Machine learning

AI-related risk source: Learning from data brings risks of its own: data quality and bias, overfitting, concept drift, behaviour that changes with retraining, and outputs that cannot be fully specified in advance. The artefact behind the answer is ML-specific risk register covering data, training, drift and retraining. Use machine learning as a prompt in the identification step, not as a finding.

What it asks

AI-related risk source: Learning from data brings risks of its own: data quality and bias, overfitting, concept drift, behaviour that changes with retraining, and outputs that cannot be fully specified in advance.

Where generative AI changes the answer

Machine learning brings the risk that the system generalises in a way no one specified, including to inputs the test set never contained.

Reading it in practice

Machine learning brings the risk that the system generalises in a way nobody specified, including to inputs the test set never contained. The evidence is a test record that includes out-of-distribution inputs and the observed behaviour, plus the monitoring that would catch a change in the input distribution after deployment.

Who it binds

The assessment team that runs identification, and the business owner who knows the use. For B.5 the named role is the owner of ML-specific risk register covering data, training, drift and retraining.

Evidence an auditor normally samples

• ML-specific risk register covering data, training, drift and retraining

The test you can run

Take ML-specific risk register covering data, training, drift and retraining and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• ML treated as ordinary software in the risk register

Before the draft publishes

For B.5, add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present. The first artefact to produce is ML-specific risk register covering data, training, drift and retraining.

Where this sits against the draft

B.5 carries the annex b: ai-related risk sources part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on B.5 (machine learning) with this record and note the change in the register.