It covers governance, risk assessment and human oversight, system implementation and management, and communication with stakeholders. In day-to-day terms that means four documents.
- An inventory of AI systems in use, with owners.
- A risk and impact assessment for each system.
- An acceptable use policy covering staff and vendors.
- A record of human oversight decisions.
What this means for you
You do not need a framework project. You need four documents and a named owner. That is the difference between answering a questionnaire in an afternoon and answering it in a month.
The four documents
An AI use inventory, a risk and impact assessment per system, an acceptable use policy for staff, and a record of the oversight decisions taken.
If a complaint reaches the PCPD, the first question is usually whether you followed your own policy. If you cannot produce the policy or the record, this voluntary guidance has effectively become the test you failed.
Sources
PCPD, Artificial Intelligence: Model Personal Data Protection Framework, 11 June 2024 — pcpd.org.hk