Foundations

Where the legal problem lives

Exposure addresses what an AI system might do. Foundations addresses what it was built from and whether the organization was entitled to use it.

An operational fault may be corrected, but some decisions about data and model use cannot be fully undone after deployment. Removing a dataset does not necessarily remove its influence from a model trained on it. Updating a privacy notice does not undo processing that has already taken place.

This is why the control objectives in this domain emphasize the period before release. Establishing entitlement and suitability before deployment reduces the risk of discovering a problem that a technical fix alone cannot resolve.

Holding data is not entitlement to use it

The most common foundational failure is an organization using data it legitimately holds for a purpose it has no basis to apply it to.

The data is the organization's own. It was lawfully collected. It sits in the organization's systems under the organization's control. None of that settles whether it may be used to train a model. Entitlement depends on purpose as well as possession: the purpose the data was collected for, whether the new use is compatible with it, and whether another basis applies. Privacy law answers those questions differently from one jurisdiction to the next, which is why the answer has to be established and recorded rather than assumed.

FND-2 and FND-3 separate these. The first asks what basis exists for the use. The second asks whether a use of personal information is consistent with what the individuals concerned were told and agreed to, which is frequently the narrower constraint and the one that produces complaints, because people who were told their information would be used to provide a service rarely contemplated it becoming training data.

The same applies to material obtained from third parties. Availability is not permission, and a substantial volume of publicly accessible content carries terms that prohibit precisely this use.

Not knowing what is underneath

A significant proportion of AI capability rests on base models the organization did not build, cannot inspect, and does not control.

FND-4 requires the origin to be known and the license examined. Model licenses vary considerably and contain restrictions that are material: limits on commercial use, on use of outputs to train other models, on particular sectors or applications, and on jurisdictions. These are frequently unexamined, because the model reaches the organization inside a product and the product's terms are reviewed in place of the model's.

FND-6 addresses the consequence that follows. A vendor may change the model underneath a product at a time of its choosing. When it does, the behavior of the organization's system changes, its validation under ASR-3 is no longer current, and its baseline under FND-5 no longer describes it. None of that generates a change record on the organization's side.

An organization that has not arranged for notification, and has no baseline against which to detect the change independently, will learn about it from its outputs.

Deletion across derived stores

FND-7 exists because AI systems copy data into forms that conventional retention processes do not reach.

Personal information deleted from a system of record may persist in an embedding store, in prompt and completion logs retained for debugging, in a fine-tuning dataset assembled six months ago, in an evaluation set held by a vendor, and in backups of each. Each copy was created for a legitimate operational reason. None of them is usually connected to the deletion process.

The result is an organization that honors a deletion request accurately with respect to its primary system and inaccurately with respect to its actual holdings. The gap becomes visible when somebody asks the question in a form that requires a complete answer.