_gap", { "fr": "Documentation insuffisante pour le déployeur", "en": "Insufficient documentation for the deployer" } ] ] }, { "key": "human_agency", "label": { "fr": "Supervision humaine & autonomie", "en": "Human oversight & autonomy" }, "themes": [ "HUMAN", "LIT" ], "refs": { "nist": "Govern 3.2, Map 3.5", "oecd": "1.2", "iso": "A.9", "aiact": "Art. 14, 26(2)" }, "risks": [ [ "automation_bias", { "fr": "Biais d'automatisation, confiance excessive", "en": "Automation bias, over-reliance" } ], [ "no_override", { "fr": "Absence d'arrêt ou de reprise en main", "en": "No stop or override" } ], [ "agentic_autonomy", { "fr": "Autonomie d'agent : actions sans validation", "en": "Agent autonomy: actions without approval" } ], [ "manipulation", { "fr": "Manipulation ou exploitation de vulnérabilités", "en": "Manipulation or exploitation of vulnerabilities" } ] ] }, { "key": "reliability", "label": { "fr": "Fiabilité & robustesse", "en": "Reliability & robustness" }, "themes": [ "ROBUST", "MONIT" ], "refs": { "nist": "Valid and reliable", "oecd": "1.4", "iso": "A.6.2.4", "aiact": "Art. 15" }, "risks": [ [ "hallucination", { "fr": "Hallucination, réponse fausse plausible", "en": "Hallucination, plausible wrong answer" } ], [ "drift", { "fr": "Dérive des données ou du modèle", "en": "Data or model drift" } ], [ "ood", { "fr": "Hors distribution, cas limites", "en": "Out of distribution, edge cases" } ], [ "performance_gap", { "fr": "Performance inégale selon les populations", "en": "Uneven performance across populations" } ] ] }, { "key": "security", "label": { "fr": "Sécurité", "en": "Security" }, "themes": [ "SEC" ], "refs": { "nist": "Secure and resilient", "oecd": "1.4", "iso": "A.6.2.4", "aiact": "Art. 15(5)" }, "risks": [ [ "prompt_injection", { "fr": "Injection de prompt, jailbreak", "en": "Prompt injection, jailbreak" } ], [ "poisoning", { "fr": "Empoisonnement des données", "en": "Data poisoning" } ], [ "model_theft", { "fr": "Extraction ou vol du modèle", "en": "Model extraction or theft" } ], [ "tool_abuse", { "fr": "Abus des outils d'un agent (MCP)", "en": "Agent tool abuse (MCP)" } ] ] }, { "key": "privacy", "label": { "fr": "Vie privée & données", "en": "Privacy & data" }, "themes": [ "PRIV", "DATA" ], "refs": { "nist": "Privacy-enhanced", "oecd": "1.2", "iso": "A.7", "aiact": "Art. 10(5), 26(9)" }, "risks": [ [ "pii_leak", { "fr": "Fuite de données personnelles dans les sorties", "en": "Personal data leakage in outputs" } ], [ "memorization", { "fr": "Mémorisation des données d'entraînement", "en": "Training data memorisation" } ], [ "unlawful_basis", { "fr": "Absence de base légale", "en": "No lawful basis" } ], [ "surveillance", { "fr": "Surveillance ou profilage excessif", "en": "Excessive surveillance or profiling" } ] ] }, { "key": "safety", "label": { "fr": "Sûreté & contenus préjudiciables", "en": "Safety & harmful content" }, "themes": [ "ROBUST", "PROHIB", "INCID" ], "refs": { "nist": "Safe", "oecd": "1.4", "iso": "A.5.4", "aiact": "Art. 5, 55" }, "risks": [ [ "harmful_content", { "fr": "Contenu dangereux ou illicite", "en": "Dangerous or illegal content" } ], [ "physical", { "fr": "Atteinte physique (robotique, santé)", "en": "Physical harm (robotics, health)" } ], [ "cbrn", { "fr": "Capacités dangereuses (CBRN, cyber offensif)", "en": "Dangerous capabilities (CBRN, offensive cyber)" } ], [ "prohibited_use", { "fr": "Dérive vers un usage interdit", "en": "Drift towards a prohibited use" } ] ] }, { "key": "accountability", "label": { "fr": "Responsabilité & gouvernance", "en": "Accountability & governance" }, "themes": [ "GOV", "INV", "QMS" ], "refs": { "nist": "Govern 1-2", "oecd": "1.5", "iso": "Cl. 5, A.3", "aiact": "Art. 17, 26" }, "risks": [ [ "no_owner", { "fr": "Pas de responsable identifié", "en": "No identified owner" } ], [ "shadow_ai", { "fr": "IA fantôme hors inventaire", "en": "Shadow AI outside the inventory" } ], [ "no_audit_trail", { "fr": "Pas de piste d'audit", "en": "No audit trail" } ] ] }, { "key": "ip_content", "label": { "fr": "Propriété intellectuelle & authenticité", "en": "Intellectual property & authenticity" }, "themes": [ "IP", "CONTENT" ], "refs": { "nist": "GAI 600-1: Intellectual property; Information integrity", "oecd": "1.2", "iso": "A.7.5", "aiact": "Art. 50(2), 53(1)(c)" }, "risks": [ [ "copyright", { "fr": "Contrefaçon dans les données ou les sorties", "en": "Infringement in data or outputs" } ], [ "deepfake", { "fr": "Deepfake, usurpation d'identité", "en": "Deepfake, impersonation" } ], [ "unmarked", { "fr": "Contenu généré non marqué", "en": "Unmarked generated content" } ] ] }, { "key": "societal", "label": { "fr": "Impact sociétal & environnemental", "en": "Societal & environmental impact" }, "themes": [ "ENV", "IMPACT" ], "refs": { "nist": "Measure 2.12", "oecd": "1.1", "iso": "A.5.5", "aiact": "Art. 27, considérant 27" }, "risks": [ [ "energy", { "fr": "Consommation énergétique et eau", "en": "Energy and water use" } ], [ "labour", { "fr": "Impact sur l'emploi et les conditions de travail", "en": "Impact on jobs and working conditions" } ], [ "misinformation", { "fr": "Désinformation à grande échelle", "en": "Misinformation at scale" } ] ] }, { "key": "third_party", "label": { "fr": "Tiers & dépendances", "en": "Third parties & dependencies" }, "themes": [ "TPR", "IP" ], "refs": { "nist": "Govern 6, Manage 3", "oecd": "1.5", "iso": "A.10", "aiact": "Art. 25" }, "risks": [ [ "foundation_dependency", { "fr": "Dépendance à un modèle de fondation", "en": "Dependency on a foundation model" } ], [ "vendor_lockin", { "fr": "Verrouillage fournisseur", "en": "Vendor lock-in" } ], [ "unclear_responsibility", { "fr": "Responsabilités floues dans la chaîne", "en": "Unclear responsibilities along the chain" } ] ] } ] }, "model": { "nodes": [ { "key": "jurisdiction", "label": { "fr": "Juridiction", "en": "Jurisdiction" }, "desc": { "fr": "Territoire qui émet le texte (UE, État américain, pays). Porte la région et l'autorité de contrôle.", "en": "Territory issuing the text (EU, US state, country). Carries the region and the supervisory authority." } }, { "key": "framework", "label": { "fr": "Cadre / réglementation", "en": "Framework / regulation" }, "desc": { "fr": "Texte ou norme : type, statut, caractère contraignant, sanctions, sources.", "en": "Text or standard: kind, status, bindingness, penalties, sources." } }, { "key": "milestone", "label": { "fr": "Jalon", "en": "Milestone" }, "desc": { "fr": "Date d'application, certaine ou potentielle, avec l'obligation qu'elle déclenche.", "en": "Application date, certain or potential, with the obligation it triggers." } }, { "key": "system", "label": { "fr": "Système d'IA", "en": "AI system" }, "desc": { "fr": "Objet de base de toute analyse. Un modèle, un produit ou une organisation peuvent aussi être l'objet (GPAI, CRA, ISO 42001).", "en": "Base object of every analysis. A model, product or organisation can also be the object (GPAI, CRA, ISO 42001)." } }, { "key": "axis", "label": { "fr": "Axe de qualification", "en": "Qualification axis" }, "desc": { "fr": "Palette de verdicts (ordinale ou catégorielle) : niveau de risque AI Act, rôle, statut GPAI, décision importante Colorado…", "en": "Verdict palette (ordinal or categorical): AI Act risk level, role, GPAI status, Colorado consequential decision…" } }, { "key": "criterion", "label": { "fr": "Critère", "en": "Criterion" }, "desc": { "fr": "Sous-qualification groupée par catégorie (Art. 5, Annexe III, catégorie de risque IA responsable).", "en": "Sub-qualification grouped by category (Art. 5, Annex III, responsible AI risk category)." } }, { "key": "verdict", "label": { "fr": "Verdict", "en": "Verdict" }, "desc": { "fr": "Résultat daté, proposé puis confirmé, avec provenance (agent, workflow, humain) et chaîne d'historique.", "en": "Dated result, proposed then confirmed, with provenance (agent, workflow, human) and history chain." } }, { "key": "rule", "label": { "fr": "Règle d'applicabilité", "en": "Applicability rule" }, "desc": { "fr": "Condition qui rend une exigence applicable : verdict × rôle × seuil × secteur × territoire.", "en": "Condition making a requirement applicable: verdict × role × threshold × sector × territory." } }, { "key": "requirement", "label": { "fr": "Exigence", "en": "Requirement" }, "desc": { "fr": "Obligation issue d'un article. Instanciée par système quand elle est applicable.", "en": "Obligation derived from an article. Instantiated per system when applicable." } }, { "key": "theme", "label": { "fr": "Thème de contrôle", "en": "Control theme" }, "desc": { "fr": "Famille transverse (24 thèmes) qui relie les exigences de tous les textes : le pivot du crosswalk.", "en": "Cross-cutting family (24 themes) linking requirements of every text: the crosswalk pivot." } }, { "key": "check", "label": { "fr": "Vérification", "en": "Check" }, "desc": { "fr": "Action de collecte de preuve, avec portée (organisation, système, fournisseur, modèle) et récurrence. Partagée entre référentiels.", "en": "Evidence-gathering action, with scope (organisation, system, provider, model) and recurrence. Shared across referentials." } }, { "key": "evidence", "label": { "fr": "Preuve", "en": "Evidence" }, "desc": { "fr": "Document, lien ou texte validé, avec expiration. Une preuve répond à toutes les exigences liées à la vérification.", "en": "Validated document, link or text, with expiry. One piece of evidence answers every requirement linked to the check." } }, { "key": "crosswalk", "label": { "fr": "Crosswalk", "en": "Crosswalk" }, "desc": { "fr": "Couverture des autres référentiels par les vérifications déjà actives du plan.", "en": "Coverage of the other referentials by the checks already live in the plan." } } ], "edges": [ [ "jurisdiction", "framework", { "fr": "émet", "en": "issues" } ], [ "framework", "milestone", { "fr": "date", "en": "dates" } ], [ "framework", "axis", { "fr": "définit", "en": "defines" } ], [ "system", "verdict", { "fr": "reçoit", "en": "receives" } ], [ "axis", "criterion", { "fr": "se décompose en", "en": "breaks into" } ], [ "criterion", "verdict", { "fr": "noté dans", "en": "rated in" } ], [ "verdict", "rule", { "fr": "déclenche", "en": "triggers" } ], [ "framework", "requirement", { "fr": "contient", "en": "contains" } ], [ "rule", "requirement", { "fr": "active", "en": "activates" } ], [ "requirement", "theme", { "fr": "classée dans", "en": "filed under" } ], [ "requirement", "check", { "fr": "vérifiée par", "en": "verified by" } ], [ "check", "evidence", { "fr": "prouvée par", "en": "proven by" } ], [ "check", "crosswalk", { "fr": "partagée via", "en": "shared via" } ], [ "milestone", "requirement", { "fr": "rend exigible", "en": "makes due" } ] ] } }