# Seclea User Documentation Seclea is a state-of-the art platform ensuring organisations build and deploy fair, transparent, explainable and accountable AI applications. We want to help data science and wider AI stakeholders to work more efficiently to build AI applications that are regulatory compliant and explainable. We achieve this by providing a simple yet powerful platform for them to collaborate and monitor AI applications. Our mission is to make AI applications trustworthy and work for the benefit of all in our modern society. On the Seclea Platform, all AI stakeholders can monitor and track the following: 1. [AI Fairness](broken://pages/QzppGzKcVcLCqbY0Zf1Y), 2. [AI Transparency and Accountability](broken://pages/UKMBfYxfPTrwGyOmMRY5), 3. [Explanation of AI Evolution and Decisions](broken://pages/GjtgUksYH7VE9MbqJlhj), 4. [Regulatory Compliance of AI Systems](/seclea-user-documentation/seclea-web-ui/ai-regulatory-compliance), 5. [Risk Management of AI Systems](/seclea-user-documentation/seclea-web-ui/ai-risk-management).
Building Trust in AIOverview of the Seclea Platform.Seclea - Building trust in AI
Getting StartedGuide to help you start using the Seclea Platform.Getting Started
Seclea Platform ServicesDetails of services offered by the Seclea Platform.Seclea - Features and services
AI RegulationsList of AI regulations supported by the Seclea PlatformAI regulatory compliance
AI Risk ManagementList of AI Risk Management frameworks supported by the Seclea PlatformAI risk management
Seclea TutorialsTutorials on how to build AI applications using the Seclea Platform.First Project - Example
# Seclea - Building trust in AI Seclea is a research-backed toolkit available as a SaaS platform by data scientists and AI stakeholders to make AI applications that are fair, explainable, transparent, and accountable. All AI stakeholders can also use the Seclea Platform to check on AI risk and regulatory compliance in real-time. Making sure that all AI stakeholders inside and outside the company accept and trust the AI application. {% embed url="" %} Seclea Brief Introduction Video {% endembed %} Seclea provides a semi-automated toolkit for fostering AI fairness, explanation, transparency, accountability, and risk management across the whole AI lifecycle, with the goal of ensuring that AI applications comply with applicable laws and regulations. In order to report to AI stakeholders on concerns of AI fairness, explanation, and transparency, data scientists must now collect a multiplicity of tools from a variety of providers, integrate them, and make sense of them collectively. In addition, they need to record everything they and the machine do to guarantee openness, responsibility, and ownership; control risks; and check for compliance with rules and policies. These are labour-intensive activities that eat into Data Scientists' productive time. This means that many data scientists cannot focus exclusively on their primary duty, which is to create AI models to solve business problems. Data scientists can easily integrate their AI application with Seclea by selecting the regulations and risk management templates for their AI project and then typing a few lines of code. Seclea can monitor an application in development or update to ensure it follows principles of fairness, transparency, explainability, and accountability. Seclea is an AI reporting and compliance platform that provides a centralised hub for managing AI fairness, transparency, explainability, accountability, regulatory compliance and risk. To know more, please visit Seclea's website: {% embed url="" %} # Seclea - Features and services Seclea is an AI assurance platform that enables organisations to develop and deploy AI algorithms with confidence. The platform provides features such as AI fairness, transparency, explainability, accountability, risk management and regulatory compliance. Through Seclea, organisations can ensure that their AI projects adhere to various regulatory frameworks and industry standards across different jurisdictions. The platform supports a range of compliance requirements, including the European Union's Artificial Intelligence Act (EU AIA), Canada's Artificial Intelligence and Data Act (AIDA), and the US Food and Drug Administration's (FDA) guidelines for AI-based Software as a Medical Device (SaMD). With Seclea, users can confidently develop and deploy AI solutions in line with global best practices and maintain a strong commitment to responsible AI development. The main features and services provided by the Seclea Platform include: ## AI Fairness: Seclea’s platform offers AI fairness services to ensure that the AI models implemented by organisations don’t discriminate against any particular group. By analysing the training data set, the platform can identify and mitigate biases that might lead to unfair AI models. For example, in hiring, the AI model can be trained on a diverse dataset to avoid biases in the hiring process. ## AI Transparency: Seclea platform’s AI transparency service aims to make AI models more transparent and understandable to stakeholders. By providing detailed documentation and visual aids for the models, the platform can help organisations ensure that their models are making decisions in a transparent and understandable manner. For example, in the healthcare industry, a transparency service could help doctors better understand the reasoning behind the decisions made by AI models. ## AI Explainability: Seclea’s AI explainability service aims to provide an explanation for the decisions made by AI models. By offering a clear understanding of how the models arrived at their decisions, stakeholders can better trust and understand the AI models. For example, in financial services, explainability services could help financial advisors better understand how AI models are making investment decisions. ## AI Accountability: Seclea’s AI accountability service aims to provide organisations with a clear audit trail of the AI models they are using. By tracking every step of the AI model’s development and deployment, the platform ensures accountability for the decisions made by the models. For example, in the legal industry, AI accountability services could help ensure that AI models are being used ethically and responsibly. ## AI Risk Management: Seclea’s AI risk management service aims to identify and mitigate potential risks associated with AI models. By analysing the potential risks associated with the AI model, the platform can help organizations ensure that their models are being used in a responsible and safe manner. For example, in the healthcare industry, risk management services could help doctors identify potential risks associated with AI models being used to diagnose patients. ## AI Regulatory Compliance: Seclea’s platform offers AI regulatory compliance services to ensure that organisations comply with the regulations related to AI models. By analyzing the relevant regulations and guidelines, the platform can help organisations ensure that their models meet the necessary standards. For example, in the financial industry, regulatory compliance services could help ensure that AI models comply with regulations related to data privacy and security. # Seclea integrations and supported frameworks Seclea platform provides integration with several machine learning frameworks and libraries, including TensorFlow, PyTorch, and Scikit-Learn. It also supports a wide range of deployment options, including cloud, on-premises, and hybrid deployments. Seclea is a comprehensive AI assurance platform that supports a wide range of machine learning and deep learning algorithms. It provides tools for AI fairness, transparency, explainability, accountability, and risk management. Additionally, Seclea supports AI number explainability tools to ensure that organisations can explain how an AI algorithm arrived at a specific output. The platform also has built-in support for various AI regulatory frameworks such as the European Union's Artificial Intelligence Act, Canada's Artificial Intelligence and Data Act, and the US Food and Drug Administration's guidelines for AI-based Software as a Medical Device, among others. With these integrations and supported frameworks, Seclea offers a comprehensive AI platform for responsible and compliant AI development and deployment. Overall, Seclea empowers organizations to develop and deploy AI applications with confidence and assurance that they are compliant with global regulatory frameworks and ethical guidelines. # Create a Seclea account Creating an account on Seclea is simple and you can have a free trial of the Seclea Platform for one week. To get an access to the Seclea Platform, please click: {% embed url="" %} Seclea account creation Form {% endembed %} Once you fill the form and submit, you will recieve an email to setup a Seclea onboarding call. We will help you get started with Seclea and demo you the main features of the platform. After you have received the account details, you can now integrate your AI application development with Seclea Platform and also access Seclea UI. The next step is explore the Seclea Platform through a small project, giving you an hands on example. # First Project - Example Please use the following Google Colaboratory project for a complete example you can work through showing how you can integrate the Seclea Platform into your data science workflow. Please copy the Google Colaboratory project into your account and run it from there. {% embed url="" %} Following is a step-by-step guide, followed by the Google Colaboratory project. We will run through a sample project showing how to use Seclea's tools to record your data science work and explore the results in the Seclea Platform. ### Set up the Project You can head to [platform.seclea.com](https://platform.seclea.com/) and log in. Please create a new project by clicking the "+ Create" button and giving it a name and description.

Creating a New Project on the Seclea Platform

After you have created your project, it will appear in the All Projects section, as shown below:

All Projects Section After Project Creation

Click the project name in the All Projects section to go to the project setting page on the Seclea Platform.

Project Dashboard on the Seclea Platform

Click the settings option in the left panel will take you to the respective project's settings.

Individual Project Setting Page on the Seclea Platform

In the project setting, you can select, modify or set new templates for compliance, risk management and any internal standard/policy you must comply with. Details on how to use [compliance](/seclea-user-documentation/seclea-web-ui/ai-regulatory-compliance), [risk management](/seclea-user-documentation/seclea-web-ui/ai-risk-management), and internal settings are detailed in their respective sections. If you want to include additional team members in the project, you can include them using the Access section of the setting. These are optional settings; you can set/modify them later in the project. ### Integrating with Seclea-AI You can get the seclea-ai package from pip ```python !pip install seclea_ai ``` When you initialise the SecleaAI object, you will be prompted to log in if you haven't already done so. You must use the same Project Name you used earlier and the Organization name provided with your credentials. ```python from seclea_ai import SecleaAI # NOTE - use the organization name provided to you when issuing credentials. seclea = SecleaAI(project_name="Car Insurance Fraud Detection", organization='') ``` ### Handling the Data You can download the [data](https://raw.githubusercontent.com/seclea/seclea_ai/dev/docs/examples/insurance_claims.csv) for this tutorial if you are working on this in Colab or without reference to the repo - this is an Insurance Claims dataset with various features and 1000 samples. Now we can upload the initial data to the Seclea Platform. This should include whatever information we know about the dataset as metadata. There are only two keys to add in metadata for now - outputs and continuous\_features. You can leave out outputs if you haven't decided what you will be predicted yet, but you should know or be able to find the continuous features at this point. You can also update these when uploading datasets during/after pre-processing. ```python import numpy as np import pandas as pd # load the data data = pd.read_csv('insurance_claims.csv', index_col="policy_number") # define the metadata for the dataset. dataset_metadata = {"outputs": ["fraud_reported"], "favourable_outcome": "N", "unfavourable_outcome": "Y", "continuous_features": [ "total_claim_amount", 'policy_annual_premium', 'capital-gains', 'capital-loss', 'injury_claim', 'property_claim', 'vehicle_claim', 'incident_hour_of_the_day', ]} # ⬆️ upload the dataset - pick a meaningful name here; you'll see it a lot on the platform! seclea.upload_dataset(dataset=data, dataset_name="Auto Insurance Fraud", metadata=dataset_metadata) ``` #### Evaluating the Dataset After running the above section, head back to the Seclea Platform so that we can take a closer look at our Dataset. To do so, you can navigate to the datasets section - under Prepare tab. {% embed url="" %} Youtube video showing how to access the dataset evaluation page on the Seclea Platform. {% endembed %} **Personal Identifiable Information (PII) and Format Check** {% embed url="" %} Youtube video showing how to access the dataset PII and format check functionality on the Seclea Platform. {% endembed %} **Data Bias Check** {% embed url="" %} Dataset bias evaluation functionality on the Seclea Platform. {% endembed %} ### Transformations When using Seclea to record your Data Science work, you will have to take care with how you deal with transformations of the data. We require that all transformations are encapsulated in a function that takes the data and returns the transformed data. There are a few things to be aware of, so please see the [docs](https://docs.seclea.com/) for more. ```python # Create a copy to isolate the original dataset df1 = data.copy(deep=True) def encode_nans(df): # convert the special characters to nans return df.replace('?', np.NaN) df2 = encode_nans(df1) ``` ### Data Cleaning We will carry out some pre-processing and generate a few different datasets to see how to track these on the platform. This also means we can train our models on different data and see how that affects performance. ```python ## Drop the the column which are more than some proportion NaN values def drop_nulls(df, threshold): cols = [x for x in df.columns if df[x].isnull().sum() / df.shape[0] > threshold] return df.drop(columns=cols) # We choose 95% as our threshold null_thresh = 0.95 df3 = drop_nulls(df2, threshold=null_thresh) def drop_correlated(data, thresh): import numpy as np # calculate correlations corr_matrix = data.corr().abs() # get the upper part of correlation matrix upper = corr_matrix.where(np.triu(np.ones(corr_matrix.shape), k=1).astype(np.bool)) # columns with correlation above threshold redundant = [column for column in upper.columns if any(upper[column] >= thresh)] print(f"Columns to drop with correlation > {thresh}: {redundant}") new_data = data.drop(columns=redundant) return new_data # drop columns that are too closely correlated correlation_threshold = 0.95 df4 = drop_correlated(df3, correlation_threshold) ``` ### Upload Intermediate Dataset Before balancing the datasets we will upload them to the Seclea Platform. * We define the metadata for the dataset - if there have been any changes since the original dataset we need to put that here, otherwise, we can reuse the original metadata. In this case, we have dropped some of the continuous feature columns so we will need to redefine * We define the transformations that took place between the last state we uploaded and this dataset. This is a list of functions and arguments. Please have a look at docs.seclea.com for more details on the correct formatting. ```python from seclea_ai.transformations import DatasetTransformation # define the updates to the metadata - only changes are updated - here a continuous feature has been dropped so now # we remove it from the list of continuous features. processed_metadata = {"continuous_features": [ "total_claim_amount", 'policy_annual_premium', 'capital-gains', 'capital-loss', 'injury_claim', 'property_claim', 'incident_hour_of_the_day', ]} # 🔀 define the transformations - note the arguments cleaning_transformations = [ DatasetTransformation(encode_nans, data_kwargs={"df": df1}, kwargs={}, outputs=["df"]), DatasetTransformation( drop_nulls, data_kwargs={"df": "inherit"}, kwargs={"threshold": null_thresh}, outputs=["data"] ), DatasetTransformation( drop_correlated, data_kwargs={"data": "inherit"}, kwargs={"thresh": correlation_threshold}, outputs=["df"] ), ] # ⬆️ upload the cleaned datasets seclea.upload_dataset(dataset=df4, dataset_name="Auto Insurance Fraud - Cleaned", metadata=processed_metadata, transformations=cleaning_transformations) ``` ```python def fill_nan_const(df, val): """Fill NaN values in the dataframe with a constant value""" return df.replace(['None', np.nan], val) # Fill nans in 1st dataset with -1 const_val = -1 df_const = fill_nan_const(df4, const_val) def fill_nan_mode(df, columns): """ Fills nans in specified columns with the mode of that column Note that we want to make sure to not modify the dataset we passed in but to return a new copy. We do that by making a copy and specifying deep=True. """ new_df = df.copy(deep=True) for col in df.columns: if col in columns: new_df[col] = df[col].fillna(df[col].mode()[0]) return new_df nan_cols = ['collision_type','property_damage', 'police_report_available'] df_mode = fill_nan_mode(df4, nan_cols) # find columns with categorical data for both dataset cat_cols = df_const.select_dtypes(include=['object']).columns.tolist() def encode_categorical(df, cat_cols): from sklearn.preprocessing import LabelEncoder new_df = df.copy(deep=True) for col in cat_cols: if col in df.columns: le = LabelEncoder() le.fit(list(df[col].astype(str).values)) new_df[col] = le.transform(list(df[col].astype(str).values)) return new_df df_const = encode_categorical(df_const, cat_cols) df_mode = encode_categorical(df_mode, cat_cols) # Update metadata with new encoded values for the outcome column. encoded_metadata = {"favourable_outcome": 0, "unfavourable_outcome": 1,} # 🔀 define the transformations - for the constant fill dataset const_processed_transformations = [ DatasetTransformation(fill_nan_const, data_kwargs={"df": df4}, kwargs={"val": const_val}, outputs=["df"]), DatasetTransformation(encode_categorical, data_kwargs={"df": "inherit"}, kwargs={"cat_cols":cat_cols}, outputs=["df"]), ] # ⬆️ upload the constant fill dataset seclea.upload_dataset(dataset=df_const, dataset_name="Auto Insurance Fraud - Const Fill", metadata=encoded_metadata, transformations=const_processed_transformations) # 🔀 define the transformations - for the mode fill dataset mode_processed_transformations = [ DatasetTransformation(fill_nan_mode, data_kwargs={"df": df4}, kwargs={"columns": nan_cols}, outputs=["df"]), DatasetTransformation(encode_categorical, data_kwargs={"df": "inherit"}, kwargs={"cat_cols": cat_cols}, outputs=["df"]), ] # ⬆️ upload the mode fill dataset seclea.upload_dataset(dataset=df_mode, dataset_name="Auto Insurance Fraud - Mode Fill", metadata=encoded_metadata, transformations=mode_processed_transformations) def get_samples_labels(df, output_col): X = df.drop(output_col, axis=1) y = df[output_col] return X, y # split the datasets into samples and labels ready for modelling. X_const, y_const = get_samples_labels(df_const, "fraud_reported") X_mode, y_mode = get_samples_labels(df_mode, "fraud_reported") def get_test_train_splits(X, y, test_size, random_state): from sklearn.model_selection import train_test_split return train_test_split( X, y, test_size=test_size, stratify=y, random_state=random_state ) # returns X_train, X_test, y_train, y_test # split into test and train sets X_train_const, X_test_const, y_train_const, y_test_const = get_test_train_splits(X_const, y_const, test_size=0.2, random_state=42) X_train_mode, X_test_mode, y_train_mode, y_test_mode = get_test_train_splits(X_mode, y_mode, test_size=0.2, random_state=42) # 🔀 define the transformations - for the constant fill training set const_train_transformations = [ DatasetTransformation( get_test_train_splits, data_kwargs={"X": X_const, "y": y_const}, kwargs={"test_size": 0.2, "random_state": 42}, outputs=["X_train_const", None, "y_train_const", None], split="train", ), ] # ⬆️ upload the const fill training set seclea.upload_dataset_split( X=X_train_const, y=y_train_const, dataset_name="Auto Insurance Fraud - Const Fill - Train", metadata={}, transformations=const_train_transformations ) # 🔀 define the transformations - for the constant fill test set const_test_transformations = [ DatasetTransformation( get_test_train_splits, data_kwargs={"X": X_const, "y": y_const}, kwargs={"test_size": 0.2, "random_state": 42}, outputs=[None, "X_test_const", None, "y_test_const"], split="test" ), ] # ⬆️ upload the const fill test set seclea.upload_dataset_split(X=X_test_const, y=y_test_const, dataset_name="Auto Insurance Fraud - Const Fill - Test", metadata={}, transformations=const_test_transformations) # 🔀 define the transformations - for the mode fill training set mode_train_transformations = [ DatasetTransformation( get_test_train_splits, data_kwargs={"X": X_mode, "y": y_mode}, kwargs={"test_size": 0.2, "random_state": 42}, outputs=["X_train_mode", None, "y_train_mode", None], split="train", ), ] # ⬆️ upload the mode fill train set seclea.upload_dataset_split(X=X_train_mode, y=y_train_mode, dataset_name="Auto Insurance Fraud - Mode Fill - Train", metadata=processed_metadata, transformations=mode_train_transformations) # 🔀 define the transformations - for the mode fill test set mode_test_transformations = [ DatasetTransformation( get_test_train_splits, data_kwargs={"X": X_mode, "y": y_mode}, kwargs={"test_size": 0.2, "random_state": 42}, outputs=[None, "X_test_mode", None, "y_test_mode"], split="test", ), ] # ⬆️ upload the mode fill test set seclea.upload_dataset_split(X=X_test_mode, y=y_test_mode, dataset_name="Auto Insurance Fraud - Mode Fill - Test", metadata={}, transformations=mode_test_transformations) def smote_balance(X, y, random_state): from imblearn.over_sampling import SMOTE sm = SMOTE(random_state=random_state) X_sm, y_sm = sm.fit_resample(X, y) print( f"""Shape of X before SMOTE: {X.shape} Shape of X after SMOTE: {X_sm.shape}""" ) print( f"""Shape of y before SMOTE: {y.shape} Shape of y after SMOTE: {y_sm.shape}""" ) return X_sm, y_sm # returns X, y # balance the training sets - creating new training sets for comparison X_train_const_smote, y_train_const_smote = smote_balance(X_train_const, y_train_const, random_state=42) X_train_mode_smote, y_train_mode_smote = smote_balance(X_train_mode, y_train_mode, random_state=42) # 🔀 define the transformations - for the constant fill balanced train set const_smote_transformations = [ DatasetTransformation( smote_balance, data_kwargs={"X": X_train_const, "y": y_train_const}, kwargs={"random_state": 42}, outputs=["X", "y"] ), ] # ⬆️ upload the constant fill balanced train set seclea.upload_dataset_split(X=X_train_const_smote, y=y_train_const_smote, dataset_name="Auto Insurance Fraud - Const Fill - Smote Train", metadata={}, transformations=const_smote_transformations) # 🔀 define the transformations - for the mode fill balanced train set mode_smote_transformations = [ DatasetTransformation( smote_balance, data_kwargs={"X": X_train_mode, "y": y_train_mode}, kwargs={"random_state": 42}, outputs=["X", "y"] ), ] # ⬆️ upload the mode fill balanced train set seclea.upload_dataset_split(X=X_train_mode_smote, y=y_train_mode_smote, dataset_name="Auto Insurance Fraud - Mode Fill - Smote Train", metadata={}, transformations=mode_smote_transformations) ``` #### Evaluating the Transformations Now head to platform.seclea.com again to take another look at the Datasets section. You will see that there is much more to look at now. You can see here how the transformations are used to show you the history of the data and how it arrived in its final state. {% embed url="" %} Evaluating the dataset transformations over the course of a project. {% endembed %} #### Modelling Now we get started with the modelling. We will run the same models over each of our datasets to explore how the different processing of the data has affected our results. We will use three models from sklearn for this, DecisionTree, RandomForest and GradientBoosting Classifers. **Training** ```python from sklearn.tree import DecisionTreeClassifier from sklearn.ensemble import RandomForestClassifier from sklearn.ensemble import GradientBoostingClassifier from sklearn.model_selection import cross_val_score from sklearn.metrics import accuracy_score classifiers = { "RandomForestClassifier": RandomForestClassifier(), "DecisionTreeClassifier": DecisionTreeClassifier(), "GradientBoostingClassifier": GradientBoostingClassifier() } datasets = [ ("Const Fill", (X_train_const, X_test_const, y_train_const, y_test_const)), ("Mode Fill", (X_train_mode, X_test_mode, y_train_mode, y_test_mode)), ("Const Fill Smote", (X_train_const_smote, X_test_const, y_train_const_smote, y_test_const)), ("Mode Fill Smote", (X_train_mode_smote, X_test_mode, y_train_mode_smote, y_test_mode)) ] for name, (X_train, X_test, y_train, y_test) in datasets: for key, classifier in classifiers.items(): # cross validate to get an idea of generalisation. training_score = cross_val_score(classifier, X_train, y_train, cv=5) # train on the full training set classifier.fit(X_train, y_train) # ⬆️ upload the fully trained model seclea.upload_training_run_split(model=classifier, X_train=X_train, y_train=y_train, X_test=X_test, y_test=y_test) # test accuracy y_preds = classifier.predict(X_test) test_score = accuracy_score(y_test, y_preds) print(f"Classifier: {classifier.__class__.__name__} has a training score of {round(training_score.mean(), 3) * 100}% accuracy score on {name}") print(f"Classifier: {classifier.__class__.__name__} has a test score of {round(test_score, 3) * 100}% accuracy score on {name}") ``` #### Analysis Let's head back to [platform.seclea.com](https://platform.seclea.com/) and we can analyse our Models {% embed url="" %} Analysis of the trained models on the Seclea Platform. {% endembed %} # Cloud Platform The Seclea Platform for AI assurance and regulatory compliance is now available as a public cloud offering, providing businesses with a convenient and scalable solution for meeting their compliance requirements. By leveraging the power of cloud computing, the platform offers seamless integration, rapid deployment, and effortless scalability, making it easier than ever for organisations to stay abreast of the evolving AI regulatory landscape. With the Seclea Platform's public cloud deployment, companies can efficiently ensure their AI systems adhere to industry standards and compliance requirements while enjoying the flexibility and cost-effectiveness of a cloud-based solution. # On-Premises Deployment The Seclea Platform for AI assurance and regulatory compliance is also available as an on-premises deployment, providing organisations with a robust and secure solution tailored to their specific needs. Companies can maintain greater control over their data and infrastructure by choosing an on-premises deployment, ensuring the utmost security and privacy. The Seclea Platform empowers organisations to navigate the complex AI regulatory environment effectively while adapting to their unique operational requirements. With its on-premises deployment option, the Seclea Platform delivers a comprehensive compliance solution that enables companies to confidently manage their AI systems and ensure adherence to industry standards, all within the secure confines of their own infrastructure. # Overview Welcome to the Seclea Web Portal documentation, your comprehensive guide to navigating and leveraging our platform's powerful features. The Seclea Platform is designed to simplify and streamline the management, tracking, and compliance of your AI projects, allowing your organisation to focus on innovation while maintaining the highest security and regulatory compliance standards. #### Key Features 1. **Monitor AI projects:** Our web portal provides a centralised dashboard to monitor the progress, performance, and status of your AI projects, giving you real-time insights and facilitating efficient project management. 2. **Track datasets and their transformations:** Seclea enables you to track the lifecycle of your datasets, from the source to the various transformations and preprocessing steps applied, ensuring data integrity and traceability throughout the project. 3. **Track model training, performance, bias, and explanation:** Our platform offers comprehensive tracking of all model training, their performance metrics, potential biases, and explanations. This level of transparency enables you to make informed decisions and optimise your AI models. 4. **Manage AI regulatory compliance against global AI regulations:** Seclea simplifies the process of adhering to international AI regulations by offering built-in compliance management tools. Stay up-to-date and confidently navigate the evolving regulatory landscape with our platform's comprehensive compliance features. 5. **Manage AI risk management using globally recognised AI risk management frameworks from NIST and ISO:** Mitigate risk and ensure the responsible development of AI systems by leveraging our platform's integration with leading risk management frameworks, such as NIST and ISO standards. 6. **Full provenance of AI projects:** Seclea provides end-to-end provenance tracking for your AI projects, ensuring complete transparency and traceability. Gain a detailed view of your project's history and make data-driven decisions with confidence. # Basic Workflows The Seclea Platform streamlines the AI development process by offering an efficient and user-friendly way to manage and monitor your AI projects. Here, we present the basic workflows to help you get started with the Seclea Platform. #### Workflow 1: Install Seclea AI and Integrate with Your AI Projects 1. **Install the `seclea-ai` Python API:** Install the `seclea-ai` package using PyPI by running `pip install seclea-ai` in your Python environment. 2. **Import the API into your AI project:** In your Python-based AI project, import the `seclea-ai` module with `import seclea_ai`. 3. **Initialise the API:** Set up the API by configuring the required credentials and project settings using the `SecleaAI(projectname="Name of your Project", organization="Name of your organisation")` function. 4. **Integrate the API into your AI project:** Utilize the various API functions to record your datasets, data transformations, and models as you develop your AI solution. For example, use `seclea.upload_dataset()` and `seclea.training_run_split()` to track the progress of your project. #### Workflow 2: Using Seclea Web UI to Manage AI-Related Services 1. **Sign in to the Seclea Web Portal:** Access the Seclea Web Portal using your registered credentials. 2. **Navigate to the dashboard:** View an overview of your AI projects, including their status, performance, and compliance metrics. 3. **Monitor AI projects:** Select individual projects to gain deeper insights into their progress and access various monitoring features, such as tracking datasets and their transformations, model trainings, performance, bias, and explanations. 4. **Manage AI regulatory compliance:** Use the built-in compliance management tools to ensure your AI projects adhere to global AI regulations and industry standards. 5. **Manage AI risk management:** Leverage the platform's integration with globally recognised AI risk management frameworks from NIST and ISO to mitigate risk and ensure responsible AI development. 6. **Access full provenance of AI projects:** Review the complete history of your AI projects, including data transformations, model trainings, and performance metrics, to make data-driven decisions and optimise your AI solutions. By following these basic workflows, you can efficiently manage and monitor your AI projects using the powerful features offered by the Seclea Platform, ensuring compliance, traceability, and accountability across your entire development process. # Creating a Project Creating an AI project on the Seclea Platform using the Web UI is a simple and intuitive process, allowing you to start managing and monitoring your AI initiatives with ease. To begin, simply log in to the Seclea Web Portal ([https://platform.seclea.com](https://platform.seclea.com/home)) and navigate to the "Create Project” (as shown in the video below) section. Here, you'll be prompted to input essential project details, such as the project name and description, to facilitate efficient organisation and searchability. Once you've completed these steps, the platform will automatically generate a project for you, and you can then use the project name in your Python-based AI workflows using the `seclea-ai` API. {% embed url="" %} Creating a new project on the Seclea Platform. {% endembed %} By creating an AI project on the Seclea Platform, you'll gain access to a comprehensive suite of management, monitoring, and compliance tools, ensuring your project's success and adherence to global AI regulations and best practices. # Project Settings The Seclea Platform offers a comprehensive "Project Settings" section, where users can easily manage various aspects of their AI projects, including user access settings, compliance settings, risk management settings, and performance settings. This centralised hub allows users to efficiently configure and control their projects according to their specific requirements and preferences. **User Access Settings:** In this section, users can manage access permissions for their project team members. By defining roles and permissions, project administrators can ensure that the right people have access to the appropriate resources and data. The user access settings enable project owners to grant or restrict access to specific project components, enhancing collaboration and safeguarding sensitive information. **Compliance Settings:** The compliance settings allow users to configure their AI projects to adhere to global AI regulations and industry standards. By customising these settings, users can ensure that their projects remain compliant with evolving regulatory requirements. The Seclea Platform offers built-in tools and features to assist with regulatory compliance, simplifying the process and providing peace of mind for project owners. **Risk Management Settings:** In the risk management settings, users can leverage the platform's integration with globally recognised AI risk management frameworks, such as NIST and ISO standards. By tailoring these settings to their projects, users can effectively mitigate risks associated with AI development and deployment. The platform provides comprehensive risk assessment and mitigation tools, ensuring responsible AI development and promoting best practices across projects. **Performance Settings (Internal Policies and Controls):** The performance settings allow users to define and manage internal policies and controls for their AI projects. By customising these settings, project owners can establish performance benchmarks, monitor progress, and optimise their AI models. The Seclea Platform enables users to track model training, performance metrics, potential biases, and explanations, ensuring transparency and accountability throughout the AI development process. The Seclea Platform's "Project Settings" section serves as a centralised location for managing and configuring AI projects, providing users with the necessary tools and features to ensure success, compliance, and responsible development across all aspects of their AI initiatives. # User Access Setting
# Compliance Settings The AI compliance settings on the Seclea Platform play a crucial role in ensuring your AI projects adhere to various regulatory frameworks and industry standards. By customizing these settings, users can efficiently manage their projects' compliance with evolving regulations across different jurisdictions. Currently, the platform supports a range of compliance requirements, including the European Union's Artificial Intelligence Act (EU AIA), Canada's Artificial Intelligence and Data Act (AIDA), the US Food and Drug Administration's (FDA) guidelines for AI-based Software as a Medical Device (SaMD), and other emerging regulatory frameworks. Leveraging these compliance settings, users can confidently develop and deploy AI solutions in line with global best practices and maintain a strong commitment to responsible AI development. Setting up compliance monitoring for an AI project on the Seclea Platform is a straightforward process. By following these steps, you can ensure your project adheres to the necessary regulatory frameworks and industry standards: **Step 1:** Familiarize yourself with the list of regulatory compliance options available on Seclea: * European Commission's Artificial Intelligence Act (EC AIA) * Canada's Artificial Intelligence and Data Act (AIDA) * US Food and Drug Administration's AI-based Software as a Medical Device (FDA SaMD) * Organisation for Economic Co-operation and Development AI Principles (OECD AI Principles)

List of available compliance templates on the Seclea Platform.

**Step 2:** Navigate to your project settings and click on the "Compliance" tab. {% embed url="" %} Compliance setting page on the Seclea Platform. {% endembed %} **Step 3:** In the "Available" section, you will find a list of available compliance templates. You can choose from the provided templates or create a custom template tailored to your project's specific compliance requirements. **Step 4:** After selecting a template, configure the necessary settings, including assigning responsible persons and reviewers. The template specifications are divided into categories, controls, and checks: * **Categories** are logical groupings of controls that organise compliance requirements. * **Controls** address specific requirements and consist of a collection of checks. * **Checks** related to individual actions that need to be monitored, recorded, or documented. {% embed url="" %} Configuring a compliance template on the Seclea Platform. {% endembed %} By completing these steps, you will have successfully set up compliance monitoring for your AI project on the Seclea Platform, ensuring adherence to relevant regulatory frameworks and promoting responsible AI development.\
# Risk Management Settings Setting up risk management monitoring for an AI project on the Seclea Platform is essential for identifying, assessing, and mitigating potential risks associated with your AI project. Follow these steps to set up risk management monitoring: **Step 1:** Familiarize yourself with the list of risk management options available on Seclea: * ISO AI Risk Management * NIST Risk Management Framework
**Step 2:** Navigate to your project settings and click on the "Risk" tab. **Step 3:** In the "Available" section, you will find a list of available risk management templates. You can choose from the provided templates or create a custom template tailored to your project's specific risk management requirements. **Step 4:** After selecting a template, configure the necessary settings, including assigning responsible persons and reviewers. The template specifications are divided into categories, controls, and checks: * **Categories** are logical groupings of controls that organise the risk management requirements. * **Controls** address specific requirements and consist of a collection of checks. * **Checks** relate to individual actions that need to be monitored, recorded, or documented. The risk likelihood, impact, and risk level are assigned to individual checks. {% embed url="" %} Configuring risk management template on the Seclea Platform. {% endembed %} By completing these steps, you will have successfully set up risk management monitoring for your AI project on the Seclea Platform. This will help you proactively identify and address potential risks associated with your AI project, ensuring its long-term success and promoting responsible AI development. # Performance (Internal Policies) Setting Setting up an internal policy template on the Seclea Platform is an important step to ensure adherence to your organization's internal governance requirements for an AI project. Follow these steps to create an internal policy template: **Step 1:** Log in to the Seclea Platform and navigate to your project settings. **Step 2:** Click on the "Internal Policies" tab to access the internal policy management section. **Step 3:** In the "Project" section, you can view a list of existing internal policy templates. To create a new template, click on the "Create template" button. **Step 4:** Enter a descriptive name and a brief description for your new internal policy template. This will help you and your team members easily identify the template and its purpose. **Step 5:** Define the structure of your internal policy template by creating categories, controls, and checks: * **Categories** are logical groupings of controls that organise the internal governance requirements. * **Controls** address specific governance requirements and consist of a collection of checks. * **Checks** relate to individual actions that need to be monitored, recorded, or documented. To add categories, click on the “ Create template Category" button and provide a name and description for each category. Within each category, click on the “ Create template category item” (aka Control) button to define specific governance requirements. Finally, within each control, click on the "Add Check" button to specify the individual actions to be monitored. **Step 6:** Assign responsible persons and reviewers for each control or check, as appropriate. This ensures clear ownership and accountability for internal governance compliance within your AI project. {% embed url="" %} Building an internal policy template on the Seclea Platform. {% endembed %} The changes to the template are saved automatically, it will be available for use in your AI project to monitor internal governance compliance. By following these steps, you can create a custom internal policy template on the Seclea Platform that aligns with your organisation's governance requirements, ensuring responsible AI development and promoting a culture of accountability and transparency. # User Management
# AI regulatory compliance Compliance with artificial intelligence regulations is becoming increasingly important as artificial intelligence (AI) continues to progress and become more integrated across a variety of business sectors. Regulation of artificial intelligence (AI) refers to the set of laws, policies, and standards that control the creation, deployment, and use of AI systems. These regulations are essential to ensure that artificial intelligence systems are developed and used in a manner that is safe, ethical, and responsible, while also safeguarding the privacy and security of individuals. A comprehensive strategy that takes into account both the technical and ethical considerations of AI development and implementation is required for effective AI regulatory compliance. This strategy is required for effective AI regulatory compliance. This involves having an understanding of the potential risks and harms associated with AI systems, as well as the ethical principles that should guide their development and use moving forward. It also includes ensuring that AI systems are transparent, explainable, and accountable, so that individuals can understand how they are being used and hold those responsible for any negative outcomes. To accomplish effective AI regulatory compliance, there must be collaboration between government regulators, business leaders, and other stakeholders. As part of this collaboration, clear and consistent regulations that are flexible enough to accommodate the quickly evolving landscape of AI technology should be developed. It should also involve continuous monitoring and evaluation of AI systems to ensure that they continue to comply with regulatory standards, as well as to identify and resolve any potential risks or harms that may arise. Ultimately, effective AI regulatory compliance is important to ensure that the benefits of AI technology are realised while minimising its potential risks and harms. The list of AI regulations, standards and guidelines supported by the Seclea Platform includes:
EC Artificial Intelligence ActMandated for High-Risk AI applications to be deployed in European Union.EC Artificial Intelligence ActFlag_of_Europe.svg.png
FDA SaMD with AIMandated for software as a medical device that relies on AI. FDA SaMD with Artificial IntelligenceFDA-Social-Graphic.png
OECD AI PrinciplesResponsible AI guidelines for developing suitable AI applications. OECD AI PrinciplesOECD-social-sharex.jpg
Canada AI and Data Act (AIDA)Mandated for AI applications to be deployed in Canada.Canada Artificial Intelligence and Data Act (AIDA)Flag_of_Canada_(Pantone).svg-2.png
South Korean - AI-based Medical DevicesMandated for AI-based medical devices in South Korea. South Korean - AI-based Medical Devices (SK-AIMD)Flag-South-Korea.jpg.webp
Saudi Arabia - AI-based Medical Devices Mandated for AI-based medical devices in Saudi Arabia. Saudi Arabia - AI-based Medical Devices (SA-AIMD)Flag_of_Saudi_Arabia_(1938–1973).svg.png
# Seclea Compliance Dashboard Seclea Compliance Dashboard provides a comprehensive overview of the compliance status of your AI projects. The dashboard is designed to provide users with a quick and easy way to assess the compliance status of their projects, and to identify any areas that require attention.\ \ To access the Compliance Dashboard on the Seclea Platform, follow these steps: 1. Navigate to the project for which you want to view the Compliance Dashboard. 2. In the left side menu, click on "Compliance." 3. On the top right of the page, you can select the compliance template that you have configured for the project. Once you have accessed the dashboard, you will be able to view the following information: 1. Overall Compliance: This section provides an overview of the compliance status of your projects. It shows the percentage of completed compliance requirements and highlights any outstanding actions that need attention. 2. Outstanding Actions: This section displays a table of all outstanding actions that need attention. The table lists the Action, Check Template, Category, Requirement and Status, allowing users to quickly identify the compliance requirements that need to be addressed. 3. Compliance by Category: This section displays a screenshot of the Compliance by Category dashboard. It shows the compliance level for each section of the regulatory requirements, allowing users to assess the compliance status of their projects in different categories. 4. Compliance by Person: This section displays a screenshot of the Compliance by Person dashboard. It shows the compliance actions associated with each team member, allowing users to track the progress of their team members. 5. Full List of Compliance: This section displays a table that lists Name, Description, Completion level and Status for each compliance requirement, allowing users to see the compliance status of their projects in detail. By using the Seclea Compliance Dashboard, users can quickly assess the compliance status of their projects and identify any areas that need attention. The dashboard provides a clear and concise overview of the compliance status of your AI projects, allowing users to ensure their projects are in compliance with relevant regulatory frameworks and industry standards. {% embed url="" %} Seclea regulatory compliance dashboard {% endembed %}

# Working with templates for compliance The AI compliance settings on the Seclea Platform play a crucial role in ensuring your AI projects adhere to various regulatory frameworks and industry standards. By customising these settings, users can efficiently manage their projects' compliance with evolving regulations across different jurisdictions. Currently, the platform supports a range of compliance requirements, including the European Union's Artificial Intelligence Act (EU AIA), Canada's Artificial Intelligence and Data Act (AIDA), the US Food and Drug Administration's (FDA) guidelines for AI-based Software as a Medical Device (SaMD), and other emerging regulatory frameworks. Leveraging these compliance settings, users can confidently develop and deploy AI solutions in line with global best practices and maintain a strong commitment to responsible AI development. Setting up compliance monitoring for an AI project on the Seclea Platform is a straightforward process. By following these steps, you can ensure your project adheres to the necessary regulatory frameworks and industry standards: **Step 1:** Familiarize yourself with the list of regulatory compliance options available on Seclea: * European Commission's Artificial Intelligence Act (EC AIA) * Canada's Artificial Intelligence and Data Act (AIDA) * US Food and Drug Administration's AI-based Software as a Medical Device (FDA SaMD) * Organisation for Economic Co-operation and Development AI Principles (OECD AI Principles)

List of available compliance templates on the Seclea Platform.

**Step 2:** Navigate to your project settings and click on the "Compliance" tab. {% embed url="" %} Compliance setting page on the Seclea Platform. {% endembed %} **Step 3:** In the "Available" section, you will find a list of available compliance templates. You can choose from the provided templates or create a custom template tailored to your project's specific compliance requirements. **Step 4:** After selecting a template, configure the necessary settings, including assigning responsible persons and reviewers. The template specifications are divided into categories, controls, and checks: * **Categories** are logical groupings of controls that organise compliance requirements. * **Controls** address specific requirements and consist of a collection of checks. * **Checks** related to individual actions that need to be monitored, recorded, or documented. {% embed url="" %} Configuring a compliance template on the Seclea Platform. {% endembed %} By completing these steps, you will have successfully set up compliance monitoring for your AI project on the Seclea Platform, ensuring adherence to relevant regulatory frameworks and promoting responsible AI development.\
# AI risk management The process of recognising and minimising the potential dangers posed by the creation and application of artificial intelligence is what is meant by the term "AI risk management." It is possible that as artificial intelligence technology becomes more advanced and widespread, it will pose significant risks to society. These risks may include the loss of jobs, the concentration of power in the hands of a few powerful corporations or governments, and even existential risks to humanity itself. It is essential to develop efficient risk management strategies that take into account both the potential benefits and the potential harms of AI technology in order to reduce the likelihood of these risks occurring. A multi-disciplinary approach that includes the participation of experts from a variety of disciplines, such as computer science, philosophy, economics, law, and ethics, is required for effective risk management of artificial intelligence (AI). To ensure that the benefits of this technology are realised while simultaneously identifying and mitigating the potential risks that may be associated with the development and application of AI technology is the objective of this endeavour. This necessitates not only an in-depth comprehension of the potential hazards and damage that can be caused by AI, but also a dedication to the development and implementation of AI that is both ethical and responsible. We can ensure that artificial intelligence (AI) technology is developed and used in a way that is beneficial to society as a whole if we take a proactive approach to the management of risks posed by AI. The list of AI risk management supported by the Seclea Platform includes:
NIST AI Risk Management FrameworkSeclea template to ensure your AI risk is managed as prescribed by NIST AI RMF.logo-nist (1).pngNIST AI Risk Management Framework
ISO AI Risk Management (ISO 23894)Seclea template to ensure your AI risk is managed as prescribed by ISO 23894.ISO-Logo.jpgISO AI Risk Management
FDA AI as SaMD Risk ManagementSeclea template for managing risks related to the FDA AI as SaMD solutions. FDA-Social-Graphic.pngFDA AI based SaMD Risk Management
# Seclea AI Risk Management Dashboard The Seclea Platform’s Risk Management Dashboard provides users with an overview of their project's risk level, along with valuable insights to help manage and mitigate risk. Here are the key features of the dashboard: * Overall Risk Level: The dashboard displays a color-coded indicator that shows the overall risk level of the project. * Risk Heatmap: The Risk Heatmap provides a visual representation of the project's risk distribution. The heatmap highlights the areas of the project with high, medium, and low risks. * Risk by Category: This section shows the distribution of risks across different categories, allowing users to identify the risk areas that require more attention. * Risk by Owner: This section provides users with insights on risks assigned to different team members, highlighting the areas where individuals can contribute to risk mitigation efforts. * Table Listing All Risks: This table provides a comprehensive overview of all the risks associated with the project. The table includes information such as Risk Name, Risk Description, Risk Owner, Likelihood, Impact, and Risk Level. This information allows users to assess the risk and develop effective mitigation strategies. To access the Risk Management Dashboard, navigate to the project on the Seclea Platform and click on the Risk option in the left-side menu. The dashboard will display the key risk management metrics and insights, allowing you to proactively manage and mitigate risks throughout the project lifecycle. {% embed url="" %} Seclea risk management dashboard {% endembed %} # Working with templates for risk management Setting up risk management monitoring for an AI project on the Seclea Platform is essential for identifying, assessing, and mitigating potential risks associated with your AI project. Follow these steps to set up risk management monitoring: **Step 1:** Familiarize yourself with the list of risk management options available on Seclea: * ISO AI Risk Management * NIST Risk Management Framework
**Step 2:** Navigate to your project settings and click on the "Risk" tab. **Step 3:** In the "Available" section, you will find a list of available risk management templates. You can choose from the provided templates or create a custom template tailored to your project's specific risk management requirements. **Step 4:** After selecting a template, configure the necessary settings, including assigning responsible persons and reviewers. The template specifications are divided into categories, controls, and checks: * **Categories** are logical groupings of controls that organise the risk management requirements. * **Controls** address specific requirements and consist of a collection of checks. * **Checks** relate to individual actions that need to be monitored, recorded, or documented. The risk likelihood, impact, and risk level are assigned to individual checks. {% embed url="" %} Configuring risk management template on the Seclea Platform. {% endembed %} By completing these steps, you will have successfully set up risk management monitoring for your AI project on the Seclea Platform. This will help you proactively identify and address potential risks associated with your AI project, ensuring its long-term success and promoting responsible AI development. # Overview Seclea's Python API, `seclea-ai`, provides seamless integration with any Python-based AI development workflow, including popular cloud-based development environments such as Google Colab. The API is easily accessible via PyPI, allowing you to quickly install and integrate `seclea-ai` into your projects by simply running `pip install seclea-ai`. With `seclea-ai`, you can effortlessly: 1. **Record your data:** The API enables you to log and track datasets used in your AI projects, ensuring complete traceability and accountability throughout the development process. 2. **Record data transformations:** `seclea-ai` allows you to document and monitor all data transformations applied to your datasets, including cleaning, feature engineering, normalization, and other preprocessing steps. This level of tracking ensures data integrity and facilitates the optimisation of your AI models. 3. **Record your models:** The Python API offers comprehensive model tracking, allowing you to log and manage model architectures, training configurations, and performance metrics. This feature streamlines model versioning and enables you to easily compare and evaluate different models throughout the development lifecycle. By utilizing the `seclea-ai` Python API, you can bring the power of the Seclea Platform to your Python-based AI projects, ensuring efficient project management, compliance, and traceability across your entire development workflow. # API Documentation For the full Python API documentation, please go to . If you just want to get straight into though, we have the basics here just for you! ### Installation To install the `seclea_ai` package, run the following command: ```python pip install seclea_ai ``` ### Initialisation To use the `seclea_ai` API, first import the `SecleaAI` class and create an instance with your project and organisation details: ```python from seclea_ai import SecleaAI  # NOTE - use the organisation name provided to you from which you received credentials.  seclea = SecleaAI(project_name="Your AI Project Name", organization='') ``` ### Uploading Datasets To upload a dataset to the Seclea Platform, use the `upload_dataset()` method, providing the dataset, dataset name, and metadata: ```python import pandas as pd  # Load the data  data = pd.read_csv('your_data.csv', index_col="index_column")  # Define the metadata for the dataset.  dataset_metadata = {  # ...  } seclea.upload_dataset(dataset=data, dataset_name="Your Dataset Name", metadata=dataset_metadata) ``` #### Uploading Datasets - as separate samples and labels To upload dataset that is split into samples and labels, use the `upload_dataset_split()` method: ```python # Upload the train and test dataset splits seclea.upload_dataset_split( X=X_train, y=y_train, dataset_name="Your Dataset Name - Train", metadata={}, transformations=train_transformations ) ``` ### Applying Dataset Transformations To apply and record dataset transformations, use the `DatasetTransformation` class from the `seclea_ai.transformations` module: 
from seclea_ai.transformations import DatasetTransformation 

# Define the updates to the metadata 
processed_metadata = { 
# ... 
} 

# Define the transformations to the dataset 
processing_transformations = [ 
    DatasetTransformation(
        # Define the dataset transformations
        ) 
] 

# Upload the processed datasets
seclea.upload_dataset(dataset=processed_data, 
                    dataset_name="Your Processed Dataset Name", 
                    metadata=processed_metadata, 
                    transformations=processing_transformations
                    )
### Training and Uploading Models To upload a model using the `seclea_ai` API, follow these steps: ```python from sklearn.model_selection import cross_val_score  from sklearn.ensemble import RandomForestClassifier  # Initialize a classifier  classifier = RandomForestClassifier()  # Cross-validate the classifier  training_score = cross_val_score(classifier, X_train, y_train, cv=5)  # Train the classifier on the full training set  classifier.fit(X_train, y_train)  # Upload the fully trained model seclea.upload_training_run_split(model=classifier, X_train=X_train, y_train=y_train, X_test=X_test, y_test=y_test) ``` Note that this uses the `upload_training_run_split` function that takes datasets as samples and labels. If you prefer to reference a dataset that isn't split in this way you can use the `upload_training_run` function instead. ### Conclusion By following the steps outlined in this documentation, you can efficiently integrate the `seclea_ai` API into your AI project, enabling seamless data and model management, as well as regulatory compliance and risk management through the Seclea Platform. \
# EC Artificial Intelligence Act European Commission published the draft resolution (it is still waiting for approval) on 21st April 2021 over the use of AI. The regulation applies to all organisations that do business in or with European Commission jurisdiction and citizens (living in the EC jurisdictions). So any company that operates in the European Union will comply with this regulation (if approved by the EU parliament). The draft resolution proposal can be downloaded from the link [![](https://eur-lex.europa.eu/images/eurlex.ico)EUR-Lex - 52021PC0206 - EN - EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021PC0206). The media briefing with the draft proposal reported that the European Commission’s objective for proposing the new rules and actions (as part of the draft resolution) is to turn Europe into the global hub for trustworthy Artificial Intelligence (AI). It is the combination of the first-ever legal framework on AI and guarantees the safety and fundamental rights of people and businesses. ## Regulation’s Key Points For reference, some of the highlights of the proposal include: ### Definition of AI * An AI system is defined as the key functional characteristics of the software, in particular the ability, for a given set of human-defined objectives, to generate outputs such as content, predictions, recommendations, or decisions which influence the environment with which the system interacts, be it in a physical or digital dimension. * AI systems can be designed to operate with varying levels of autonomy and be used on a stand-alone basis or as a component of a product, irrespective of whether the system is physically integrated into the product (embedded) or serve the functionality of the product without being integrated therein (non-embedded). * AI Techniques and Approaches this regulations applies to: * Machine learning approaches, including supervised, unsupervised and reinforcement learning, using a wide variety of methods including deep learning; * Logic- and knowledge-based approaches, including knowledge representation, inductive (logic) programming, knowledge bases, inference and deductive engines, (symbolic) reasoning and expert systems; * Statistical approaches, Bayesian estimation, search and optimization methods. * The rules established by this Regulation should apply to providers of AI systems in a non-discriminatory manner, irrespective of whether they are established within the Union or in a third country, and to users of AI systems established within the Union. * This Regulation should also apply to providers and users of AI systems that are established in a third country, to the extent the output produced by those systems is used in the Union. * AI systems are categorised into four groups; Unacceptable risk, high risk, limited risk and minimal risk. * AI systems (unacceptable risk category) are forbidden or prohibited to be deployed in the markets include: * Systems intended to distort human behaviour, whereby physical or psychological harms are likely to occur * Systems providing social scoring of natural persons for general purpose by public authorities or on their behalf. * High-risk AI systems should only be placed on the Union market or put into service if they comply with certain mandatory requirements. * AI systems identified as high-risk should be limited to those that have a significant harmful impact on the health, safety and fundamental rights of persons in the Union and such limitation minimises any potential restriction to international trade, if any. * There are no mandatory requirements on Listed Risk (AI systems with specific transparency obligations) and minimal risk. However, EC encourages Incentivisation of the non-High-risk AI providers to voluntarily meet the mandatory requirements. * Compliance Requirements include: * Risk management system (Article 9), Data and Data Governance (Article 10), Technical Documentation (Article 11), Record-Keeping (Article 12), Transparency and provision of information to users (Article 13), Human Oversight (Article14), Accuracy, robustness and cybersecurity (Article 15). * The the conformity assessment (validation that a provider meets the mandatory requirements) of their respective AI systems should be carried out as a general rule by the provider under its own responsibility - at least in an initial phase of application of this regulation. * For any AI system placed on the market, a specific natural or legal person, defined as the provider, takes the responsibility for the placing on the market or putting into service of a high-risk AI system, regardless of whether that natural or legal person is the person who designed or developed the system. * The non-compliance of the AI systems can be: * Administrative fines of up to 30 000 000 EUR or, if the offender is company, up to 6 % of its total worldwide annual turnover for the preceding financial year, whichever is higher * non-compliance with the prohibition of the artificial intelligence practices referred to in Article 5 (Prohibited Artificial Intelligence Practices); * non-compliance of the AI system with the requirements laid down in Article 10 (High-risk AI systems - Data and Data Governance). * Administrative fines of up to 20 000 000 EUR or, if the offender is company, up to 4 % of its total worldwide annual turnover for the preceding financial year, whichever is higher * non-compliance of the AI system with any requirements or obligations under this Regulation, other than those laid down in Articles 5 and 10 * Administrative fines of up to 10 000 000 EUR or, if the offender is a company, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. * for supplying of incorrect, incomplete or misleading information to notified bodies and national competent authorities in reply to a request Seclea Platform template for EC Artificial Intelligence Act (AIA) consists of the following compliance categories: * [Article 09 - Risk Management System](https://documentations.seclea.com/ec-aia-compliance/article-09-risk-management-system-art09) * [Article 10 - Data Governance](https://documentations.seclea.com/ec-aia-compliance/article-10-data-governance-art10) * [Article 11 - Technical Documentation](https://documentations.seclea.com/ec-aia-compliance/article-11-technical-documentation-art11) * [Article 12 - Record Keeping](https://documentations.seclea.com/ec-aia-compliance/article-11-technical-documentation-art11) * [Article 13 - Transparency and provision of information to user](https://documentations.seclea.com/ec-aia-compliance/article-13-transparency-and-provision-of-information-to-user-art13) * [Article 14 - Human Oversight](https://documentations.seclea.com/ec-aia-compliance/article-14-human-oversight-art14) * [Article 15 - Accuracy, Robustness and Cybersecurity](https://documentations.seclea.com/ec-aia-compliance/article-15-accuracy-robustness-and-cybersecurity-art15) * [Article 17 - Quality Management System](https://documentations.seclea.com/ec-aia-compliance/article-17-quality-management-system-art17) * [Article 61 - Post Market Monitoring System](https://documentations.seclea.com/ec-aia-compliance/article-61-post-market-monitoring-system-art61) More details on the EC AIA can be found [here](https://documentations.seclea.com/ec-aia-compliance/). # FDA SaMD with Artificial Intelligence U.S Food and Drug Administration (FDA) has published guidance documents for Artificial Intelligence (AI) based Software as a Medical Device (SaMD). As AI and Machine Learning (ML) are being increasingly incorporated into medical devices, the FDA Center for Devices and Radiological Health (CDRH) is [considering](https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-and-machine-learning-software-medical-device) “a total product lifecycle-based regulatory framework for these technologies that would allow for modifications to be made from real-world learning and adaptation, while ensuring that the safety and effectiveness of the software as a medical device are maintained. The FDA traditionally reviews medical devices through an “appropriate premarket pathway,” but the agency recognises that this regulatory framework was not designed for adaptive technologies such as AI and ML. Regulators have noted that these technologies may require premarket review under the existing agency approach to software modifications. In 2019, the agency published a [discussion paper](https://www.fda.gov/media/122535/download) outlining a potential approach to premarket review for AI and ML software. As part of its Artificial Intelligence and Machine Learning (AI/ML) Software as a Medical Device Action Plan, the CDRH’s Digital Health Center of Excellence took feedback on the 2019 paper. It formulated a [response](https://www.fda.gov/media/145022/download) outlining actions the FDA intends to take in this area. Seclea Platform provides a baseline template based on the FDA's published guidelines. The template is based on the following documents produced by FDA (Federal Drug Authority) and IMDRF (International Medical Device Regulators Forum). There is no definitive regulatory guideline for AI/ML as a medical device. FDA has published a framework change request for SaMD (Software as a Medical Device) to include AI/ML algorithms. [IMDRF](https://www.imdrf.org/) has an [AI Medical Devices working group](https://www.imdrf.org/working-groups/artificial-intelligence-medical-devices) working on the guideline document. EU and other countries that have imposed AI regulations are part of this working group. The last public activity by IMDRF was to release the “Key Terms and Definitions” document. The list of documents used to formulate the FDA AI/ML-based SaMD template includes: * [IMDRF/SaMD - SaMD: Application of Quality Management System](https://www.imdrf.org/sites/default/files/docs/imdrf/final/technical/imdrf-tech-151002-samd-qms.pdf) * [AI/ML-Based Software as a Medical Device (SaMD) Action Plan](https://www.fda.gov/media/145022/download) * [Proposed Regulatory Framework for Modification to AI/ML-Based Software as a Medical Device (SaMD)](https://www.fda.gov/files/medical%20devices/published/US-FDA-Artificial-Intelligence-and-Machine-Learning-Discussion-Paper.pdf) * [Good Machine Learning Practice for Medical Device Development Guiding Principles](https://www.fda.gov/media/153486/download) * [European Commission - Artificial Intelligence Act (AIA)](https://seclea.atlassian.net/wiki/spaces/SE/pages/631668737) As with any medical device, AI-enabled software is subject to FDA review based on its risk classification. Class I devices—such as software that solely displays readings from a continuous glucose monitor— pose the lowest risk. Class II devices are considered moderate to high risk and may include AI software tools that analyse medical images such as mammograms and flag suspicious findings for a radiologist to review. Most Class II devices undergo what is known as a 510(k) review (named for the relevant section of the Federal Food, Drug, and Cosmetic Act), in which a manufacturer demonstrates that its device is “substantially equivalent” to an existing device on the market with the same intended use and technological characteristics. Alternatively, certain Class I and Class II device manufacturers may submit a De Novo request to FDA, which can be used for devices that are novel but whose safety and underlying technology are well understood and are therefore considered lower risk. Several AI-driven devices are currently on the market—such as IDx-DR, OsteoDetect, and ContaCT. Class III devices pose the highest risk. They include life-supporting, life-sustaining products or are substantially crucial in preventing the impairment of human health. These devices must undergo the full premarket approval process, and developers must submit clinical evidence that the product's benefits outweigh the risks. The continuous glucose monitoring system, Guardian Connect, was approved through a premarket approval. Once a device is on the market, FDA takes a risk-based approach to determine whether it will require a premarket review of any changes the developer makes. Generally, when a manufacturer significantly updates the software or makes other changes that would substantially affect the device’s performance, the device may be subject to additional review by the FDA. However, the process for this evaluation differs depending on the device’s risk classification and the nature of the change. The compliance requirements are taken from Appendix A of [IMDRF/SaMD - SaMD: Application of Quality Management System](https://www.imdrf.org/sites/default/files/docs/imdrf/final/technical/imdrf-tech-151002-samd-qms.pdf), with modifications based on proposed modifications in “[Proposed Regulatory Framework for Modification to AI/ML-Based Software as a Medical Device (SaMD)](https://www.fda.gov/files/medical%20devices/published/US-FDA-Artificial-Intelligence-and-Machine-Learning-Discussion-Paper.pdf)“ and “[European Commission - Artificial Intelligence Act (AIA)](https://seclea.atlassian.net/wiki/spaces/SE/pages/631668737)“. Any future proposals from IMDRF related to AI/ML will require revisiting the template. Seclea Platform template for FDA - AI based SaMD consists of the following compliance categories: * [Data Governance (DG)](https://documentations.seclea.com/fda-ai-based-samd/data-governance-dg) * [Technical Documentation (TD)](https://documentations.seclea.com/fda-ai-based-samd/technical-documentation-td) * [Transparency and Provision of Information to Users (TPI)](https://documentations.seclea.com/fda-ai-based-samd/transparency-and-provision-of-information-to-users-tpi) * [Human Oversight (HO)](https://documentations.seclea.com/fda-ai-based-samd/human-oversight-ho) * [Accuracy, Robustness and Cybersecurity (ARC)](https://documentations.seclea.com/fda-ai-based-samd/accuracy-robustness-and-cybersecurity-arc) * [Managing SaMD Lifecycle Support Process - Record Keeping (RK)](https://documentations.seclea.com/fda-ai-based-samd/managing-samd-lifecycle-support-process-record-keeping-rk) * [Risk Management System (RMS)](https://documentations.seclea.com/fda-ai-based-samd/risk-management-system-rms) * [Quality Management Principles (QMP)](https://documentations.seclea.com/fda-ai-based-samd/quality-management-principles-qmp) * [Post Market Monitoring System (PMS)](https://documentations.seclea.com/fda-ai-based-samd/post-market-monitoring-system-pms) More details on the FDA AI-based SaMD can be found [here](https://documentations.seclea.com/fda-ai-based-samd/). # OECD AI Principles The OECD AI Principles promote innovative and trustworthy AI use that respects human rights and democratic values. Adopted in May 2019, they set standards for AI that are practical and flexible enough to stand the test of time. The template captures the baseline an AI project should meet to conform to the principles set by the OECD AI Principles. According to the OECD website, AI is a general-purpose technology that has the potential to improve the welfare and well-being of people, to contribute to positive sustainable global economic activity, to increase innovation and productivity, and to help respond to key global challenges. It is deployed in many sectors ranging from production, finance and\ transport to healthcare and security. Alongside benefits, AI also raises challenges for our societies and economies, notably regarding economic shifts and inequalities, competition, transitions in the labour market, and implications for\ democracy and human rights. The OECD has undertaken empirical and policy activities on AI in support of the policy debate over the past two years, starting with a Technology Foresight Forum on AI in 2016 and an international\ conference on AI: Intelligent Machines, Smart Policies in 2017. The Organisation also conducted analytical and measurement work that provides an overview of the AI technical landscape, maps economic and social impacts of AI technologies and their applications, identifies major policy considerations, and describes AI initiatives from governments and other stakeholders at national and international levels. This work has demonstrated the need to shape a stable policy environment at the international level to foster trust in and adoption of AI in society. Against this background, the OECD Committee on Digital Economy Policy (CDEP) agreed to develop a draft Council Recommendation to promote a human-centric approach to trustworthy AI, that fosters research, preserves economic incentives to innovate, and applies to all stakeholders. The OECD AI Principles include: 1. [Inclusive growth, sustainable development and well-being ](https://documentations.seclea.com/oecd-ai-principles/1.-inclusive-growth-sustainable-development-and-well-being-isw) 2. [Human-centred values and fairness](https://documentations.seclea.com/oecd-ai-principles/2.-human-centred-values-and-fairness-hvf) 3. [Transparency and Explainability](https://documentations.seclea.com/oecd-ai-principles/3.-transparency-and-explainability-tae) 4. [Accuracy, Robustness and Cybersecurity](https://documentations.seclea.com/oecd-ai-principles/4.-accuracy-robustness-and-cybersecurity-arc) 5. [Accountability](https://documentations.seclea.com/oecd-ai-principles/5.-accountability-acc) You can access the full documentation on the Seclea Platform's OECD AI Principles template [here](https://documentations.seclea.com/oecd-ai-principles/). # Canada Artificial Intelligence and Data Act (AIDA) Canada - AIDA (Artificial Intelligence and Data Act) is focused on Artificial Intelligence, and it was passed as Bill C-27. According to the Department of Justice, Canada: > Part 3 of the *Digital Charter Implementation Act, 2022*, the *Artificial Intelligence and Data Act*, sets out new measures to regulate international and interprovincial trade and commerce in artificial intelligence systems. It would establish common requirements for the design, development, and use of artificial intelligence systems, including measures to mitigate risks of harm and biased output. It would also prohibit specific practices with data and artificial intelligence systems that may result in serious harm to individuals or their interests. Canada - AIDA also states that: > Measures under the *Artificial Intelligence and Data Act* may also implicate rights under section 8. For example, under the *Artificial Intelligence and Data Act*, the Minister responsible may compel the production of certain information from persons subject to the Act for the purpose of verifying compliance with the Act. Regulated persons may also need to provide auditors with records. In addition, the *Artificial Intelligence and Data Act* authorizes the Minister to publish information about artificial intelligence systems posing a serious risk of harm; to order a person to publish information related to their compliance with the Act; and to share information with other government entities specified in the Act. > > The following considerations support the consistency of the Minister’s authorities to collect, disclose, and share information with section 8. Privacy interests are diminished in contexts where government access to business information and records is essential to ensuring compliance with the regulatory obligations a regulated entity must meet. Under the *Artificial Intelligence and Data Act*, the Minister’s powers to gather, compel the production of, or disclose relevant information for regulatory or administrative purposes are consistent with similar powers upheld as reasonable in other regulatory contexts. They are tailored and subject to limits. They authorize access to information that is reasonable and necessary to advance the Act’s important regulatory objectives. In addition, there are restrictions on the uses to which information gathered under the Act may be put and protections for personal and confidential business information. These protections include limits on the circumstances in which personal and confidential business information may be disclosed by the Minister. The regulation of AI under the AIDA mainly focuses on persons carrying out a "regulated activity," which means any of the following in the course of international or interprovincial trade and commerce: 1. processing or making available for use any data relating to human activities to design, develop or use an AI system; or 2. designing, developing or making available for use an AI system or managing its operations. Therefore, any organisation developing or deploying AI systems within Canada's jurisdiction has to comply with AIDA - and, when required, provide documentary proof of their compliance. The degree of regulation of private sector AI systems under the AIDA will depend in part on whether the system falls within the definition of a "high-impact system," with such systems being subject to a higher degree of regulation. As presently drafted, AI systems subject to the AIDA will fall into one of only two categories: high-impact systems and those that are not (meaning AI systems within the scope of the AIDA but do not meet the definition of a high-impact system). It is possible that what constitutes a "high-impact system" will be similar to what the EU defines as a "high-risk" AI system or it may take some of its framework from the Directive. Those responsible for an AI system will be required to assess whether the AI system is a high-impact system. Where an AI system meets this definition, the person responsible must: 1. establish measures to identify, assess and mitigate the risks of harm or biased output that could result from the use of the system; 2. establish measures to monitor compliance with the mitigation measures and the effectiveness of those mitigation measures; 3. where the system is made *available for use*, publish on a public website a plain-language description of the system that explains, among other things, how the system is intended to be used, the types of content that it is intended to generate and the types of decisions, recommendations or predictions it is intended to make, and the risk mitigation measures established; 4. where the person is managing the *operation of the system*, publish on a public website a plain-language description of the system that explains, among other things, how the system is used, the types of content that it generates and the decisions, recommendations or predictions that it makes, and the mitigation measures established; and 5. notify the Minister if use of the system results or is likely to result in material harm. The Minister responsible for administering the AIDA will have considerable powers under the act to promote and ensure compliance. One of the options available to the Minister to ensure compliance is the ability to conduct or direct an audit by a qualified person—at the expense of the person being audited—where the Minister believes there has been a contravention of certain sections of the act. Unlike the existing PIPEDA framework, which has minimal enforcement powers, the potential implications of an audit for those operating AI systems are substantial. The Minister may: 1. require any person responsible for a high-impact system to *cease* using it or making it available for use where the Minister has reasonable grounds to believe that the use of the system gives rise to a serious risk of imminent harm; 2. require the audited person implement *any measure* specified in the order to address anything referred to in an audit report; or 3. require a person to publish on a publicly available website certain information, including audit details, so long as it does not require disclosure confidential business information. Those subject to an order *must* comply with the order. As written, the AIDA creates a variety of Administrative Monetary Penalties. In some cases, these penalties can rise to the greater of $10,000,000 or 3% of the person’s gross global revenues in its previous financial year, or, in the case of an individual, a fine at the discretion of the court. AIDA also creates criminal offences related to: * The possession or use of Personal Information knowing or believing that such information was obtained as a result of the commission of an offence; * Making an Artificial Intelligence system available for use knowing that it is likely to cause serious harm to an individual or their property and the use of the system actually causes such harm; and * Making an Artificial Intelligence system available for use with the intent to defraud the public and to cause substantial economic loss to an individual and it actually causes such loss. The Seclea Platform provides support for managing and tracking compliance with AIDA. The Canada - AIDA compliance template on the Seclea Platform deals with: * [Data Governance (DG) of Anonymized and Non-Anonymized Data](https://documentations.seclea.com/canada-aida/data-governance-dg-of-anonymized-and-non-anonymized-data) * [Record Keeping (RK)](https://documentations.seclea.com/canada-aida/record-keeping-rk) * [Technical Documentation (RT)](https://documentations.seclea.com/canada-aida/technical-documentation-td) * [Transparency and Provision of Information to User (TPI)](https://documentations.seclea.com/canada-aida/transparency-and-provision-of-information-to-user-tpi) * [Risk Management System (RMS)](https://documentations.seclea.com/canada-aida/risk-management-system-rms) * [Quality Management System (QMS)](https://documentations.seclea.com/canada-aida/quality-management-system-qms) * [Post Market Monitoring System (PMS)](https://documentations.seclea.com/canada-aida/post-market-monitoring-system-pms) The full documentation related to the Canada AIDA can be accessed [here](https://documentations.seclea.com/canada-aida/). # South Korean - AI-based Medical Devices (SK-AIMD)
# Saudi Arabia - AI-based Medical Devices (SA-AIMD)
# NIST AI risk management NIST is developing a framework to better manage risks to individuals, organisations, and society associated with artificial intelligence (AI). The NIST AI Risk Management Framework (AI RMF) is for voluntary use. It improves the ability to incorporate trustworthiness considerations into designing, developing, using, and evaluating AI products, services, and systems. NIST has issued the [second draft of the AI RMF](https://www.nist.gov/document/ai-risk-management-framework-2nd-draft), along with a draft [Playbook companion](https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook) to the AI Framework. According to the second draft of the AI RMF: > The AI RMF is intended for voluntary use to address risks in the design, development, use, and evaluation of AI products, services, and systems. AI research and development, as well as the standards landscape, is evolving rapidly. For that reason, the AI RMF and its companion documents will evolve over time and reflect new knowledge, awareness, and practices. NIST intends to continue its engagement with stakeholders to keep the Framework up to date with AI trends and reflect experience based on the use of the AI RMF. Ultimately, the AI RMF will be offered in multiple formats, including online versions, to provide maximum flexibility. > > Part 1 of the AI RMF draft explains the motivation for developing and using the Framework, its audience, and the framing of AI risk and trustworthiness. > > Part 2 includes the AI RMF Core and a description of Profiles and their use. Along with the draft framework, NIST has also provided Playbook. The Playbook provides actions framework users could take to implement the AI RMF by incorporating trustworthiness consideration in the design, development, use and evaluation of AI systems. The NIST AI RMF focuses on trustworthy and responsible AI, which the NIST defines as: > **Trustworthy AI** is valid and reliable, safe, fair and bias is managed, secure and resilient, accountable and transparent, explainable and interpretable, and privacy-enhanced. > > **Responsible** use and practice of **AI** systems is a counterpart to AI system trustworthiness. AI systems are not inherently bad or risky, and it is often the contextual environment that determines whether or not negative impact will occur. The AI Risk Management Framework (AI RMF) can help organizations enhance their understanding of how the contexts in which the AI systems they build and deploy may interact with and affect individuals, groups, and communities. Responsible AI use and practice can: > > * assist AI designers, developers, deployers, evaluators, and users to think more critically about context and potential or unexpected negative and positive impacts; > * be leveraged to design, develop, evaluate, and use AI systems with impact in mind; and > * prevent, preempt, detect, mitigate, and manage AI risks. As per the NIST AI Risk Management Framework, the core attributes of the AI RMF are: > The AI RMF strives to: > > 1. Be risk-based, resource-efficient, pro-innovation, and voluntary. > 2. Be consensus-driven and developed and regularly updated through an open, transparent process. All stakeholders should have the opportunity to contribute to the AI RMF’s development. > 3. Use clear and plain language that is understandable by a broad audience, including senior executives, government officials, non-governmental organization leadership, and those who are not AI professionals – while still of sufficient technical depth to be useful to practitioners. The AI RMF should allow for communication of AI risks across an organization, between organizations, with customers, and to the public at large. > 4. Provide common language and understanding to manage AI risks. The AI RMF should offer taxonomy, terminology, definitions, metrics, and characterizations for AI risk. > 5. Be easily usable and fit well with other aspects of risk management. Use of the Framework should be intuitive and readily adaptable as part of an organization’s broader risk management strategy and processes. It should be consistent or aligned with other approaches to managing AI risks. > 6. Be useful to a wide range of perspectives, sectors, and technology domains. The AI RMF should be universally applicable to any AI technology and to context-specific use cases. > 7. Be outcome-focused and non-prescriptive. The Framework should provide a catalog of outcomes and approaches rather than prescribe one-size-fits-all requirements. > 8. Take advantage of and foster greater awareness of existing standards, guidelines, best practices, methodologies, and tools for managing AI risks – as well as illustrate the need for additional, improved resources. > 9. Be law- and regulation-agnostic. The Framework should support organizations’ abilities to operate under applicable domestic and international legal or regulatory regimes. > 10. Be a living document. The AI RMF should be readily updated as technology, understanding, and approaches to AI trustworthiness and uses of AI change and as stakeholders learn from implementing AI risk management generally and this framework in particular. {% hint style="warning" %} The AI RMF is not a compliance mechanism. It is law- and regulation-agnostic, as AI policy discussions are live and evolving. While risk management practices should incorporate and align with applicable laws and regulations, this framework (NIST AI RMF) is not intended to supersede existing regulations, laws, or other mandates. {% endhint %} The NIST AI Risk Management Framework classify the risk as a composite measure of an event's probability of occurring and the magnitude (or degree of the consequences of the corresponding events. {% hint style="info" %} The impacts, or consequences, of AI systems can be positive, negative, or both and can result in opportunities or threats (Adapted from: ISO 31000:2018). {% endhint %} When taking into account the negative impact of a potential event, the risk is a function of: * the negative impact, or magnitude of harm, that would arise if the circumstance or event occurs and * the likelihood of occurrence (Adapted from: OMB Circular A-130:2016). {% hint style="success" %} Risk Management, refers to coordinated activities to direct and control an organisation concerning risk” (Source: ISO 31000:2018). {% endhint %} **AI Trustworthiness and AI Risks** Trustworthy AI is: valid and reliable, safe and fair, and bias is managed, secure and resilient, accountable and transparent, explainable and interpretable, and privacy-enhanced. Activities that focus on enhancing the AI's trustworthiness also contribute to the reduction of AI risks. These characteristics are inextricably tied to human social and organisational behaviour, the datasets used by AI systems and the decisions made by those who build them, and the interactions with the humans who provide insight from and oversight of such systems. Addressing AI trustworthy characteristics individually will not assure AI system trustworthiness, and tradeoffs are always involved. Trustworthiness is greater than the sum of its parts. According to the NIST AI RMF, all of the AI trustworthiness characteristics are interrelated, if not interdependent. > Trustworthiness characteristics explained in this document are interrelated. Highly secure but unfair systems, accurate but opaque and uninterpretable systems, and inaccurate but secure, privacy-enhanced, and transparent systems are all undesirable. Trustworthy AI systems should achieve a high degree of control over risk while retaining a high level of performance quality. Achieving this difficult goal requires a comprehensive approach to risk management, with tradeoffs among the trustworthiness characteristics. The following table shows the mapping of AI RMF taxonomy to global AI policy documents:
AI RMFOECD AI PrinciplesEU AIAEO 13960
Valid and reliableRobustnessTechnical robustnessPurposeful and performance driven
Accurate, reliable and effective
Regularly mointored
SafeSafetySafetyLawful and respect of our Nation's values
Fair and bias are managedHuman-centred values and fairnessNon-discrimination
Diversity and fairness
Data governance		Secure and resilient
Secure and resilientSecuritySecurity & resilienceTransparent
Accountable
Lawful and respectful of our Nation's values
Responsible and traceable
Regularly monitored
Transparent and accountableTransparency and responsible disclosure
Accountability		Transparency
Accountability
Human agency and oversight		Understandable by subject matter experts, users, and others, as appropriate
Explainable and interpretableExplainabilityUnderstandable by subject matter experts, users and others, as appropriate
Privacy-enhancedHuman values; Respect for human rightsPrivacy
Data governance		Lawful and respectful of our Nation's values
* **Valid and reliable**: Validity and reliability for deployed AI systems is often assessed by ongoing audits or monitoring that confirm a system is performing as intended. Measurement of accuracy, reliability, and robustness contribute to trustworthiness and should consider that certain types of failures can cause greater harm – and risks should be managed to minimise the negative impact of those failures. * **Safe**: AI systems “should not, under defined conditions, cause physical or psychological harm or lead to a state in which human life, health, property, or the environment is endangered” (Source: ISO/IEC TS 5723:2022). Safe operation of AI systems requires responsible design and development practices, clear information to deployers on how to use a system appropriately, and responsible decision-making by deployers and end-users. * **Fair and bias are managed**: NIST has identified three major categories of AI bias to be considered and managed: systemic, computational, and human, all of which can occur in the absence of prejudice, partiality, or discriminatory intent. While bias is not always a negative phenomenon, certain biases exhibited in AI models and systems can perpetuate and amplify negative impacts on individuals, groups, communities, organisations, and society – and at a speed and scale far beyond the traditional discriminatory practices that can result from implicit human or systemic biases. Bias is tightly associated with the concepts of transparency as well as fairness in society. * **Secure and resilient**: AI systems that can withstand adversarial attacks, or more generally, unexpected changes in their environment or use, or to maintain their functions and structure in the face of internal and external change, and to degrade gracefully when this is necessary (Adapted from: ISO/IEC TS 5723:2022) may be said to be resilient. AI systems that can maintain confidentiality, integrity, and availability through protection mechanisms that prevent unauthorised access and use may be said to be secure. * **Transparent and accountable**: Transparency reflects the extent to which information is available to individuals about an AI system, if they are interacting – or even aware that they are interacting – with such a system. Its scope spans from design decisions and training data to model training, the structure of the model, its intended use case, and how and when deployment or end user decisions were made and by whom. Determinations of accountability in the AI context relate to expectations of the responsible party in the event that a risky outcome is realized. The shared responsibility of all AI actors should be considered when seeking to hold actors accountable for the outcomes of AI systems. * **Explainable and interpretable**: Explainability refers to a representation of the mechanisms underlying an algorithm’s operation, whereas interpretability refers to the meaning of AI systems’ output in the context of its designed functional purpose. Together, they assist those operating or overseeing an AI system to do so effectively and responsibly. The underlying assumption is that perceptions of risk stem from a lack of ability to make sense of, or contextualize, system output appropriately. * **Privacy-enhanced**: Privacy refers generally to the norms and practices that help to safeguard human autonomy, identity, and dignity. These norms and practices typically address freedom from intrusion, limiting observation, or individuals’ agency to consent to disclosure or control of facets of their identities (e.g., body, data, reputation). In the NIST AI RMF, the core provides the outcomes and actions related to managing the AI risks. The Core comprises four functions: Map, Measure, Manage and Govern. Each of these high-level functions is broken down into categories and subcategories. The Seclea Risk Management template for NIST AI RMF is structured around these core categories/sub-categories - along with relevant checks and controls (if and when appropriate). * **Govern**: Governance processes are the backbone of risk management and focus on the potential impacts of AI technologies. Govern function outcomes foster a risk management culture within organisations designing, developing, deploying, or acquiring AI systems. Categories in this function interact with each other and other functions but do not necessarily build on prior actions. Note: on Seclea Platform, GOVERN is represented as GRN. * [GOVERN 1: Policies, processes, procedures, and practices across the organisation related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.](https://documentations.seclea.com/nist-ai-risk-management-framework/grn-1-risk-management-documentation) * [GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.](https://documentations.seclea.com/nist-ai-risk-management-framework/grn-2-ai-organisation-structure) * [GOVERN 3: Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.](https://documentations.seclea.com/nist-ai-risk-management-framework/grn-3-ai-internal-stakeholders) * [GOVERN 4: Organizational teams are committed to a culture that considers and communicates risk.](https://documentations.seclea.com/nist-ai-risk-management-framework/grn-4-organisational-commitments) * [GOVERN 5: Processes are in place for robust stakeholder engagement.](https://documentations.seclea.com/nist-ai-risk-management-framework/grn-5-stakeholder-engagement) * [GOVERN 6: Policies and procedures are in place to address AI risks arising from third-party software and data and other supply chain issues.](https://documentations.seclea.com/nist-ai-risk-management-framework/grn-6-managing-3rd-party-risk) * **Map**: The Map function establishes the context to frame risks related to an AI system. The information gathered while carrying out this function enables risk prevention and informs decisions for processes such as model management and an initial decision about the appropriateness or the need for an AI solution. Determination of whether AI use is appropriate or warranted can be considered in comparison to the status quo per a qualitative or quantitative analysis of benefits, costs, and risks. Outcomes in the Map function are the basis for the Measure and Manage functions. Risk management is difficult to perform without contextual knowledge and awareness of risks within the identified contexts. * [MAP 1: Context is established and understood.](https://documentations.seclea.com/nist-ai-risk-management-framework/map-1-ai-application-context) * [MAP 2: Classification of the AI system is performed.](https://documentations.seclea.com/nist-ai-risk-management-framework/map-2-ai-application-classification) * [MAP 3: AI capabilities, targeted usage, goals, and expected benefits and costs compared with the status quo are understood.](https://documentations.seclea.com/nist-ai-risk-management-framework/map-3-ai-benefits-and-costs) * [MAP 4: Risks and benefits are mapped for third-party software and data.](https://documentations.seclea.com/nist-ai-risk-management-framework/map-4-3rd-party-risks-and-benefits) * [MAP 5: Impacts to individuals, groups, communities, organizations, and society are assessed.](https://documentations.seclea.com/nist-ai-risk-management-framework/map-5-ai-impacts) * **Measure**: The Measure function employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts. It uses knowledge relevant to AI risks identified in the Map function and informs the Manage function. AI systems should be tested before their deployment and regularly while in operation. Note: on Seclea Platform, MEASURE is represented as MRE. * [MEASURE 1: Appropriate methods and metrics are identified and applied.](https://documentations.seclea.com/nist-ai-risk-management-framework/mre-1-appropriate-methods-and-metrics) * [MEASURE 2: Systems are evaluated for trustworthy characteristics.](https://documentations.seclea.com/nist-ai-risk-management-framework/mre-2-trustworthy-evaluation) * [MEASURE 3: Mechanisms for tracking identified risks over time are in place.](https://documentations.seclea.com/nist-ai-risk-management-framework/mre-3-risk-tracking-mechanism) * [MEASURE 4: Feedback about efficacy of measurement is gathered and assessed.](https://documentations.seclea.com/nist-ai-risk-management-framework/mre-4-measurement-feedback) * **Manage**: The Manage function entails allocating risk management resources to mapped and measured risks on a regular basis and as defined by the Govern function.Note: on Seclea Platform, MANAGE is represented as MGE. * [MANAGE 1: AI risks based on impact assessments and other analytical output from the Map and Measure functions are prioritized, responded to, and managed. ](https://documentations.seclea.com/nist-ai-risk-management-framework/mge-1-managing-ai-risk) * [MANAGE 2: Strategies to maximize benefits and minimize negative impacts are planned, prepared, implemented, and documented, and informed by stakeholder input. ](https://documentations.seclea.com/nist-ai-risk-management-framework/mge-2-managing-ai-benefits-and-impacts) * [MANAGE 3: Risks from third-party entities are managed. ](https://documentations.seclea.com/nist-ai-risk-management-framework/mge-3-managing-3rd-party-risk) * [MANAGE 4: Responses to identified and measured risks are documented and monitored regularly.](https://documentations.seclea.com/nist-ai-risk-management-framework/mge-4-reporting-risk-management) Subcategories in the NIST AI RMF are mapped to risk categories in the Seclea Risk Management for AI applications. The details of each of Seclea's risk categories with controls and checks are discussed in the rest of this documentation. You can click on the NIST AI RMFor quick reference subcategories of Seclea's risk categories. Full details of the risk management templates on Seclea Platform can be accessed [here](https://documentations.seclea.com/nist-ai-risk-management-framework/). # ISO AI risk management ISO 23894 is an international standard for the risk management of artificial intelligence (AI) systems. The standard was published in November 2020 under "ISO/IEC 23894:2020 - Risk management of AI systems." By providing a framework for risk management, ISO 23894 aims to assist organisations in managing the risks associated with AI systems. The standard offers guidance on the following critical areas: * Risk assessment: This entails the identification and evaluation of potential AI system risks, such as bias, errors, and security vulnerabilities. * Risk treatment: Once hazards have been identified, organisations must determine the most effective course of action to manage them. This could involve mitigating the hazards, transferring them to another party, or accepting them. * Risk communication: Organizations must inform relevant stakeholders, such as consumers, customers, and regulators, of the risks associated with AI systems. * Risk monitoring and review: To ensure that the risk management framework remains effective, organisations must monitor the performance of AI systems and conduct regular reviews of the risk management framework. Principal advantages of implementing ISO 23894 include: * Enhanced risk management: The standard provides a comprehensive framework for managing the risks associated with AI systems, allowing organisations to identify and mitigate potential risks more effectively. * Increased transparency: By communicating to stakeholders the risks associated with AI systems, organisations can increase transparency and establish trust with customers, regulators, and other stakeholders. * Compliance with regulatory requirements: Implementing ISO 23894 can assist organisations in meeting regulatory requirements for AI risk management. * Better decision-making: Enhanced decision-making: Organizations can make more informed decisions regarding the use and deployment of AI systems if they comprehensively comprehend the associated risks. Overall, ISO 23894 provides organisations with a valuable framework for managing the risks associated with AI systems, thereby facilitating these technologies' safe and efficient application. The Seclea Risk Management template for ISO AI Risk Management (ISO 23894) is structured around these core categories/sub-categories - along with relevant checks and controls (if and when appropriate). * [General Risk (GER)](https://documentations.seclea.com/iso-ai-risk-management/general-risk-ger) * [AI Accountability (ACC)](https://documentations.seclea.com/iso-ai-risk-management/ai-accountability-acc) * [AI Expertise (AIE)](https://documentations.seclea.com/iso-ai-risk-management/ai-expertise-aie) * [Training and Test Dataset (TTD)](https://documentations.seclea.com/iso-ai-risk-management/training-and-test-dataset-ttd) * [Environmental Impact (ENI)](https://documentations.seclea.com/iso-ai-risk-management/environmental-impact-eni) * [AI Fairness (AIF)](https://documentations.seclea.com/iso-ai-risk-management/ai-fairness-aif) * [AI Maintainability (AIM)](https://documentations.seclea.com/iso-ai-risk-management/ai-maintainability-aim) * [AI Privacy (AIP)](https://documentations.seclea.com/iso-ai-risk-management/ai-privacy-aip) * [AI Robustness (AIR)](https://documentations.seclea.com/iso-ai-risk-management/ai-robustness-air) * [AI Safety (AIS)](https://documentations.seclea.com/iso-ai-risk-management/ai-safety-ais) * [AI Security (ASE)](https://documentations.seclea.com/iso-ai-risk-management/ai-security-ase) * [AI Transparency and Explainability (ATE)](https://documentations.seclea.com/iso-ai-risk-management/ai-transparency-and-explainability-ate) More details on ISO risk management can be found [here](https://documentations.seclea.com/iso-ai-risk-management/). # FDA AI based SaMD Risk Management In the United States, the FDA (Food and Drug Administration) regulates medical devices, including software as a medical device (SaMD). Software-as-a-Medical-Device (SaMD) is defined as software intended for one or more medical purposes that perform these functions independently of a hardware medical device. Regarding AI-based SaMD, the FDA has established risk management guidelines. The guidelines are intended to ensure the safety and efficacy of AI-based SaMD and provide a framework for product designers and testers. The FDA's risk management approach involves identifying and evaluating potential hazards associated with AI-based SaMD. This includes evaluating the algorithm's accuracy, its performance under various conditions, and the potential impact of output errors or inaccuracies. Additionally, developers must implement measures to mitigate any identified hazards. The FDA recommends a process of continuous monitoring to ensure that the SaMD continues to function as intended and that any new hazards are promptly identified and addressed. This includes continuous testing and evaluation of the SaMD and monitoring user and medical professional feedback. In conclusion, the FDA's AI-based SaMD risk management guidelines emphasise the significance of identifying and mitigating potential risks associated with AI-based SaMD and implementing a continuous monitoring process to ensure ongoing safety and efficacy. By adhering to these guidelines, developers can ensure that their AI-based SaMD products comply with FDA regulations and provide patients with safe and effective medical solutions. The FDA Guidance on what to submit with a 510(k) titled, *Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices* includes the following: * [Level of Concern Document](https://documentations.seclea.com/fda-ai-based-samd-risk-management/level-of-concern-document-lcd) * [Software Description](https://documentations.seclea.com/fda-ai-based-samd-risk-management/software-description-sde) * [AI Expertise (AIE)](https://documentations.seclea.com/fda-ai-based-samd-risk-management/ai-expertise-aie) * [Device Hazard Analysis](https://documentations.seclea.com/fda-ai-based-samd-risk-management/device-hazard-analysis-dha) * [Software Requirement Specifications (SRS)](https://documentations.seclea.com/fda-ai-based-samd-risk-management/software-requirement-specifications-srs) * [Training and Test Dataset (TTD)](https://documentations.seclea.com/fda-ai-based-samd-risk-management/training-and-test-dataset-ttd) * [Software Design Specifications (SDS)](https://documentations.seclea.com/fda-ai-based-samd-risk-management/software-design-specifications-sds) * [AI Fairness (AIF)](https://documentations.seclea.com/fda-ai-based-samd-risk-management/ai-fairness-aif) * [AI Transparency and Explainability (ATE)](https://documentations.seclea.com/fda-ai-based-samd-risk-management/ai-transparency-and-explainability-ate) * [Traceability Analysis](https://documentations.seclea.com/fda-ai-based-samd-risk-management/traceability-analysis-tra) * [Verification and Validation (V\&V) Documentation](https://documentations.seclea.com/fda-ai-based-samd-risk-management/verification-and-validation-vav) * [Revision Level History](https://documentations.seclea.com/fda-ai-based-samd-risk-management/revision-level-history-rlh) More details on FDA AI based SaMD Risk Management can be found [here](https://documentations.seclea.com/fda-ai-based-samd-risk-management/). # Reporting Bugs The Seclea platform strives to provide a seamless and efficient experience for its users, and we understand that bugs and issues may arise during usage. That's why we have provided an in-platform feedback option to report any bugs, issues or suggestions to improve our platform. By clicking on the feedback option in the platform, you can easily report any problems or share suggestions for improvements. Our team of experts will promptly respond and address the issue to ensure that the platform runs smoothly and efficiently. We value your feedback, and we believe that it will help us to enhance the Seclea platform and provide you with an outstanding user experience. # Error Catalog The Seclea Error Catalog is a comprehensive repository of errors that users may encounter while working with the Seclea Platform. It provides a centralised location to record, track, and manage issues, allowing for efficient communication and collaboration between users and the Seclea support team. The Error Catalog is regularly updated with new errors and solutions to ensure that users have access to the latest information. With this resource, users can quickly and easily identify and resolve issues, improving their overall experience with the Seclea Platform.