7.1 Clear ownership and lifecycle accountability
Every AI system shall have an identified organizational owner responsible for its purpose, approval, operation, monitoring, material changes and withdrawal. Responsibilities among management, professional users, technical teams, data owners and providers shall be explicit.
7.2 Impact and risk assessment by design
Before deployment and after any material change, the responsible organization shall assess the intended benefit, affected persons, impacts on rights and equality, data limitations, safety and security, organizational dependencies, and available safeguards. The assessment and its findings shall shape design and procurement from the outset, and serious unresolved risks shall prevent or restrict use.
7.3 Effective remedy and redress
A person harmed or materially disadvantaged by an AI-assisted process shall have access to a timely and effective remedy, including explanation, contestation, human reconsideration, correction, restoration and compensation where appropriate. Redress shall address both the individual outcome and any underlying defect that may affect others.
7.4 Institutional and individual accountability for AI-assisted decisions
An organization remains accountable for the AI systems it develops, procures, integrates or uses, including their outputs and consequences. Where an AI output informs a particular decision, the person who makes or adopts that decision remains responsible for independently evaluating the output and for the final decision, and shall have the information, competence and authority necessary to do so. Neither the organization nor the decision-maker may avoid responsibility by attributing the outcome to the AI system, a vendor, supplier, developer or other third party.