AIリスク対応

Clause 6.1.3

Taking the AI risk assessment results into account, the organization shall define an AI risk treatment process to: a) select appropriate AI risk treatment options; b) determine all controls that are necessary to implement the AI risk treatment options chosen and compare the controls with those in Annex A to verify that no necessary controls have been omitted; c) consider the controls from Annex A that are relevant for the implementation of the AI risk treatment options; d) identify if additional controls are necessary beyond those in Annex A in order to implement all risk treatment options; e) consider the guidance in Annex B for the implementation of controls determined in b) and c); f) produce a statement of applicability that contains the necessary controls [see b), c) and d)] and provide justification for inclusion and exclusion of controls. Justification for exclusion can include where the controls are not deemed necessary by the risk assessment and where they are not required by (or are subject to exceptions under) applicable external requirements; g) formulate an AI risk treatment plan.

Clause 6.1.3

The organization shall obtain approval from the designated management for the AI risk treatment plan and for acceptance of the residual AI risks. The necessary controls shall be: aligned to the objectives in 6.2; available as documented information; communicated within the organization; available to interested parties, as appropriate. The organization shall retain documented information about the AI risk treatment process.