3.3 Awareness

1. Clause Overview

If competence (3.2) addresses “can they do it,” awareness addresses “do they know why they should.” It is not enough for participants to merely know that a policy exists. Compliance functions in practice only when participants also know how their own work contributes to the program and what happens if they fail to follow it.

3.3 requires ensuring that program participants are aware of four things: the AI SBOM policy, relevant business objectives, their own contribution to the program’s effectiveness, and the implications of not following the program’s requirements. In AI, the implications of non-conformance extend beyond copyright disputes to regulatory violations and breaches of usage restrictions, so participants must clearly recognize this.

2. Required Activities

• Ensure participants know the AI SBOM policy and where to find it.
• Communicate relevant business objectives (building trust, regulatory compliance, meeting supply-chain requirements).
• Inform participants how their own work contributes to the program.
• Inform participants of the implications of non-conformance (regulatory violations, contract termination, breaches of usage restrictions).
• Assess participants’ awareness and preserve evidence of that assessment.

3. Requirements and Verification Material

4. Compliance Methods and Samples by Verification Material

3.3.1 Evidence of assessed participant awareness

Compliance Method

Assess whether participants actually understand the four awareness elements and keep evidence of that assessment. If policy dissemination (3.1.2) proves that participants “were informed,” the awareness assessment proves that they “understood.” Assess through post-training comprehension quizzes, acknowledgment signatures, or interviews. Make sure the assessment does not omit the three elements the standard specifies in its verification material: the program’s objectives, one’s own contribution, and the implications of non-conformance.

Considerations

• Cover all four elements: In addition to policy awareness, include objectives, contribution, and the implications of non-conformance in the assessment. Omitting even one can be flagged during a certification audit.
• Emphasize AI-specific implications: Include regulatory violations (the EU Artificial Intelligence Act, Korea’s AI Basic Act) and breaches of non-standard license usage restrictions among the implications of non-conformance.
• Differentiate by role: Data staff and developers contribute differently, so tailor the assessment content to each role.
• Retain evidence: Preserve assessment results and acknowledgment signatures for use as verification material.

Sample (Awareness Assessment Log)

| Participant (Role) | Policy Awareness | Objectives Awareness | Contribution Awareness | Non-conformance Awareness | Assessment Method | Assessment Date |
|-------------|:--------:|:--------:|:--------:|:---------------:|----------|--------|
| Lee OO (Development) | Met | Met | Met | Met | Post-training check | 2026-03-10 |
| Park OO (Data) | Met | Met | Met | Met | Interview + signature | 2026-03-11 |

Sample acknowledgment signature form:

I have been informed of and understand our company's AI SBOM compliance policy, the program's
objectives, my own contribution, and the implications of non-conformance (regulatory violations,
license usage restriction breaches, contract termination).

Name: ____  Role: ____  Signature: ____  Date: ____

5. See Also

• Policy and dissemination procedure: 3.1 Policy
• Competence by role: 3.2 Competence
• ISO/IEC 5230 awareness example: ISO/IEC 5230 Compliance Guide — 3.1.3 Awareness