CDR Content
The Classification Decision Record (CDR) is the formal artefact documenting the system’s risk tier determination. It contains the system’s description (intended purpose, deployment context, affected population, input/output specification), the classification determination (tier, Annex III domain or Annex I legislation if applicable, Article 50 category if applicable), the Article 6(3) exception analysis (if claimed, with both functional and risk criteria addressed), and the supporting evidence for the determination.
The CDR also records the Classification Reviewer’s independent assessment, the AI Governance Lead’s approval, and the date of the determination. Where the determination is borderline, the CDR documents the reasoning for the chosen classification, the arguments for the alternative classification, and the factors that tipped the decision.
The CDR is a living document in the sense that reclassification triggers can require its revision. Each revision creates a new version; all versions are retained for the ten-year period required by Article 18. The CDR is the first document an assessor examines when reviewing the AISDP; it sets the context for everything that follows.
Key outputs
- System description, classification determination, and Article 6(3) analysis
- Independent review and AI Governance Lead approval
- Version-controlled with all versions retained
- Module 6 AISDP evidence
Independent Review by Classification Reviewer
The CDR is subject to independent review by a Classification Reviewer, a role that requires functional independence from the system’s development team. The reviewer assesses whether the classification analysis is thorough, whether the evidence supports the conclusion, whether alternative classifications were fairly considered, and whether the Article 6(3) exception analysis (if present) meets the rigorous standard described above.
The Classification Reviewer does not need to agree with every aspect of the analysis; they need to confirm that the analysis is defensible. If the reviewer identifies gaps, inconsistencies, or unsupported conclusions, these are documented as findings that must be addressed before the CDR is approved. The reviewer’s assessment, including any findings and their resolution, is recorded in the CDR.
The independence requirement is critical. A classification review conducted by a member of the development team, or by a person with a commercial interest in a lower classification, lacks the objectivity needed to ensure the analysis is rigorous.
Key outputs
- Independent Classification Reviewer assessment
- Functional independence from the development team
- Findings documented with resolution required before approval
- Module 6 AISDP evidence
Disagreement Escalation to AI Governance Lead
Where the Classification Reviewer disagrees with the AI System Assessor’s classification determination, the disagreement is escalated to the AI Governance Lead for resolution. The AI Governance Lead reviews both positions, may request additional analysis or evidence, and makes a binding determination.
The escalation process is documented: the original determination, the reviewer’s objection with its reasoning, any additional analysis requested, and the AI Governance Lead’s final decision with its rationale. The documentation ensures that classification disagreements are resolved through governance, not through informal pressure or hierarchy.
Classification disagreements are a healthy sign, indicating that the review process is genuinely independent. An organisation that never experiences a classification disagreement should examine whether its review process is sufficiently rigorous.
Key outputs
- Formal escalation process for classification disagreements
- AI Governance Lead binding determination
- Complete documentation of positions, analysis, and resolution
- Module 6 AISDP evidence