How could this system harm people’s privacy — and have we checked before launch?
Baseline: 1Enhanced: 23 controls
Who it applies to
Enter for every AI system. Some of its controls apply only where it processes personal data (B4). Go as deep as your system letter, and implement in your mode.
Why it exists
Run a structured privacy check before an AI system goes live, not after it has processed a million records. Such a check — a written assessment, done in advance, of how a system affects the privacy of the people whose data it uses — is a familiar instrument, but AI changes what it must examine. A model can expose information nobody deliberately stored in it: it can be induced to reveal fragments of its training data, it can infer sensitive facts about a person that were never provided, and it can leak one person’s information into an answer given to another. Assess these AI-specific pathways, not only the classical question of who can see the database.
What to actually do
Do the assessment before deployment, and make it a gate for higher-risk systems. Complete the privacy assessment as a condition of the go-live decision from the Governance lifecycle, not as documentation produced afterwards to satisfy an auditor. For systems that make or support decisions about people, treat a completed assessment as mandatory before launch.
Examine the pathways only AI creates. Ask specifically: can the system be made to reveal parts of the data it learned from? Can it infer sensitive attributes — health, beliefs, relationships — that were never entered? Can one user’s data surface in another user’s answer? These are the questions a database-era assessment never had to ask, and they are where AI privacy failures now occur.
Reassess when the system materially changes. A new model version, a new data source, or a new use can change the privacy picture entirely. Tie reassessment to those events — including the provider’s model change you now get warned about — rather than to a fixed annual date.
Controls
Baseline1 controls
Control 150
Complete a privacy impact assessment before deploying any AI that processes personal data.
A gate for systems that decide about people; documentation-after-launch is not acceptable.
How to implement it · Minimum structure
Description: purpose, personal data categories, people affected, provider involved
Necessity: why each data category is needed and what could be removed
Risks to individuals: exposure, misuse, wrong decisions about them, data reaching the provider
Measures: minimisation, access limits, retention, human review
Residual risk and decision: go, go with conditions, or no-go, signed by the system owner
Systems that decide about people: completed and approved before go-live, with no exceptions
How to start
Prepare a short template with these sections, complete it with the system owner, and make the go-live decision reference the signed assessment.
Evidence
The signed assessment, dated before go-live and referenced in the go-live decision.
Mode: light / standard / full
light
The owner-manager completes a two-page template with whoever set up the tool, using the provider's documentation.
standard
The system owner drafts it and the privacy lead reviews and signs it before go-live.
full
The privacy function runs it in a workflow that blocks deployment until the assessment is approved.
Enhanced2 controls
Control 151
Assess the AI-specific exposure pathways explicitly.
EnhancedPreventiveall rolesper system
What it is
Training-data leakage, sensitive inference, and cross-user leakage — not only access to the store.
How to implement it · Steps
Training-data leakage: try to make the system repeat records, names or passages it was trained or adapted on
Sensitive inference: check whether it infers health, beliefs, relationships or other sensitive facts never supplied
Cross-user leakage: check whether one user's data, history or documents can appear in another user's answer
Retrieval permissions: confirm it only consults documents the asking user is allowed to see
Per pathway, record the test, the result, the measure adopted and the residual risk
How to start
Add the pathways as a section of the assessment template and, for the next system going live, run a few probing prompts per pathway and record the answers.
Evidence
The AI-pathway section of each assessment, with the probes used and their results.
Mode: light / standard / full
light
Whoever set up the tool runs the probes, relying on the provider's statements for untestable training data.
standard
The system owner and privacy lead run a scripted set of probes per pathway before go-live.
full
A security testing team runs a maintained probe library and the privacy function signs off the findings.
Control 152
Reassess on material change.
EnhancedPreventiveall rolesper system
What it is
Model change, new data source, or new purpose triggers a fresh assessment.
How to implement it · Steps
Triggers: new model or model version (including provider changes notified to you), new data source, new purpose or user group
Routing: change requests and provider change notices reach the assessment owner
Screening: decide promptly, before the change goes live, whether it alters the privacy picture
Reassessment: update the affected sections, AI-specific pathways included, before the change goes live
Minor changes: record the decision not to reassess and the reason
How to start
Write the trigger list into the change procedure and route the provider's model-change notices to whoever owns the assessment.
Evidence
The change log showing each trigger and the resulting reassessment or recorded decision not to reassess.
Mode: light / standard / full
light
The person responsible checks the trigger list whenever the provider announces a change or the tool is put to a new use.
standard
The change-approval step includes a privacy screening question owned by the privacy lead.
full
The change-management workflow opens a reassessment task automatically for any change tagged with a trigger.
Evidence
The completed assessments tied to go-live decisions; the record of AI-specific pathways examined; reassessment records against change events.