Responsible disclosure
The established security research norm of privately notifying an organization of a discovered governance or security gap, with a reasonable window to remediate, before any broader or public disclosure, balancing the risk of the gap remaining unaddressed against the risk of publicizing it before a fix exists.
Defined in 2 GAGE programs, which carry 3 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
The established security research norm of privately notifying an organization of a discovered governance or security gap, with a reasonable window to remediate, before any broader or public disclosure, balancing the risk of the gap remaining unaddressed against the risk of publicizing it before a fix exists.
A common synonym for coordinated vulnerability disclosure, emphasizing the discloser's ethical duty to maximize the fix and minimize the harm.
The professional norm, modeled by the Carlini et al. research team, of notifying the party positioned to fix a discovered vulnerability before making that vulnerability public, applied inside an organization as escalating a confirmed poisoning finding through proper channels before wider disclosure.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Responsible Disclosure Practices · AI Security Fundamentals, Certified AI Practitioner: Workplace Foundations
- Attacking to learn: you audit another estate and discover how thin most governance is · Adversarial Data Governance, Certified AI Data Governance Professional (CADGP)
- The poisoned quarter: an attacker has been feeding your pipelines, find the entry point · Adversarial Data Governance, Certified AI Data Governance Professional (CADGP)
Where it shows up at work
A definition is where Responsible disclosure starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Applies acceptable-use rules, discloses AI assistance where it matters, and keeps confidential material out of unapproved tools.
One lesson on this page teach it as a primary outcome.
Designs safeguards, family protocols and reporting paths for older adults, minors and people who cannot challenge an automated outcome.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Literacy Leadneeds working knowledge
- AI Adoption and Enablement Leadneeds working knowledge
- Ethical AI Specialistneeds working knowledge · 5 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: EU AI Act Article 50; OECD AI Principles; Elder Justice Act; EU AI Act Article 5 vulnerability prohibitions.
One interview question about it
How do you decide what you may put into an AI tool at work, and how do you tell people when AI helped produce something?
Asked of candidates for responsible and disclosed use of ai at work. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Elder services, social work, banking front line and fraud teams carries it as a claim to back up: Safeguarding vulnerable people is the profession.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.