Do AI projects still need to meet the government Service Standard?

Answered

Yes. AI services must meet the same standards as other technology. Service Standard point 9 requires Secure by Design principles. Central government departments and ALBs must meet the Secure by Design policy when delivering digital services and technical infrastructure. Follow Secure by Design / Service Manual security expectations — including consulting security professionals for AI.

From the guidance

Primary (how) Service Manual: Using artificial intelligence (AI) in services

Services using AI need to meet the same standards as services using other technology.

Section: Using artificial intelligence (AI) in services

Read this in Service Manual: Using artificial intelligence (AI) in services (opens in new tab)

Secondary (normative) Technology Code of Practice

If you’re building a service as part of your technology project or programme you will also need to meet the Service Standard

Section: 13. Meet the Service Standard

Read this in Technology Code of Practice (opens in new tab)

Secondary (normative) AI Playbook for the UK Government

If you develop a service, you must use the government Service Standard.

Section: Principle 5: You understand how to manage the full AI life cycle

Read this in AI Playbook for the UK Government (opens in new tab)

Secondary (normative) Service Manual: Using artificial intelligence (AI) in services

You must consult a security professional to make sure that: users’ data is protected; your service stays secure.

Section: Involve cyber security professionals

Read this in Service Manual: Using artificial intelligence (AI) in services (opens in new tab)

Secondary (normative) About Secure by Design

The Service Standard Point 9(Create a secure service which protects users’ privacy) advises service teams that they must follow the Secure by Design principles.

Section: Secure by Design’s wider context

Read this in About Secure by Design (opens in new tab)

Secondary (normative) Implementing Secure by Design

All central government departments and arm's length bodies (ALBs) must incorporate effective security practices and meet the Secure by Design policy when delivering and building digital services and technical infrastructure.

Section: Implementing Secure by Design

Read this in Implementing Secure by Design (opens in new tab)

Related questions

• Which organisations must use the Algorithmic Transparency Recording Standard? Lawful, ethical and responsible use
• Who should own cyber security risk for an AI service under Secure by Design?
• Do I need to tell users when a service uses AI?
• How should I secure the AI supply chain (models and components)?
• How do teams evidence Secure by Design?