Establish output data policy

Establish AI output ownership, usage, opt-out and deletion policies to customers and communicate these policies

Keywords

Data Ownership

Usage

Deletion

Consent

Opt-Out

Application

Mandatory

Frequency

Every 12 months

Type

Preventative

Crosswalks

DSP-16: Data Retention and Deletion

DSP-08: Data Privacy by Design and Default

STA-10: Primary Service and Contractual Agreement

Control activities

Typical evidence

Establishing output ownership and usage rights policies. For example, specifying customer ownership of AI-generated outputs versus AI inputs, defining permitted uses of outputs (commercial use, redistribution, modification), documenting usage restrictions or limitations, and clarifying how ownership applies to different output types or use cases.

Disclosing opt-out and deletion procedures for AI outputs. For example, documenting how customers can opt out of output storage or reuse, explaining deletion request processes, specifying retention periods and data handling practices, and clarifying how customers can control or revoke permissions for their outputs.

A002.1 Documentation: Output usage and ownership policy

Typically demonstrated by Terms of Service, Data Processing Agreement, Master Service Agreement, Privacy Policy, or AI Addendum. May be a combination of these policies.

AIUC-1 is built with industry leaders

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Phil Venables

Former CISO of Google Cloud

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."