Skip to main content

Compliance and Policy Center

Turo bridges the gap between AI teams and Risk teams, ensuring every project complies with the policies and controls defined by your organization. This is achieved through two key components: the Policy Center and the Compliance Workflow.

Policy Center​

The Policy Center is where admins can define the controls and policies that apply to individual projects in Turo. Let’s break it down:

  • Control: A control is a specific rule that an AI project must fulfill as part of the compliance process. For example, “Document model validation framework.”
  • Policy: A policy is a collection of controls grouped together. For instance, you might have a “Data Policy” or a “Security Policy.”
  • External Policies: These are optional policies provided by Turo. If this section is empty, there’s no need to worry!

Adding a Control​

Here’s how to add a control in Turo:

  1. Navigate to the “Policy Center” and ensure you’re on the “Controls” tab.
  2. Click “Register New Control.”
  3. Fill out the form with the necessary details.
  4. Click “Submit.”

You can add as many controls as you need. To edit or delete a control, simply click the action button.

register project

Adding a Policy​

Here’s how to create a policy:

  1. Navigate to the “Policy Center” and switch to the “Internal Policies” tab.
  2. Click “Register New Policy” and fill in the required information.
  3. Use the “Jurisdiction” dropdown to specify the region the policy applies to. This will help when setting up compliance for a project.
  4. Click “Submit.”

Just like controls, you can add, edit, or delete policies as needed using the action button.

register project

A Few Things to Keep in Mind:​

  • A single control can belong to multiple policies.
  • When editing a control or policy, Turo will show you how many projects will be impacted by the change.
  • After editing, project teams will be notified of the update via email and in-app notifications.
  • Editing a control or policy does not affect its current state within a project. For example, if a control is already marked as “Mitigated,” it will remain in that state.

Project Compliance​

Once controls and policies are set up in the Policy Center, project teams can begin the compliance process. Here’s how it works:

  1. Navigate to the “Compliance” tab within a project and click “Submit” to launch the compliance wizard.
  2. Choose the Jurisdiction for your project. This determines which policies will be displayed in the next step. If you’re unsure, select all jurisdictions.
  3. Select any External Policies that apply to your project, then click Continue.
  4. Select the relevant Internal Policies for your project, then click Continue.
  5. Complete the wizard.

You’ll now see a list of controls that your team needs to address. Each control can be assigned to a team member for mitigation.

Submitting a Control​

To mitigate a control:

  1. Click “Manage” next to the control you want to address.
    • Note that you need to be assigned the control before you can manage it.
  2. Follow the wizard to provide evidence of mitigation. You can either:
    • Attach a metric as proof, or
    • Upload a document as evidence.
  3. Click “Submit.”

Once submitted, the project admin will be notified to review the control. As a submitter, you can find the submitted control in the Requests tab, and you can add more information by adding comments to the request.

register project

Approving or Declining a Control​

As a project admin, you’ll receive a notification whenever a control is submitted for review. You can approve, decline, or request more information by adding comments to the request.

register project

Here’s how to take action:

  1. Navigate to the Requests section.

register project

  1. Click on the request you want to review.
  2. Review the evidence:
    • For metrics, note that the value reflects the state at the time of submission.
    • For documents, you can download and review the attached file.
  3. Use the “Comments” tab to communicate with the submitter and maintain an audit trail. The submitter will receive an email notification for any comments you add.
  4. Choose to either “Approve” or “Decline” the control:
    • Approve: Marks the control as “Mitigated.”
    • Decline: Keeps the control in the “In-Progress” state, allowing the team to submit new evidence.