ASEAN Working Group on AI Governance

Risk and scope 2 of 4

• Risk classification 1 control
• Prohibited practices, not covered
• Risk management system 1 control
• Impact assessment, not covered

Data and privacy 1 of 4

• Data governance and quality 2 controls
• Data subject rights and consent, not covered
• Cross-border data transfer, not covered
• Copyright and training data, not covered

Transparency and records 1 of 4

• Transparency and disclosure to users 2 controls
• Labelling of synthetic content, not covered
• Technical documentation, not covered
• Record keeping and logging, not covered

Technical safeguards 1 of 4

• Human oversight, not covered
• Accuracy, robustness and cybersecurity 1 control
• Bias and non-discrimination, not covered
• Testing and evaluation, not covered

Assurance and lifecycle 0 of 4

• Conformity assessment and certification, not covered
• Registration and notification, not covered
• Incident and breach reporting, not covered
• Post-market monitoring and corrective action, not covered

Rights and protected groups 0 of 4

• Automated decision-making rights, not covered
• Children and vulnerable groups, not covered
• Biometric identification and surveillance, not covered
• Whistleblowing, complaints and redress, not covered

Roles and organisation 3 of 6

• Supply chain and provider-deployer duties, not covered
• General purpose and foundation models 1 control
• Accountability and governance roles 4 controls
• Training and AI literacy 1 control
• Public sector use and procurement, not covered
• Innovation support and sandboxes, not covered

Enforcement and sectors 0 of 5

• Enforcement, penalties and regulators, not covered
• Sector rules: health, not covered
• Sector rules: finance and insurance, not covered
• Sector rules: employment, not covered
• Sector rules: education, not covered