The Safeguard Catalogue contains 42 Safeguards arranged in seven Groups of six. Each carries a code from SG1-01 through to SG7-06. Selection is not a matter of judgement about which feel sensible, it follows from the Consequence Rating the Activity was given.
The seven Safeguard Groups
Group names describe what the Safeguards inside them protect against, so an organisation can usually tell from the profile which Groups will be engaged before it opens the catalogue.
Foundation
Universal, applying to every Activity
The six that apply to everything on the register regardless of rating. Registration, named accountability, a completed profile, a recorded safeguard selection, competence and a current status. An Activity missing any of these is not governed at all.
Transparency and Disclosure
Making the use of AI findable
Telling people that AI contributes to something affecting them, recording what was disclosed and to whom, then keeping that disclosure current when the Activity changes.
Data Integrity
Controlling what goes in and where it goes
What data may be entered, what must never be, how the provider handles retention and deletion, plus how that position is evidenced.
Human Oversight
Keeping a competent person in the decision
Review before an output is acted on, the authority to overrule, a route to challenge an outcome and the competence to exercise all three meaningfully.
Accuracy and Reliability
Checking that output is fit to use
Verification before reliance, testing against known cases, monitoring for drift and a defined position on what accuracy is good enough for this Activity.
Fairness and Non-Discrimination
Watching for adverse impact
Bias assessment before deployment, monitoring outcomes across protected characteristics after it, plus a mitigation position where a disparity appears.
Continuity and Dependency
Planning for the provider failing you
What happens if the tool is withdrawn, degraded, repriced or taken offline, plus how the work continues while that is resolved.
How many Safeguards each rating attracts
| Rating | Typical count | Which Groups are engaged |
|---|---|---|
| 1 Negligible | 6 | SG1 only |
| 2 Moderate | 12 to 18 | SG1 plus the Groups the profile points to |
| 3 Significant | 20 to 28 | SG1 plus enhanced selections across multiple Groups |
| 4 Critical | 32 to 42 | The full applicable suite across all seven Groups |
Recording the selection
Choosing Safeguards is only half the requirement. The Safeguard Selection Record captures which Safeguards were applied to which Activity, when and by whom, so the organisation can later show that the protection matched the assessment rather than being decided after something went wrong.
That record is one of the ten minimum contents of the Governance Evidence Pack and is kept for three years, running from creation or from retirement of the Activity, whichever produces the longer period.
Continue reading
Material changes since the previous version See how AIGMS™ is structured
Put this into practice
The AIGMS™ packages provide the documents, registers, workbooks and training needed to implement the governance management system.