The Deployer Baseline
An open, fifteen-control baseline for organizations that use AI, written as a NIST AI RMF profile for deployers and crosswalked to ISO/IEC 42001, the EU AI Act, and US state laws. Version 0.1, open for public comment. Licensed CC BY 4.0.
Maturity scale
Not in place
Nothing documented or practiced.
Informal
Practiced by some people some of the time; nothing written or assigned.
Defined
Written, assigned to an owner, practiced consistently, with records.
Managed
Measured, reviewed on a schedule, improved, and able to show evidence to a third party on request.
Controls
Accountability and governance structure
A named executive owns AI governance; roles and a decision forum exist; the board or equivalent is briefed.
Level 2 looks like: A named executive owns AI governance under a written charter, a decision forum meets, and minutes exist.
Crosswalk: ISO/IEC 42001: Clause 5; A.2; A.3 · NIST AI RMF: Govern · EU AI Act: Art. 4; Art. 26 · US: TRAIGA safe harbor · Other: Thai draft deployer duties
AI inventory
Every AI system in use is listed with owner, purpose, data, people affected, and risk tier, including vendor, embedded, and unapproved tools.
Level 2 looks like: A maintained register lists every AI system with owner, purpose, data, people affected, and risk tier, updated at least quarterly.
Crosswalk: ISO/IEC 42001: A.4; A.6.2.7 · NIST AI RMF: Map · EU AI Act: Art. 26; Art. 50 · US: Colorado SB 26-189 · Other: Korea operator duties
Acceptable use and AI literacy
People know what they may and may not do with AI, and have training suited to their role.
Level 2 looks like: A published acceptable use policy and role-based training exist, with completion records.
Crosswalk: ISO/IEC 42001: Clause 7.2, 7.3; A.4.6 · NIST AI RMF: Govern · EU AI Act: Art. 4 · Other: Thai draft oversight-staff duty
Use-case screening and risk classification
New and changed AI uses are screened before deployment for prohibited uses, risk tier, and applicable law.
Level 2 looks like: Every new or changed AI use passes a written screening step that checks prohibited uses, assigns a risk tier, and records applicable law.
Crosswalk: ISO/IEC 42001: Clause 6.1; A.5 · NIST AI RMF: Map; Govern · EU AI Act: Art. 5; Art. 6; Annex III · US: TRAIGA prohibited uses; Colorado high-risk definition; NYC LL144
Third-party and vendor AI management
Vendor AI is reviewed for data handling, model changes, subprocessors, and contract terms before and during use.
Level 2 looks like: A vendor AI review checklist, contract clauses, and a review record exist for each vendor AI product.
Crosswalk: ISO/IEC 42001: A.10 · NIST AI RMF: Govern 6; Map 4 · EU AI Act: Art. 25; Art. 26 · Other: HAIP 2.0 deployer questions
Data governance for AI use
What data goes into AI systems is known and controlled, including personal data, confidential data, and retention.
Level 2 looks like: Written data rules for AI use exist, a DPIA trigger is defined, and approvals are recorded.
Crosswalk: ISO/IEC 42001: A.7 · NIST AI RMF: Map; Measure · EU AI Act: GDPR; Art. 26 · US: CPPA ADMT rules · Other: Korea
Human oversight of consequential decisions
Where AI informs decisions about people's jobs, credit, housing, insurance, health, or education, a competent human can understand, override, and is accountable.
Level 2 looks like: Named reviewers with documented override authority oversee each consequential use, and decisions are sampled periodically.
Crosswalk: ISO/IEC 42001: A.9; A.6.2.6 · NIST AI RMF: Manage · EU AI Act: Art. 14; Art. 26(2) · US: Colorado; Illinois HB 3773; NYC LL144; CPPA ADMT; TRAIGA
Transparency to people
People are told when they interact with AI, when AI materially affects a decision about them, and when content is AI-generated.
Level 2 looks like: Disclosure notices are in place for chatbots and decisions, and a labelling practice exists for synthetic content.
Crosswalk: ISO/IEC 42001: A.8 · NIST AI RMF: Govern; Map · EU AI Act: Art. 50 · US: California bot and transparency laws; TRAIGA government disclosure; Colorado · Other: Korea labelling
Monitoring, logging, and performance review
AI systems in use are monitored for quality, drift, misuse, and complaints, with logs kept for a defined period.
Level 2 looks like: Each system has a monitoring owner, a review cadence, and logs retained to the longest applicable rule.
Crosswalk: ISO/IEC 42001: A.6.2.6; A.6.2.8 · NIST AI RMF: Measure; Manage · EU AI Act: Art. 26(5), (6); Art. 12 · Other: Thai draft six-month logs
Incident management and reporting
AI incidents are defined, reported internally, remediated, and reported externally where the law requires.
Level 2 looks like: An incident procedure covers AI, a log exists, and the external reporting map (regulators, affected people, vendors) is written.
Crosswalk: ISO/IEC 42001: A.8.4 · NIST AI RMF: Manage · EU AI Act: Art. 73; Art. 26(5) · US: TRAIGA cure process · Other: Insurer remediation record
Security of AI systems
AI systems and their data are protected against unauthorized access, prompt injection, data leakage, and misuse.
Level 2 looks like: AI-specific security requirements are in the security program and customer-facing systems are tested.
Crosswalk: ISO/IEC 42001: A.6.2.4; ISO 27001 controls · NIST AI RMF: Cyber AI Profile · EU AI Act: Art. 15; Art. 26 · Other: OWASP LLM Top 10; CSA AICM
Fairness and impact assessment for higher-risk uses
Higher-risk uses get an impact assessment including bias testing before deployment and periodically after.
Level 2 looks like: Completed impact assessments, including bias testing, are on file for each higher-risk system with findings and actions.
Crosswalk: ISO/IEC 42001: A.5; ISO 42005 · NIST AI RMF: Map 5; Measure 2 · EU AI Act: Art. 27; Annex III · US: NYC LL144; Colorado; Illinois
Records and evidence
The organization can show what it did, when, and why, to an auditor, regulator, customer, or insurer.
Level 2 looks like: An evidence practice with owners and retention keeps documentation for each system, control, and obligation.
Crosswalk: ISO/IEC 42001: Clause 7.5; A.6.2.7 · NIST AI RMF: Govern · EU AI Act: Art. 26; Art. 12 · US: AB 1405 record expectations · Other: Insurer documentation requests
Periodic review and improvement
Governance is reviewed at least annually against changes in law, use, and incidents, and improved.
Level 2 looks like: A management review of AI governance happens at least annually with a record and an improvement log.
Crosswalk: ISO/IEC 42001: Clauses 9, 10 · NIST AI RMF: Govern 1.5; Manage · Other: HAIP annual update
Synthetic content provenance
If the organization publishes AI-generated or AI-edited media, it labels it, preserves provenance where feasible, and verifies inbound media where it matters.
Level 2 looks like: A labelling and provenance procedure exists, Content Credentials are kept in the publishing chain, and high-stakes inbound media is verified.
Crosswalk: EU AI Act: Art. 50(4); transparency Code · US: California AI Transparency Act (providers); platform duties · Other: Korea and China labelling; C2PA; India IT Rules
Scope
Organizations that use AI systems (vendor products, embedded features, agents, internal builds) in their operations, whether or not they also build AI.
Overall levels
Initial (under 1.0), Developing (1.0 to 2.0), Defined (2.0 to 2.7), Managed (2.7 to 3.0). The attestation shows the overall level and date; per-control levels are optional.
Governance
Maintained by the Baseline working group with a published change log, a 60-day comment period per version, and a conflict-of-interest policy. Synthetic Labs operates the Commons and discloses its role.
Status
v0.1: comment period.