Home / Requirement record / A.8
A.8
Privacy
AI-related objective: Personal data used by or inferable from the AI system is protected across collection, training, operation and query, and the system does not expose more about individuals than intended. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4). Read privacy against the objective the use threatens most.
- What it asks
- AI-related objective: Personal data used by or inferable from the AI system is protected across collection, training, operation and query, and the system does not expose more about individuals than intended. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4).
- Where generative AI changes the answer
- Privacy is where a prompt becomes a disclosure, because the person in the data never chose to be in the conversation.
- Reading it in practice
- Privacy for generative AI is where a prompt becomes a disclosure. The evidence is a data flow that shows what personal data enters the prompt, what the supplier retains and where inference runs, plus the rule that stops staff pasting data they should not. The person in the data never chose the conversation, so consent is rarely the answer.
- Who it binds
- The AI risk owner, with the objective owner named in the risk treatment plan. For A.8 the named role is the owner of privacy assessment across the AI data life cycle.
- Evidence an auditor normally samples
- Privacy assessment across the AI data life cycle
- The test you can run
- Take privacy assessment across the AI data life cycle and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.
- Common failures
- Privacy assessed at collection only
- Before the draft publishes
- For A.8, pick the two objectives the use most affects, write the test you would apply, and record the result before the draft is published. The first artefact to produce is privacy assessment across the AI data life cycle.
- Where this sits against the draft
- A.8 carries the annex a: ai-related objectives part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on A.8 (privacy) with this record and note the change in the register.