Who in my organisation owns ATRS records?

Answered

In-scope organisations should have a single point of contact (SPOC) who coordinates with the ATRS team on identifying tools, drafting and publishing records. Name an SRO as the primary risk owner. On the ATRS record, the SRO should be a role title, not a named person.

From the guidance

Primary (how) ATRS: Guidance for public sector bodies

If your organisation is within the mandatory scope of the ATRS policy, it should have a single point of contact (SPOC) whose role is to coordinate with the ATRS team on identifying in-scope algorithmic tools, drafting and publishing records.

Section: How do I know if I should complete an ATRS record?

Read this in ATRS: Guidance for public sector bodies (opens in new tab)

Secondary (normative) Data and AI Ethics Framework

You need strong oversight and clear responsibilities to ensure accountability across the life cycle of your data or AI project. You must set out who is responsible at each stage of the project. This includes naming senior responsible owners (SROs)– as the primary risk owners for the project.

Section: Set clear roles and responsibilities

Read this in Data and AI Ethics Framework (opens in new tab)

Secondary (normative) ATRS: Guidance for public sector bodies

The SRO should be a role title, not a named individual, for business continuity and security purposes. It should be the role which is ultimately accountable for the tool in an operational context.

Section: Owner and responsibility (Tier 2)

Read this in ATRS: Guidance for public sector bodies (opens in new tab)

Related questions