Responsible AI Toolkit IconHome
Overview of RAI Activities Throughout the Product Life Cycle

Appendix 5. Responsibility Flows Questionnaire

Stakeholder Engagement and Communication

  1. Who is responsible for tracking stakeholder concerns and communicating how any changes in the system or its operational context may affect them?
  2. What is the process for flagging concerns or incidents and who is responsible for triaging these?

Impacts Tracking and Assessment

  1. Who is responsible for tracking progress on the Statements of Concern?
  2. Who is responsible for continuous harms monitoring and evaluation?
  3. Who is responsible for evaluating tradeoffs?

System Misuse and Robustness

  1. Have you created a plan to prevent the intentional or unintentional manipulation of data or model outputs and identified who is responsible for implementing this plan?
  2. Who is testing how the system can be misused (unintentionally or intentionally) in ways that result in harm or impediments to mission success?
  3. Who is monitoring for system misuse?
  4. Who is testing the system for possible adversarial attacks?
  5. Who is monitoring the threat landscape and providing mitigations?

Stack Monitoring

  1. Who is responsible for assessing and monitoring the integrity of the hardware?
  2. Who is responsible for assessing and monitoring the integrity of the infrastructure and architecture?
  3. Who is responsible for monitoring degradation in the abilities of the operational users?
  4. Who has access to the data?
  5. Who has access to the models?
  6. Who is responsible for managing access controls/permissions?
  7. Who is responsible for assessing and monitoring the integrity of the data/models?
  8. Who has root access and how are permissions for root access managed?

System Monitoring and Auditing

  1. Have you defined procedures and reporting processes for system performance and post deployment monitoring, and identified who is responsible for implementing these procedures? Define these standard operating procedures:
    1. System performance
    2. Post-deployment monitoring
    3. Reporting and addressing undesirable system behavior
  2. Have you defined and assigned roles/positions for government and /or third-party system audits? Explain your approach.

Deployment Context Monitoring

  1. Who on your team is tracking changes to deployment context over time?

Error and Incident Response

  1. What is the process for reacting when error modes are discovered? Who is involved in addressing errors?
  2. What are your rollback procedures? Who makes the decision (and in the event it’s an edge case)?
  3. Who decides when to deactivate the system?
  4. What types of situations will drive your team to downversion? Who makes that decision?
  5. What types of situations will drive your team to eclipse the system? Who makes that decision?

System Changes

  1. What is the process for deciding when to retrain or upversion a model and who is responsible for that decision?
  2. Is there a specific person (or role) designated to make, track, monitor, and certify changes to the system while in development?
  3. Does that person (or role) have the requisite authority to assess changes, and, if necessary, authorize and execute corrective actions when needed?
  4. Does that person (or role) have full visibility (administrator privileges) on the system inputs, outputs, and evaluation metrics used to track and monitor the system during development?
  5. Has that person (or role) developed procedures that ensure system continuity if they are replaced?
  6. Who is responsible for monitoring emerging capabilities that could augment and improve the system?
  7. What is the process for deciding when to sunset a system, and who is responsible for that decision?

Verifying System Outputs

  1. Have you developed an appropriate plan/interface to verify individual outputs of the system? Explain your plan.

Accountability Flows for Use

  1. Have accountability flows for operational commanders and operational users been established?