Control #
C
2
.
1
Define AI training policy for customer data
Create an internal policy that governs whether and how customer data can be used for model training. The policy should default to exclusion unless customers have clearly consented.
Evidence
We'll list specific evidence that demonstrates compliance with this control. Typically, this is screenshots, proof of a legal or operational policy, or product demonstrations.
Recommended actions
We'll recommend specific practices and actions for complying with this control.