Declaring What Does Not Apply: AI, APIs, Dependencies

In an audit or a security questionnaire, not every control makes sense for every organisation. Leaving a box blank raises doubts; explaining in writing why a control does not apply, and when it would apply again, builds trust.

• A not-applicable declaration is a brief, signed and dated justification.
• It avoids padding with paperwork what does not apply and shows judgement.
• It must be reviewed when systems or services change.
• General guidance; it does not replace legal advice.

What a not-applicable declaration is

It is a document that names a control or requirement, explains why it does not apply to the organisation or a specific service, and sets the circumstances in which it must be reassessed. It is not a way to avoid obligations: it is a way to be precise.

Common examples

1. Artificial intelligence. If the organisation uses no in-house or customised AI systems, it can record that and keep an impact assessment template ready for the day it adopts one.
2. Application programming interfaces (APIs). If none are exposed to the internet, certain associated controls may not apply.
3. Software dependency analysis. If no proprietary software is built with build pipelines, the analysis may not apply until development begins.
4. Other controls tied to environments the organisation does not have.

How to write one well

• Identify the requirement precisely.
• Explain the reason in plain language.
• State the reactivation condition: what change would make it apply.
• Set an owner, a date and a validity period.
• Store it with the rest of the evidence.

What to do

• Review the questionnaires and frameworks your organisation answers and spot which items do not apply.
• Write the declarations in a single format.
• Have management approve them formally.
• Review them at least yearly or on relevant change.
• Keep a clear and truthful position on AI use.

Frequently asked questions

Will an assessor accept a "not applicable"? A clear justification is usually more acceptable than an empty answer; the final decision is the assessor's.

Can I declare something not applicable just for convenience? No; the declaration must be truthful and verifiable.

What if I adopt AI later? The declaration no longer holds and the corresponding impact assessment should be carried out.

This practice helps with supplier security assessments. Organizations we have supported have passed supplier security assessments required by their institutional customers.

IT Lab supports Chilean organisations in this. Contact us.