SECAI Core · phase 8 of 15
Due diligence
A legal principle that a subject has used best practice or reasonable care when setting up, configuring, and maintaining a system.
The Explain card
- Plain English
- Due diligence is the legal principle that you took reasonable care and followed best practice when setting up, configuring and maintaining a system. It is about demonstrable effort, not perfection.
- Example
- A company deploys a third-party LLM in its customer portal. Before launch it reviews the vendor's security documentation, runs a red-team exercise, documents the findings and fixes the serious ones. When a breach later occurs, those records show the company acted responsibly.
- Why it matters
- After an AI incident, regulators and courts ask what you did before it happened. Evidence of reasonable care can be the difference between a fine and a finding of negligence.
- Hook
- Did your homework, and kept the receipts.
Where it sits in the deck
Phase 8: Governance, Risk, and Compliance Frameworks
Individual controls need a governance envelope — introduce the risk and compliance structures, standards bodies, and regulations that frame AI accountability at scale.
