# 3.3 Awareness

> Explains how to ensure that program participants are aware of the AI SBOM policy and objectives, their own contribution, and the implications of non-conformance.

---

LLMS index: [llms.txt](/llms.txt)

---

<div class="alert alert-info" role="alert"><div class="h4 alert-heading" role="heading">Implementation Stage</div>


This clause is established during **Phase 1 — Program Foundation**.
[View the full implementation roadmap](../../#phased-implementation-roadmap)
</div>


## 1. Clause Overview

If competence (3.2) addresses "can they do it," awareness addresses "do they know why they should."
It is not enough for participants to merely know that a policy exists. Compliance functions in
practice only when participants also know how their own work contributes to the program and what
happens if they fail to follow it.

3.3 requires ensuring that program participants are aware of four things: the AI SBOM policy,
relevant business objectives, their own contribution to the program's effectiveness, and the
implications of not following the program's requirements. In AI, the implications of
non-conformance extend beyond copyright disputes to regulatory violations and breaches of usage
restrictions, so participants must clearly recognize this.

## 2. Required Activities

- Ensure participants know the AI SBOM policy and where to find it.
- Communicate relevant business objectives (building trust, regulatory compliance, meeting
  supply-chain requirements).
- Inform participants how their own work contributes to the program.
- Inform participants of the implications of non-conformance (regulatory violations, contract
  termination, breaches of usage restrictions).
- Assess participants' awareness and preserve evidence of that assessment.

## 3. Requirements and Verification Material

| Clause | Requirement (EN) | Verification Material |
|-----------|--------------|---------|
| 3.3 | The organisation shall ensure that the program participants are aware of the AI SBOM policy, relevant business objectives, their contribution to the effectiveness of the program, and the implications of not following the Program's requirements. | **3.3.1** Documented evidence of assessed awareness for the program participants, which should include: the program's objectives; one's contribution within the program; and the implications of program non-conformance |

<details><summary>View original English text</summary>

> **3.3 Awareness**
> The organisation shall ensure that the program participants are aware of: the AI SBOM policy;
> relevant business objectives; their contribution to the effectiveness of the program; and the
> implications of not following the Program's requirements.
>
> **Verification material(s):**
> - Documented evidence of assessed awareness for the program participants, which should include: the
>   program's objectives; one's contribution within the program; and the implications of program
>   non-conformance.

</details>

## 4. Compliance Methods and Samples by Verification Material

### 3.3.1 Evidence of assessed participant awareness

**Compliance Method**

Assess whether participants actually understand the four awareness elements and keep evidence of
that assessment. If policy dissemination (3.1.2) proves that participants "were informed," the
awareness assessment proves that they "understood." Assess through post-training comprehension
quizzes, acknowledgment signatures, or interviews. Make sure the assessment does not omit the three
elements the standard specifies in its verification material: the program's objectives, one's own
contribution, and the implications of non-conformance.

**Considerations**

- **Cover all four elements**: In addition to policy awareness, include objectives, contribution,
  and the implications of non-conformance in the assessment. Omitting even one can be flagged during
  a certification audit.
- **Emphasize AI-specific implications**: Include regulatory violations (the EU Artificial
  Intelligence Act, Korea's AI Basic Act) and breaches of non-standard license usage restrictions
  among the implications of non-conformance.
- **Differentiate by role**: Data staff and developers contribute differently, so tailor the
  assessment content to each role.
- **Retain evidence**: Preserve assessment results and acknowledgment signatures for use as
  verification material.

**Sample (Awareness Assessment Log)**

```
| Participant (Role) | Policy Awareness | Objectives Awareness | Contribution Awareness | Non-conformance Awareness | Assessment Method | Assessment Date |
|-------------|:--------:|:--------:|:--------:|:---------------:|----------|--------|
| Lee OO (Development) | Met | Met | Met | Met | Post-training check | 2026-03-10 |
| Park OO (Data) | Met | Met | Met | Met | Interview + signature | 2026-03-11 |
```

Sample acknowledgment signature form:

```
I have been informed of and understand our company's AI SBOM compliance policy, the program's
objectives, my own contribution, and the implications of non-conformance (regulatory violations,
license usage restriction breaches, contract termination).

Name: ____  Role: ____  Signature: ____  Date: ____
```

## 5. See Also

- Policy and dissemination procedure: [3.1 Policy](../1-policy/)
- Competence by role: [3.2 Competence](../2-competence/)
- ISO/IEC 5230 awareness example: [ISO/IEC 5230 Compliance Guide — 3.1.3 Awareness](https://openchain-project.github.io/OpenChain-KWG/guide/iso5230_guide/1-program-foundation/3-awareness/)