C1 — Product & Solution Documentation
Please provide materials that help us understand what your product does, how AI is used, and who the product is intended to serve. Your evidence should, where applicable, explain: the purpose of the product or solution; the problem it is designed to address; its primary users or beneficiaries; the countries or markets where it is used; the main AI-enabled functions; whether AI models are developed internally or provided by third parties; whether the product makes or supports decisions that may affect individuals.
c1-1 — Purpose of the product or solution
0 = no evidence at all, 10 = fully met, backed by hard evidence
c1-2 — The problem it is designed to address
0 = no evidence at all, 10 = fully met, backed by hard evidence
c1-3 — Its primary users or beneficiaries
0 = no evidence at all, 10 = fully met, backed by hard evidence
c1-4 — The countries or markets where it is used
0 = no evidence at all, 10 = fully met, backed by hard evidence
c1-5 — The main AI-enabled functions
0 = no evidence at all, 10 = fully met, backed by hard evidence
c1-6 — Whether AI models are developed internally or provided by third parties
0 = no evidence at all, 10 = fully met, backed by hard evidence
c1-7 — Whether the product makes or supports decisions that may affect individuals
0 = no evidence at all, 10 = fully met, backed by hard evidence
C2 — Technical Architecture & Data Flow
Please provide evidence showing how the product operates technically and how data moves through the system. Where possible, provide a simple system architecture or data-flow diagram, for example: User -> Application -> Cloud Infrastructure -> AI Model/API -> Database -> Analytics. Your evidence should help identify: where data originates; what types of data are processed; which systems process the data; which AI models or APIs receive data; where data is stored; relevant cloud or hosting regions; who can access the data; whether data is transferred across national borders; major external system integrations.
c2-1 — Where data originates
0 = no evidence at all, 10 = fully met, backed by hard evidence
c2-2 — What types of data are processed
0 = no evidence at all, 10 = fully met, backed by hard evidence
c2-3 — Which systems process the data
0 = no evidence at all, 10 = fully met, backed by hard evidence
c2-4 — Which AI models or APIs receive data
0 = no evidence at all, 10 = fully met, backed by hard evidence
c2-5 — Where data is stored, and relevant cloud/hosting regions
0 = no evidence at all, 10 = fully met, backed by hard evidence
c2-6 — Who can access the data
0 = no evidence at all, 10 = fully met, backed by hard evidence
c2-7 — Whether data is transferred across national borders
0 = no evidence at all, 10 = fully met, backed by hard evidence
c2-8 — Major external system integrations
0 = no evidence at all, 10 = fully met, backed by hard evidence
C3 — Privacy & Data Governance
Please provide evidence demonstrating how data is collected, used, accessed, retained, transferred and deleted in connection with the product. Your evidence should, where applicable, address: what personal or organizational data is collected; why the data is collected; the legal or consent basis for collection; who can access the data; where the data is stored and processed; how long the data is retained; how users can request correction or deletion; whether data is transferred internationally; whether customer or user data is used for AI training, fine-tuning or model improvement.
c3-1 — What personal or organizational data is collected, and why
0 = no evidence at all, 10 = fully met, backed by hard evidence
c3-2 — The legal or consent basis for collection
0 = no evidence at all, 10 = fully met, backed by hard evidence
c3-3 — Who can access the data, and where it is stored/processed
0 = no evidence at all, 10 = fully met, backed by hard evidence
c3-4 — How long the data is retained
0 = no evidence at all, 10 = fully met, backed by hard evidence
c3-5 — How users can request correction or deletion
0 = no evidence at all, 10 = fully met, backed by hard evidence
c3-6 — Whether data is transferred internationally
0 = no evidence at all, 10 = fully met, backed by hard evidence
c3-7 — Whether user data is used for AI training, fine-tuning or model improvement
0 = no evidence at all, 10 = fully met, backed by hard evidence
C4 — Security & Access Control
Please provide evidence demonstrating the security controls used to protect the product, systems and data. Your evidence should, where applicable, explain: who can access production systems; how access permissions are granted; how privileged access is controlled; whether multi-factor authentication (MFA) is used; how access is removed when employees or contractors leave; how sensitive information is protected; how security incidents are identified and handled; whether security testing is conducted. External security certification is not mandatory — FAIR assesses whether reasonable security controls exist and are implemented in practice.
c4-1 — Who can access production systems, and how permissions are granted
0 = no evidence at all, 10 = fully met, backed by hard evidence
c4-2 — How privileged access is controlled, and whether MFA is used
0 = no evidence at all, 10 = fully met, backed by hard evidence
c4-3 — How access is removed when employees or contractors leave
0 = no evidence at all, 10 = fully met, backed by hard evidence
c4-4 — How sensitive information is protected
0 = no evidence at all, 10 = fully met, backed by hard evidence
c4-5 — How security incidents are identified and handled
0 = no evidence at all, 10 = fully met, backed by hard evidence
c4-6 — Whether security testing is conducted
0 = no evidence at all, 10 = fully met, backed by hard evidence
C5 — AI Models, Cloud Services & Third-Party Dependencies
Please identify the major external providers, AI models, cloud services and other third parties on which the product depends. For each major dependency, please provide, where known: provider name; service, model or technology used; purpose; type of data shared or processed; processing or hosting region; whether the dependency is critical to the operation of the product.
c5-1 — Major AI models, cloud services and third-party providers are named
0 = no evidence at all, 10 = fully met, backed by hard evidence
c5-2 — What each dependency is used for, and what data it processes
0 = no evidence at all, 10 = fully met, backed by hard evidence
c5-3 — Processing/hosting region for each major dependency
0 = no evidence at all, 10 = fully met, backed by hard evidence
c5-4 — Whether each dependency is critical to the product's operation
0 = no evidence at all, 10 = fully met, backed by hard evidence
C6 — User & Stakeholder Engagement
Please provide evidence showing how users, communities or other relevant stakeholders have been involved in the design, development, testing or improvement of the product. Your evidence should, where applicable, demonstrate: who the relevant stakeholders are; whether intended users were consulted; whether local communities or affected groups were engaged; whether local language, cultural or accessibility needs were considered; what feedback was received; whether stakeholder feedback resulted in changes to the product; how users can continue to provide feedback after deployment. FAIR considers not only whether consultation took place, but whether stakeholder input meaningfully influenced the solution.
c6-1 — Relevant stakeholders are identified
0 = no evidence at all, 10 = fully met, backed by hard evidence
c6-2 — Intended users, local communities or affected groups were consulted
0 = no evidence at all, 10 = fully met, backed by hard evidence
c6-3 — Local language, cultural or accessibility needs were considered
0 = no evidence at all, 10 = fully met, backed by hard evidence
c6-4 — What feedback was received, and whether it changed the product
0 = no evidence at all, 10 = fully met, backed by hard evidence
c6-5 — How users can continue to give feedback after deployment
0 = no evidence at all, 10 = fully met, backed by hard evidence
C7 — Complaints, Incidents, Appeals & Human Review
Please provide evidence explaining what happens when the product produces an incorrect, disputed, harmful or otherwise problematic outcome. Your evidence should, where applicable, explain: how users can submit complaints; who receives and investigates complaints; expected response times; escalation procedures; how AI-related incidents are recorded and addressed; whether users can challenge AI-generated or AI-supported decisions; when human review is available; how corrective action is taken. For products that make or materially support decisions affecting individuals, please specifically address: can an affected person challenge an AI-supported decision and obtain meaningful human review?
c7-1 — How users can submit complaints, and who investigates them
0 = no evidence at all, 10 = fully met, backed by hard evidence
c7-2 — Expected response times and escalation procedures
0 = no evidence at all, 10 = fully met, backed by hard evidence
c7-3 — How AI-related incidents are recorded and addressed
0 = no evidence at all, 10 = fully met, backed by hard evidence
c7-4 — Whether an affected person can challenge an AI-supported decision and get meaningful human review
0 = no evidence at all, 10 = fully met, backed by hard evidence
c7-5 — How corrective action is taken
0 = no evidence at all, 10 = fully met, backed by hard evidence
C8 — Sustainability & Social / Local Impact
Please provide evidence describing the environmental, social, economic and local impact of the product, where applicable. Depending on the nature and scale of the product, this may include: benefits delivered to users or communities; measurable social or economic outcomes; local employment created or supported; workforce displacement or employment impacts; training and local capacity building; support for local SMEs or suppliers; accessibility and inclusion; environmental impact; computing and energy requirements; measures taken to reduce negative impacts. Evidence requirements should be proportionate to the size and nature of the applicant and product — small companies and early-stage innovators are not expected to produce the same level of documentation as large multinational organisations.
c8-1 — Benefits delivered to users or communities, and measurable outcomes
0 = no evidence at all, 10 = fully met, backed by hard evidence
c8-2 — Local employment, training, or capacity building
0 = no evidence at all, 10 = fully met, backed by hard evidence
c8-3 — Workforce displacement or employment impacts
0 = no evidence at all, 10 = fully met, backed by hard evidence
c8-4 — Accessibility and inclusion
0 = no evidence at all, 10 = fully met, backed by hard evidence
c8-5 — Environmental / computing footprint and steps to reduce negative impact
0 = no evidence at all, 10 = fully met, backed by hard evidence
Nothing you enter here is saved or sent to AIFOD.
See my indicative score