System hardware issues

AI-related risk source: Faults, limits and tampering in the hardware running or feeding the AI system, including sensors and accelerators, can corrupt data and computation and so its behaviour. The artefact behind the answer is hardware fault and dependency analysis for AI platforms. Use system hardware issues as a prompt in the identification step, not as a finding.

What it asks

AI-related risk source: Faults, limits and tampering in the hardware running or feeding the AI system, including sensors and accelerators, can corrupt data and computation and so its behaviour.

Where generative AI changes the answer

Hardware and capacity issues surface as degraded or truncated outputs, which users read as a wrong answer rather than a system fault.

Reading it in practice

Hardware and capacity problems surface to users as a wrong or truncated answer rather than as a system fault. The evidence is the service level, the fallback behaviour when the model is unavailable and the log that shows the system degraded rather than invented. Users should be told when the quality has dropped.

Who it binds

The assessment team that runs identification, and the business owner who knows the use. For B.6 the named role is the owner of hardware fault and dependency analysis for AI platforms.

Evidence an auditor normally samples

• Hardware fault and dependency analysis for AI platforms

The test you can run

Take hardware fault and dependency analysis for AI platforms and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Hardware assumed reliable and secure

Before the draft publishes

For B.6, add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present. The first artefact to produce is hardware fault and dependency analysis for AI platforms.

Where this sits against the draft

B.6 carries the annex b: ai-related risk sources part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on B.6 (system hardware issues) with this record and note the change in the register.