Delivery, assurance and operations
- Do AI projects still need to meet the government Service Standard?
- Do I need to tell users when a service uses AI? Contrasting
- How should I do user research for an AI product?
- How do I monitor an AI system once it is live?
- Do staff need AI-specific cyber security training? Contrasting
- How should I secure the AI supply chain (models and components)?
- What AI assets should I document and inventory?
- How should I decommission AI models and training data?
- What happens if the model drifts or starts performing worse over time?
- How do I keep an inventory of AI systems in my organisation?
- Who is accountable if an AI system causes harm or makes a bad decision?
- How do people challenge or seek redress for an AI-influenced decision?
- Which AI assurance techniques should my organisation use?
- How do I keep AI assurance proportionate to risk?
- What governance should underpin AI assurance?
- When should we use third-party conformity assessment for AI?
- Should we red-team AI before release?
- Should we document AI models with model cards or SBOMs?
- Should we monitor AI system inputs as well as outputs?
- How do teams evidence Secure by Design?
- Who should own cyber security risk for an AI service under Secure by Design?
- What is continuous assurance under Secure by Design?
- Do equality and data-protection checks stop once an AI contract is signed?
- What does the Service Standard say about choosing AI technology?
- How does the Service Standard affect whether I should use AI?