Disengage or deactivate the system

The requirement, in our words

Put in place and apply mechanisms, with assigned and understood responsibilities, to supersede, disengage or deactivate a system that performs inconsistently with its intended use, and test that the mechanism works.

What it means for human oversight

The stop is the last resort of oversight. The mechanism must exist technically, be assigned to a role with the authority to use it, and have been demonstrated.

How to evidence it

Attach the artefacts above to the Disengage or deactivate the system row with the system name, the owner and the date. The first one is the anchor: The technical mechanism to supersede, disengage or deactivate. The OH-47 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for The assigned role and evidence it understands the duty. If that artefact for OH-47 cannot be produced, the row is a gap, whatever the policy says.

OH-47 carries 3 evidence items and 3 common gaps. For disengage or deactivate the system, test the control on a live system at production volume, since a version that works only in a pilot has not yet been shown to work. The OH-47 statement above is ours, written from NIST AI RMF 1.0, MN-2.4, not a reproduction of the licensed text.

Common gaps

• Kill switch assumed to exist but never tested
• Deactivation needs a release cycle
• Authority held by someone with a competing delivery incentive

Related units

• AI risk assessment
• Operational planning and control
• Context and the role you play