{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"AI Governance","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-17","description":"Publish and maintain customer-facing policies for AI services that state how customer inputs are used for model training and inference, how long inputs and outputs are retained, who owns and may use generated outputs, and how customers can opt in or out, request deletion, or exercise other data rights. Communicate the policies before onboarding, version them, and retain customer acknowledgements and periodic review records as evidence.","details":{"control_category":"administrative","control_type":"preventive","domain":"AI Governance","guidance":[],"members":[{"control_id":"A001","coverage":"full","framework":"aiuc-1","relationship":"superset_of"},{"control_id":"A002","coverage":"full","framework":"aiuc-1","relationship":"superset_of"}],"statement":"Publish and maintain customer-facing policies for AI services that state how customer inputs are used for model training and inference, how long inputs and outputs are retained, who owns and may use generated outputs, and how customers can opt in or out, request deletion, or exercise other data rights. Communicate the policies before onboarding, version them, and retain customer acknowledgements and periodic review records as evidence.","title":"Define customer data-use and output-rights policies for AI services","unified_id":"UC-AI-17"},"id":"uc:UC-AI-17","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-17","sourceIds":["aiuc-1"],"sourceUrl":null,"title":"UC-AI-17 — Define customer data-use and output-rights policies for AI services","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:293c31975b4156ae704bb43345019929fc29556808a2eea712077d842d30c3ed","properties":{"control_id":"A002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","sourceId":"uc:UC-AI-17","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a002-1cad7f1d.json","targetId":"ctrl:aiuc-1:A002","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:42fc495ceafeb9fe0981d70396cc5adef709d767e5063e137704d2b82e254f00","properties":{"rationale":"Customer-facing input and output data policies (training use, retention, ownership, opt-out, deletion) are the notice-and-consent backbone of a privacy program for AI services.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","sourceId":"uc:UC-AI-17","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c3ce8677537179c10d2c669f0a25c9a3df258809ff6ac1143364dbe657a29d1","properties":{"rationale":"Clear ownership and usage terms for outputs pre-empt the liability disputes that arise when rights to generated content are undefined.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","sourceId":"uc:UC-AI-17","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6d82ad1149ccf222a896df54517800e494b50e8ecae50c3d8ed81945a1b1a668","properties":{"rationale":"Declared training-use and retention limits reduce the volume of customer data an AI system can later leak, but the operative defenses are the output and isolation controls.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","sourceId":"uc:UC-AI-17","targetDetailPath":"/data/v1/records/risk-ai-privacy-leakage-9aa8d83c.json","targetId":"risk:ai-privacy-leakage","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6f774f7cd777256df0e1295b5cead55fd3c8ba3f05dd2c985513f47e770d3502","properties":{"rationale":"Published data-use and output-rights terms are part of the transparency customers rely on to understand how the AI service treats their data.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","sourceId":"uc:UC-AI-17","targetDetailPath":"/data/v1/records/risk-ai-lack-explainability-transparency-edbd29e2.json","targetId":"risk:ai-lack-explainability-transparency","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9319569ffe9ba47ddf14ea107d9a4cdfacc2717c4f9186e20578122fdaa3ea64","properties":{},"sourceDetailPath":"/data/v1/records/wf-g35-088a9083.json","sourceId":"wf:G35","targetDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","targetId":"uc:UC-AI-17","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ed6055e345e89117b3a987498744584de023ad64a77ec1210e5a9cb035b10000","properties":{"control_id":"A001","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","sourceId":"uc:UC-AI-17","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a001-a1b59a6f.json","targetId":"ctrl:aiuc-1:A001","type":"maps_to"}],"schemaVersion":1}