APRF-25 · Safety & Responsible AI

Purpose

Define and enforce content-safety, harm-prevention, fairness/bias, and user-facing AI disclosure requirements appropriate to the product domain and risk tier.

Mandatory checks

Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.

SAF-M1L3 · DefinedTier 2 · ProductionhybridE3
Product domains shall maintain a versioned, owned AI safety policy that includes domain-specific harm categories with refuse-vs-escalate actions for each—so safety filters and human escalation are grounded in explicit policy, not ad-hoc judgment.
Artifact
Approved domain-specific AI safety policy (versioned, owned) including harm categories and refusal/escalation + Evidence each domain-minimum harm category maps refuse vs escalate + Last review record ≤12 months with named owner
Pass condition
Domain-specific AI safety policy has version, owner, and review date ≤12 months; maps ≥ domain-minimum harm categories with explicit refuse vs escalate actions for each (measuredAt ≤90 days). If the product has no AI user- or tool-facing behavior in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Define what constitutes unsafe output and behaviour for this specific product domain.
Threats mitigated
Harmful Content GenerationMisinformationBias and Discrimination
Protects
UsersSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Generic safety filters miss domain-specific harms such as unlicensed medical, legal, or financial guidance. A domain policy defines the harm boundary that the automated gates in SAF-M2 then enforce; the policy itself maps to no adversary technique.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
SAF-M2L3 · DefinedTier 2 · ProductionhybridE3
In-scope releases shall run an automated safety evaluation suite with numeric thresholds that blocks promote on fail—unless a time-boxed waiver (expiry ≤14 days) with a named owner is recorded.
Artifact
Safety suite definition with numeric thresholds + CI/gate reports covering in-scope releases in the last 30 days (100%) + Waiver register for gate failures (owner + expiry ≤14 days) when used
Pass condition
Safety gate executed on 100% of in-scope releases in the last 30 days; fail blocks promote unless a time-boxed waiver (expiry ≤14 days) with owner is recorded (measuredAt ≤90 days). If no in-scope AI releases exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Block releases that fail the organization's stated safety bar.
Threats mitigated
Harmful Content GenerationJailbreakMisinformationBias and Discrimination
Protects
UsersModelsSafety
MITRE: ATLAS AML.T0054 · ATLAS AML.T0048 · ATLAS AML.T0048.003
Safety gates stop a release that has lost jailbreak resistance or begun producing harmful content from reaching users at all. They reduce the likelihood of external and user harm originating from the deployed system.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
SAF-M3L3 · DefinedTier 2 · ProductionhybridE3
Where policy or law requires it, in-scope user surfaces shall disclose that the user is interacting with AI—so people are not misled about automated vs human counterparts.
Artifact
Disclosure UX inventory of in-scope user surfaces (policy checklist) + Latest screenshot/checklist audit showing coverage + critical-surface status
Pass condition
AI-interaction disclosure present on 100% of in-scope user surfaces per policy checklist; 0 critical surfaces missing disclosure in the latest audit (measuredAt ≤90 days). If policy or law does not require AI-interaction disclosure for in-scope surfaces, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure users know when they are interacting with an AI system.
Threats mitigated
MisinformationIdentity Spoofing
Protects
UsersSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Users who believe they are speaking with a human calibrate trust differently and may disclose more than they intend. Disclosure is a transparency obligation, so the driver is regulatory rather than adversarial.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
SAF-M4L4 · Quantitatively ManagedTier 3 · Mission CriticalhybridE3
When AI influences or automates high-stakes decisions (rights, opportunities, or access to essential services), those paths shall be inventoried and covered by a retained fairness/disparity evaluation with numeric thresholds and named owners. If the system has no such paths, score NOT_APPLICABLE.
Artifact
Scope attestation: whether AI influences/automates high-stakes decisions + Inventory of in-scope high-stakes decision paths (when applicable) + Fairness/disparity eval methodology + latest run report with thresholds and owners (≤90 days)
Pass condition
If the system influences or automates high-stakes decision paths, those paths are inventoried and the latest fairness/disparity eval (≤90 days) is retained with thresholds and named owners (measuredAt ≤90 days). If no high-stakes decision paths exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Measure disparate outcomes on high-stakes automated decision paths.
Threats mitigated
Bias and DiscriminationHarmful Content Generation
Protects
UsersSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
High-stakes automated decisions can produce systematically disparate outcomes that aggregate accuracy metrics conceal entirely. Disparity evaluation makes that visible; it is a responsible-AI obligation with no adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

Evidence required

Domain-specific AI safety policy document
Safety eval suite definitions and recent gate results
Disclosure UX or policy evidence

Recommended checks

Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.

SAF-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Production systems should sample safety edge cases on a defined cadence (≥ monthly or per release), with a retained review packet that dispositions each fail/edge case and links backlog items when needed.
Artifact
Safety edge-case sampling plan (sample size + cadence) + Last review packet ≤90 days (labels, dispositions, reviewer names, backlog links when needed)
Pass condition
Defined sample size and cadence (≥ monthly or per release); last packet ≤90 days includes disposition for each fail/edge case and links to backlog items when needed, with reviewer names (measuredAt ≤90 days). If no production AI with safety-relevant outputs exists, score NOT_APPLICABLE.
Why this control exists
Threat map
Apply human judgement to safety edge cases that automated evaluation classifies poorly.
Threats mitigated
Harmful Content GenerationBias and DiscriminationMisinformation
Protects
UsersSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Edge cases are exactly where automated safety classifiers are least reliable. Sampled human review covers that gap; no adversary technique maps.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
SAF-R2L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Production systems should run a jailbreak-to-harm red-team suite—distinct from security injection corpora—that covers documented harm categories, meets refusal/safety thresholds on a run ≤90 days old, and routes findings into the safety backlog with owners.
Artifact
Jailbreak-to-harm red-team suite definition (explicitly distinct from security injection suite) + Latest scored run report ≤90 days vs refusal/safety thresholds + Safety backlog items for findings with named owners
Pass condition
A jailbreak-to-harm red-team suite (distinct from the security injection suite) covers documented harm categories; the latest run ≤90 days meets refusal/safety thresholds; findings feed the safety backlog with named owners (measuredAt ≤90 days). If no production AI with user- or tool-facing generation exists, score NOT_APPLICABLE.
Why this control exists
Threat map
Test whether safety controls hold end to end, from jailbreak attempt through to real-world harm.
Threats mitigated
JailbreakHarmful Content GenerationPrompt Injection
Protects
UsersModelsSafety
MITRE: ATLAS AML.T0054 · ATLAS AML.T0051 · ATLAS AML.T0048.003
Safety red teaming asks whether a bypassed guardrail actually produces harm, which component-level filter tests never answer. It exercises the jailbreak-to-user-harm chain that automated suites systematically under-represent.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

More detailPhilosophy, failures, practices, validations, examples, crosswalks, and evolution

Engineering philosophy

Safety is not a synonym for security. Adversarial controls stop attackers; safety controls stop harmful or unfair outcomes for users and society. Both are required for production readiness.

Why it matters

Systems can be “secure” yet produce toxic, discriminatory, or undisclosed AI-generated content that creates regulatory, brand, and user harm.

Common failures

No domain-specific AI safety policy (harm categories + refusal/escalation)
Safety filters only on output, not on tool-mediated side effects
No fairness or disparity testing for high-stakes decisions
Users not informed when they interact with AI

Severity & risk

Severity: critical; Impact if violated
Risk level: high; Typical residual risk (impact × likelihood)

Engineering best practices

Separate safety eval datasets from adversarial security corpora
Fail closed on high-severity harm categories
Align safety thresholds to criticality tier, not headcount
Log safety refusals for measurement without storing unnecessary sensitive content

Automatic validations

CI safety-gate failures block release
Online monitoring of refusal rates and safety classifier signals
Regression tests for known harmful prompt classes

Manual validations

Domain expert review of the AI safety policy and harm categories
Periodic calibration of automated safety graders vs human labels

Examples

A tutoring agent refuses self-harm content and escalates to a human protocol
A lending assistant reports group disparity metrics before each model promotion

References

Crosswalks

Show 17 peer mappingsexpand

MEASURE Measure
NIST AI Risk Management Framework · supports
Safe Safe
NIST AI Risk Management Framework · aligns-with
Fair Fair — Harmful Bias Managed
NIST AI Risk Management Framework · partial
§6 Planning
ISO/IEC 42001 · partial
Annex A AI system controls (selected themes)
ISO/IEC 42001 · partial
LLM05 Improper Output Handling
OWASP Top 10 for Large Language Model Applications · supports
LLM09 Misinformation
OWASP Top 10 for Large Language Model Applications · aligns-with
C7.1 Output Format Enforcement
OWASP AI Application Security Verification Standard (AISVS) · supports
C7.2 Hallucination Detection & Mitigation
OWASP AI Application Security Verification Standard (AISVS) · supports
C7.3 Output Safety
OWASP AI Application Security Verification Standard (AISVS) · supports
C7.4 Source Attribution & Citation Integrity
OWASP AI Application Security Verification Standard (AISVS) · aligns-with
C11.1 Model Alignment, Safety, and Robustness Testing and Training
OWASP AI Application Security Verification Standard (AISVS) · supports
C11.2 Membership-Inference and Model-Inversion Mitigation
OWASP AI Application Security Verification Standard (AISVS) · partial
C11.3 Model-Extraction Defense
OWASP AI Application Security Verification Standard (AISVS) · partial
C11.4 Model Runtime Anomaly Detection
OWASP AI Application Security Verification Standard (AISVS) · supports
CC3 Risk Assessment
SOC 2 Trust Services Criteria · evidence-for
Generative AI Lens Generative AI Lens (themes)
AWS Well-Architected Framework · aligns-with

Future evolution

Shared harm taxonomies and portable safety scorecards across model providers.