I thought I'd share with this group to get thoughts. We drafted up principles for using AI in our software and none of them seem like they should be unique to any one vendor. Anything you think should be added or removed?

I copied them here, but they are also in the link below.

1. Human in Control: The investigator will always have a chance to review results from automated scoring and generative AI. The software is designed to support, not replace, human expertise.

2. Traceability: Results will include references to the original source data (such as files and registry keys) so that the investigator can manually verify them. 

3. Explainability: Results will include information about why a conclusion was made so the investigator can more easily evaluate them.

4. Disclose Non-Determinism: When a technique is used that is non-deterministic, the investigator will be notified so that they know to:

   • Not be surprised when they get a different result next time

   • Not assume the results are exhaustive

5. Disclose Generative AI: The user will be notified when generative AI is used so that they know to review it for accuracy.  

6. Verify Generative AI: Where possible, structured data such as file paths, hashes, timestamps, and URLs in generative AI output are automatically cross-checked against source evidence to reduce the risk of AI “hallucinations.”

7. Refute: If applicable, the AI techniques should attempt to both refute and support its hypotheses in order to come to the best conclusion. This is inline with the scientific method of coming to the best conclusion based on observations. 

https://www.cybertriage.com/blog/ai-principles-for-digital-forensics-and-investigations-dfir/