語音、逐字稿、翻譯、摘要都可以完全在你自己的設備上處理，不需要任何雲端 AI 服務，能幫助組織落實個人資料保護、資訊安全與 AI 管理的要求。Speech, transcripts, translations and summaries can be processed entirely on your own hardware with no cloud AI service, which helps organizations meet privacy, security and AI governance requirements.
個資法、GDPR 是法律，規範組織實際怎麼處理個人資料；ISO/IEC 27001:2022、ISO/IEC 42001:2023 是管理制度標準，驗證組織在指定範圍內的管理制度。兩者都不是針對某一套軟體，所以本工具箱不宣稱「通過」或「符合」任何法規或認證，用了它也不代表某個部署就合法或取得驗證。這一頁說明工具本身做到什麼（多半只是控制措施的一部分或佐證），以及你的組織使用後還要做哪些事。本頁不是法律意見，也不是程式的安全稽核報告。Privacy laws such as Taiwan's PDPA and the GDPR govern how an organization actually handles personal data; ISO/IEC 27001:2022 and ISO/IEC 42001:2023 are management system standards that certify an organization's management system within a defined scope. Neither applies to a piece of software, so the toolbox claims no certification, and using it does not make a deployment lawful or certified. This page explains what the tool does (mostly part of a control, or supporting evidence) and what your organization still needs to do. It is neither legal advice nor a security audit of the code.
錄音、逐字稿、摘要可以完全在你的內網裡處理與保存；雲端 AI 服務完全用不到。實際資料流向依你的部署與設定決定。Recordings, transcripts and summaries can be processed and stored entirely inside your network; no cloud AI service is involved. Actual data flows depend on your deployment and settings.
| 資料Data | 在哪裡處理、存在哪裡Where it is processed and stored |
|---|---|
| 會議錄音、即時音訊Meeting recordings, live audio | 你的電腦；選用 GPU 伺服器時送到你自己架設的 GPU 伺服器辨識，暫存音檔辨識完就刪（處理出錯也會刪；伺服器當機時可能留在系統的暫存資料夾，由作業系統清理）Your computer; with a GPU server, audio goes to your own server for recognition and the temporary file is deleted afterwards (also on errors; if the server crashes it may remain in the system temp folder until the OS cleans it up) |
| 逐字稿、翻譯、摘要Transcripts, translations, summaries | 你的電腦（logs/）；翻譯與摘要送到你自己設定的 LLM 伺服器（例如內網的 Ollama）Your computer (logs/); translation and summaries use the LLM server you configure (e.g. Ollama on your LAN) |
| 錄音檔Audio files | 你的電腦（recordings/）Your computer (recordings/) |
| 朗讀用的參考錄音（聲音）Reference recordings for text-to-speech (voices) | 你的電腦（tts_voices/）；用 GPU 伺服器合成時伺服器依內容快取一份。刪除聲音時本機那份立刻刪，GPU 伺服器那份一起刪；伺服器連不上時記在待刪清單，下次用 GPU 伺服器朗讀時補刪（在那之前伺服器上還有一份）Your computer (tts_voices/); the GPU server caches a copy by content. Deleting a voice removes the local copy at once and the server copy too; if the server is unreachable it goes on a pending list and is deleted the next time the GPU server is used for reading aloud (until then the server still has it) |
| 設定（含密碼雜湊、轉發平台的認證）Settings (password hashes, forwarding credentials) | 你的電腦（config.json）Your computer (config.json) |
模型都可以在自己的設備上執行，各模型依各自的授權使用；授權是 2026 年 10 月查證時的狀態，以各模型的頁面為準。Every model can run on your hardware and is used under its own license; licenses as checked in October 2026, each model's page is authoritative.
| 項目Item | 授權License |
|---|---|
| 本工具箱的程式碼The toolbox's code | Apache-2.0Apache-2.0 |
| 語音辨識：Whisper（含 faster-whisper、mlx、ggml 轉換版）Speech recognition: Whisper (incl. faster-whisper, mlx, ggml conversions) | MITMIT |
| 語音辨識：Breeze-ASR-26（台語）Speech recognition: Breeze-ASR-26 (Taiwanese) | Apache-2.0Apache-2.0 |
| 語音辨識：Moonshine（英文串流）Speech recognition: Moonshine (English streaming) | MITMIT |
| 語音辨識：Qwen3-ASR 0.6B 與對齊模型（實驗）Speech recognition: Qwen3-ASR 0.6B and aligner (experimental) | Apache-2.0Apache-2.0 |
| 講者辨識：Nemotron 3 DiarizationDiarization: Nemotron 3 Diarization | OpenMDW-1.1OpenMDW-1.1 |
| 講者辨識：resemblyzer、spectralclusterDiarization: resemblyzer, spectralcluster | Apache-2.0Apache-2.0 |
| 離線翻譯：NLLB 600MOffline translation: NLLB 600M | CC-BY-NC-4.0（僅限非商業用途）CC-BY-NC-4.0 (non-commercial only) |
| 離線翻譯：Argos Translate 英翻中Offline translation: Argos Translate EN→ZH | 程式 MIT；模型 CC-BY 4.0（源自 OPUS-MT）Code MIT; model CC-BY 4.0 (from OPUS-MT) |
| 翻譯、摘要用的 LLM（Ollama 等）LLMs for translation and summaries (Ollama etc.) | 依你選用的模型；預設的 gemma4:26b、qwen3.8:27b 與備援 qwen2.5:14b 為 Apache-2.0Depends on the model you choose; the defaults gemma4:26b, qwen3.8:27b and fallback qwen2.5:14b are Apache-2.0 |
| 朗讀：VoxCPM2、BreezyVoice、g2pWText-to-speech: VoxCPM2, BreezyVoice, g2pW | Apache-2.0Apache-2.0 |
| 朗讀：教育部《重編國語辭典修訂本》Text-to-speech: Taiwan MOE Revised Mandarin Dictionary | CC BY-ND 3.0 TWCC BY-ND 3.0 TW |
| 內建的 10 個聲音（中文 8、英文 2，AI 產生）The 10 built-in voices (8 Chinese, 2 English; AI-generated) | 隨本工具箱（Apache-2.0）Part of the toolbox (Apache-2.0) |
NLLB 600M 僅限非商業用途：選單與 WebUI 都有標示；沒有 LLM 伺服器時程式會自動改用它，提示裡也會寫。企業或組織使用前請自行確認是否符合授權條款（不要預設內部使用就算非商業），或改用 LLM 伺服器翻譯。NLLB 600M is non-commercial only: it is labeled in the menus and the WebUI, and the notice says so when the program falls back to it without an LLM server. Organizations should check the license terms themselves (internal use is not automatically non-commercial) or translate with an LLM server.
都不會送出會議內容，或由你自己決定。Either no meeting content, or your own decision.
| 情況When | 送出什麼What leaves |
|---|---|
| 安裝、升級Install, upgrade | 從 GitHub、PyPI、HuggingFace 等下載程式與模型：不送出會議內容；對方會看到一般的連線資訊（IP、時間、下載了什麼）Downloads code and models from GitHub, PyPI, HuggingFace: no meeting content; they see ordinary connection details (IP, time, what was downloaded) |
| 第一次用到某個模型First use of a model | 從 HuggingFace 下載模型檔：同上Downloads the model from HuggingFace: same as above |
| 你開啟「字幕轉發」You turn on subtitle forwarding | 字幕會送到你設定的平台（Telegram、Slack、Discord、Teams、LINE、Nextcloud Talk 或自訂網址）。預設關閉，設定頁只能在本機打開Subtitles go to the platforms you set (Telegram, Slack, Discord, Teams, LINE, Nextcloud Talk or a custom URL). Off by default; the settings page opens only on the local machine |
| 你把 GPU 伺服器或 LLM 伺服器設在外部主機You point the GPU or LLM server at an outside host | 音訊或文字會送到那台主機，是否允許由你決定Audio or text goes to that host; your call |
webui.trusted_proxies：只採信這些代理轉來的來源位址，偽造的不算。沒設定時（v2.31.1 起），同一台代理轉來、帶著轉送標頭的請求一律當成遠端（要密碼、僅限本機的頁面不開）；代理完全不加轉送標頭時分不出來，仍會被當成本機Behind a reverse proxy, always set webui.trusted_proxies: only forwarded addresses from those proxies are believed, forged ones are not. Without it (since v2.31.1), requests from a proxy on the same machine that carry forwarding headers are treated as remote (password required, local-only pages refused); a proxy that adds no forwarding headers cannot be detected and still counts as localtrusted_proxies，並讓代理送出 X-Forwarded-ForAlways set passwords: the WebUI listens on all interfaces; set admin and read-only passwords, restrict IPs, use TLS even on the same network, and behind a reverse proxy set trusted_proxies and have the proxy send X-Forwarded-Forrecordings/、logs/（包含備份）Set retention: clean up recordings/ and logs/ on schedule, backups included| 法規或標準Law or standard | 規範或驗證什麼What it governs or certifies | 本工具箱幫得上的What the toolbox provides | 你的組織要補的What your organization adds |
|---|---|---|---|
| 個人資料保護法（台灣）Personal Data Protection Act (Taiwan) | 告知、蒐集處理利用要有特定目的與法定要件、安全維護、當事人權利Notice, specific purpose and legal grounds for collection and use, security, data-subject rights | 可以完全在自有設備處理、存取控制、刪除聲音兩邊一起刪Can run entirely on your hardware, access control, voice deletion on both sides | 告知（第 8 條各款）與合法依據、保存期限、安全維護措施、當事人請求的處理流程Notice (all items of Article 8) and legal grounds, retention, security measures, handling data-subject requests |
| GDPR（部署與處理活動落在其適用範圍時，見第 3 條）GDPR (where your deployment and processing fall within its scope, see Article 3) | 合法依據、資料最小化、當事人權利、跨境傳輸Lawful basis, minimization, data-subject rights, transfers | 可以完全在自有設備處理、不需要送往第三方 AI 服務Can run entirely on your hardware; no third-party AI service needed | 合法依據與處理活動紀錄、告知（第 13、14 條）、刪除與查詢請求的處理、必要時的影響評估；依實際部署判斷有沒有跨境傳輸Lawful basis and records of processing, information (Articles 13, 14), erasure and access requests, impact assessments where needed; whether data crosses borders depends on your deployment |
| ISO/IEC 27001:2022（資訊安全管理）ISO/IEC 27001:2022 (information security) | 組織在指定範圍內的資訊安全管理制度The organization's information security management system within a defined scope | 存取控制、加密連線（WebUI 可選、REST API 預設）、資料可以留在內網、API 依呼叫端隔離、變更紀錄Access control, TLS (optional for the WebUI, default for the REST API), data can stay on your LAN, per-client API isolation, a changelog | 列入資產清單與風險評估、適用性聲明、網路隔離、備份、日誌與事件處理、內部稽核Asset inventory and risk assessment, Statement of Applicability, network segmentation, backups, logging and incident handling, internal audit |
| ISO/IEC 42001:2023（AI 管理）ISO/IEC 42001:2023 (AI management) | 組織的 AI 管理制度The organization's AI management system | 模型清單與授權、公開的實測與限制、摘要可追溯到原文、找不到依據的內容不輸出或標示、可以完全在自有設備執行Model inventory and licenses, published benchmarks and limits, summaries traceable to the transcript, ungrounded content dropped or flagged, can run entirely on your hardware | AI 使用政策與範圍、風險與影響評估、人工覆核流程、人員訓練、使用監控與問題回報AI policy and scope, risk and impact assessment, human review, training, monitoring and issue reporting |
ISO/IEC 27001:2022 與 ISO/IEC 42001:2023 的逐條對照見下面兩節：27001:2022 附錄 A、42001:2023 條文與附錄 A。Clause-by-clause mappings follow: ISO/IEC 27001:2022 Annex A and ISO/IEC 42001:2023 clauses and Annex A.
跟本工具箱有關的控制項：本工具箱提供了什麼、你的組織要做什麼。可以做為撰寫適用性聲明（SoA）、風險處理與稽核準備的參考；控制項適不適用、怎麼落實，由你的組織決定。Controls related to the toolbox: what it provides and what your organization does. Use it as input for your Statement of Applicability, risk treatment and audit preparation; applicability and implementation are your organization's decision.
「本工具箱提供的」只是控制措施的一部分或佐證，不代表那個控制項已經落實；標「部分」的只涵蓋其中一小部分。What the toolbox provides is part of a control or supporting evidence, not proof that the control is implemented; rows marked Partial cover only a small part of it.
編號與英文名稱依 ISO/IEC 27001:2022 附錄 A（與 ISO/IEC 27002:2022 相同）。中文名稱是本頁的說明，正式譯名以標準的中文版為準。Numbers and titles follow ISO/IEC 27001:2022 Annex A (the same as ISO/IEC 27002:2022).
| 控制項Control | 本工具箱提供的What the toolbox provides | 你的組織要做的What your organization does |
|---|---|---|
| 5.9 資訊及相關資產清冊Inventory of information and other associated assets5.9 Inventory of information and other associated assets | 資料固定存在幾個位置：recordings/、logs/、tts_voices/、config.json（伺服器版的 REST API 另有 api_data/）；使用的模型與授權列在文件Data lives in fixed places: recordings/, logs/, tts_voices/, config.json (plus api_data/ for the REST API); models and licenses are documented | 把這些資料、GPU 伺服器、LLM 伺服器列入資產清冊，指定負責人Add this data and the GPU and LLM servers to your asset inventory with owners |
| 5.14 資訊傳送Information transfer5.14 Information transfer | 內容只送到你設定的 GPU 伺服器與 LLM 伺服器；WebUI 可以開 TLS，REST API 預設加密；字幕轉發預設關閉。GPU 伺服器的連線是 HTTP、沒有加密，LLM 伺服器預設也是 HTTP（v2.31.4 起可用 https）Content goes only to the GPU and LLM servers you configure; the WebUI can use TLS and the REST API uses it by default; subtitle forwarding is off by default. The GPU server connection is plain HTTP, not encrypted; the LLM server connection is HTTP by default (https can be used since v2.31.4) | 規定哪些內容可以傳到哪裡；GPU 伺服器與 LLM 伺服器的連線放在內網或 VPNDecide what may go where; keep GPU and LLM server traffic on your LAN or a VPN |
| 5.15 存取控制Access control5.15 Access control | WebUI 分管理與唯讀兩種密碼、可以限制允許連線的 IP；安全設定、轉發等含認證的設定頁只能在本機打開（放在反向代理後面時要設定信任的代理）WebUI admin and read-only passwords and an IP allow-list; pages holding credentials (security, forwarding) open only on the local machine (behind a reverse proxy, trusted proxies must be configured) | 訂出誰可以使用、從哪裡連線Define who may use it and from where |
| 5.17 鑑別資訊Authentication information5.17 Authentication information | 密碼與 API 金鑰只存雜湊；日誌不記錄金鑰與授權標頭Passwords and API keys are stored only as hashes; logs never contain keys or authorization headers | 密碼強度、保管與更換方式Password strength, safekeeping and rotation |
| 5.18 存取權限Access rights5.18 Access rights | REST API 每個串接的系統一把金鑰，可以個別撤銷One REST API key per integrated system, revocable individually | 定期檢視金鑰與密碼，不用的撤銷Review keys and passwords regularly; revoke unused ones |
| 5.19、5.21 供應者關係、ICT 供應鏈Information security in supplier relationships; Managing information security in the ICT supply chain5.19, 5.21 Information security in supplier relationships; Managing information security in the ICT supply chain | 原始碼公開（Apache-2.0）可以自行稽核；使用的模型與授權列在文件（NLLB 600M 僅限非商業用途）Open source (Apache-2.0) and auditable; models and their licenses are documented (NLLB 600M is non-commercial only) | 把本工具箱與它使用的模型、套件列入供應者評估Include the toolbox, its models and packages in supplier assessment |
| 5.23 使用雲端服務之資訊安全Information security for use of cloud services5.23 Information security for use of cloud services | 不需要任何雲端 AI 服務，模型都可以在自己的設備上執行No cloud AI service is needed; models can run on your hardware | 如果把 GPU 伺服器或 LLM 伺服器放在雲端或外部主機，依這個控制項評估If you host the GPU or LLM server in a cloud or outside, assess it under this control |
| 5.34 隱私及個人可識別資訊保護Privacy and protection of PII5.34 Privacy and protection of PII | 資料可以留在自有設備；刪除聲音時本機與 GPU 伺服器的快取一起刪；REST API 有保存期限Data can stay on your hardware; deleting a voice also deletes the GPU server's cache; the REST API has retention limits | 告知與合法依據、保存期限、當事人請求的處理Notice and legal grounds, retention, data-subject requests |
| 5.37 文件化操作程序Documented operating procedures5.37 Documented operating procedures | 操作手冊：安裝、升級、設定、各種模式的操作The manual covers install, upgrade, settings and every mode | 依組織環境寫成內部程序（誰安裝、誰升級、怎麼備份與還原）Turn it into internal procedures: who installs, who upgrades, how to back up and restore |
| 8.2 特權存取權限Privileged access rights8.2 Privileged access rights | 管理密碼才能開始、停止、改設定，唯讀密碼只能看字幕；伺服器版的服務以安裝資料夾的擁有者身分執行，不會因為用 sudo 安裝就以 root 執行Only the admin password can start, stop or change settings; read-only can just watch; the server edition runs as the install folder's owner, not root just because sudo was used | 管理密碼只給需要的人Give the admin password only to those who need it |
| 8.3 資訊存取限制Information access restriction8.3 Information access restriction | REST API 每個呼叫端只看得到自己送的作業Each REST API client sees only its own jobs | 依用途分配金鑰，不共用Issue keys per purpose; never share them |
| 8.5 安全鑑別Secure authentication8.5 Secure authentication | WebUI 與 REST API 受保護的功能要先輸入密碼或金鑰才能使用（WebUI 沒設密碼時啟動會提醒）Protected WebUI and REST API functions require authentication (the WebUI warns at startup when no password is set) | 設定密碼；開啟 TLS（同網段也建議）Set passwords; turn on TLS (on the same network too) |
| 8.8 技術脆弱性管理Management of technical vulnerabilities8.8 Management of technical vulnerabilities | 安全性修正記在 CHANGELOG；--upgrade 升級到最新版Security fixes are listed in the CHANGELOG; --upgrade updates to the latest release | 追蹤新版本並及時升級；作業系統與套件更新Track releases and upgrade promptly; keep the OS and packages updated |
| 8.10 資訊刪除Information deletion8.10 Information deletion | GPU 伺服器辨識完就刪暫存音檔（伺服器當機時可能留在系統暫存資料夾）；REST API 確認收到後刪除作業內容、沒確認的 7 天後刪除；刪除聲音兩邊一起刪（伺服器連不上時下次朗讀補刪）。都是一般刪除檔案，不是不可復原的抹除The GPU server deletes temporary audio after recognition (a crash may leave it in the system temp folder); the REST API deletes job content after acknowledgement or after 7 days; voices are deleted on both sides (if the server is unreachable, at the next reading). These are ordinary file deletions, not secure erasure | 依保存期限刪除 recordings/、logs/ 與備份；需要不可復原的抹除時用磁碟加密與媒體報廢程序Delete recordings/, logs/ and backups on your retention schedule; use disk encryption and media disposal procedures where secure erasure is needed |
| 8.12 資料洩露預防（部分）Data leakage prevention8.12 Data leakage prevention | WebUI 不載入外部的字型、腳本或追蹤程式；REST API 從網址抓音檔只允許設定好的主機（主要是防止被拿來探測內網）。這些不是資料外洩防護（DLP）系統Partial. The WebUI loads no outside fonts, scripts or trackers; the REST API fetches audio URLs only from allowed hosts (mainly to prevent probing your network). This is not a data leakage prevention (DLP) system | 端點與網路的資料外洩防護Endpoint and network data leakage prevention |
| 8.15 日誌（部分）Logging8.15 Logging | REST API 記錄每個請求（含授權失敗與來源 IP）與每件作業的每個步驟，不記錄金鑰、授權標頭、詞彙庫與逐字稿內容。WebUI 的登入失敗與設定變更、REST API 金鑰的新增與撤銷目前沒有記錄Partial. The REST API logs every request (including authorization failures and source IP) and every job step, never keys, authorization headers, glossaries or transcript text. WebUI login failures and settings changes, and REST API key creation and revocation, are not logged yet | 日誌的保存期限、集中保存、定期檢視；需要時用主機或反向代理的存取紀錄補上 WebUI 的部分Log retention, central collection and review; use host or reverse-proxy access logs to cover the WebUI where needed |
| 8.20、8.22 網路安全、網路區隔Networks security; Segregation of networks8.20, 8.22 Networks security; Segregation of networks | WebUI 可以限制允許連線的 IP；放在反向代理後面時，設定信任的代理（trusted_proxies）後只採信這些代理轉來的來源位址The WebUI can restrict client IPs; behind a reverse proxy, once trusted proxies (trusted_proxies) are set, only forwarded addresses from those proxies are believed | GPU 伺服器與 LLM 伺服器放在內網，防火牆只開給需要的電腦，跨網段走 VPN；用反向代理時設定 trusted_proxiesKeep GPU and LLM servers internal, firewalled to the machines that need them, with a VPN across networks; set trusted_proxies when using a reverse proxy |
| 8.24 密碼技術之使用Use of cryptography8.24 Use of cryptography | TLS（WebUI 可選、預設關閉；REST API 預設開啟；可以換成組織自己的憑證）；密碼與金鑰以雜湊保存。GPU 伺服器的連線沒有加密、LLM 伺服器預設也沒有（v2.31.4 起可用 https）；LLM 伺服器的 API 金鑰以明文存在 config.jsonTLS (optional and off by default for the WebUI, on by default for the REST API; your own certificate can be used); passwords and keys stored as hashes. The GPU server connection is not encrypted and the LLM server's is not by default (https can be used since v2.31.4); the LLM server API key is stored in plain text in config.json | 憑證管理；磁碟加密；GPU 與 LLM 伺服器的連線放在內網或 VPNCertificate management; disk encryption; keep GPU and LLM server traffic on your LAN or a VPN |
| 8.29 開發及驗收中之安全測試Security testing in development and acceptance8.29 Security testing in development and acceptance | 每次發版前跑守門測試（三個平台、升級、全新安裝、WebUI 授權檢查）；測試程式與結果沒有公開A release gate runs before every release (three platforms, upgrade, fresh install, WebUI authorization checks); the tests and results are not published | 導入與升級前在自己的環境驗收Run acceptance tests in your environment before adopting or upgrading |
| 8.32 變更管理Change management8.32 Change management | 每一版的改動記在 CHANGELOG；已安裝的模型與套件不會自己更新（朗讀模型固定版本，其他模型與套件在安裝時取得當時的版本）；升級由管理者執行，GPU 伺服器的自動更新預設關閉Every change is in the CHANGELOG; installed models and packages never update themselves (text-to-speech models are pinned, other models and packages are whatever was current at install time); upgrades are run by an administrator and GPU server auto-update is off by default | 升級前看 CHANGELOG、先在測試環境試、排定升級時間、保留前一版以便還原Read the CHANGELOG, try upgrades in a test environment first, schedule them and keep the previous version for rollback |
recordings/、logs/、tts_voices/、config.json（伺服器版另有 api_data/），定期測試還原8.13 Information backup: back up recordings/, logs/, tts_voices/, config.json (and api_data/) and test restores條文（第 4～10 章）是 AI 管理制度本身的要求，附錄 A 是控制項。使用本工具箱的組織通常是自己架設、自己使用 AI 系統，下面列出本工具箱可以做為依據或輸入的部分。Clauses 4 to 10 are requirements for the AI management system itself; Annex A lists controls. Organizations using the toolbox usually host and use the AI system themselves; below is what the toolbox can serve as evidence or input for.
同樣只是部分支援或佐證；標「部分」的只涵蓋其中一小部分。Again this is partial support or evidence; rows marked Partial cover only a small part.
編號與英文名稱依 ISO/IEC 42001:2023。中文名稱是本頁的說明，正式譯名以標準的中文版為準。Numbers and titles follow ISO/IEC 42001:2023.
| 條文Clause | 本工具箱提供的What the toolbox provides | 你的組織要做的What your organization does |
|---|---|---|
| 4.3 決定 AI 管理系統的範圍Determining the scope of the AI management system4.3 Determining the scope of the AI management system | 文件列出哪些功能用到 AI（語音辨識、翻譯、摘要、講者辨識、朗讀）、各在哪台設備上執行The docs list which features use AI (speech recognition, translation, summaries, diarization, text-to-speech) and where each runs | 決定本工具箱是否納入範圍、用在哪些部門與場合Decide whether the toolbox is in scope and where it is used |
| 6.1.2、8.2 AI 風險評估AI risk assessment6.1.2, 8.2 AI risk assessment | BENCHMARKS.md 公開準確度與已知限制，包括哪些情況會出錯BENCHMARKS.md publishes accuracy and known limits, including when it goes wrong | 依組織的用途評估風險並留下紀錄Assess risks for your use and keep records |
| 6.1.4、8.4 AI 系統影響評估AI system impact assessment6.1.4, 8.4 AI system impact assessment | 同上；「你的組織使用後要做的」檢查清單（告知與合法依據、人工覆核、合成語音）As above, plus the checklist on this page (notice and legal grounds, human review, synthetic speech) | 評估對與會者與對外的影響並文件化Assess and document the impact on participants and others |
| 7.5 文件化資訊Documented information7.5 Documented information | README、操作手冊、BENCHMARKS、CHANGELOG、本頁、REST API 介面規格README, manual, BENCHMARKS, CHANGELOG, this page and the REST API specification | 納入組織的文件管理Bring them under your document control |
| 9.1 監督、量測、分析及評估Monitoring, measurement, analysis and evaluation9.1 Monitoring, measurement, analysis and evaluation | BENCHMARKS 寫明量測方法（語料、指標），可以做為自己量測的參考BENCHMARKS describes the method (corpora, metrics) as a reference for your own measurements | 用自己的錄音定期確認品質是否夠用Check quality on your own recordings regularly |
| 控制項Control | 本工具箱提供的What the toolbox provides | 你的組織要做的What your organization does |
|---|---|---|
| A.4.2、A.4.4、A.4.5 資源文件化、工具資源、系統與運算資源Resource documentation; Tooling resources; System and computing resourcesA.4.2, A.4.4, A.4.5 Resource documentation; Tooling resources; System and computing resources | 使用的模型、推論引擎、授權與硬體需求列在 README、操作手冊與本頁Models, inference engines, licenses and hardware needs are in the README, the manual and this page | 依此建立組織的 AI 資源清單Build your AI resource inventory from them |
| A.4.3 資料資源Data resourcesA.4.3 Data resources | 不拿你的資料訓練或微調模型；資料存放位置固定Your data is never used to train or fine-tune models; storage locations are fixed | 記錄哪些資料會進到 AI 系統（錄音、逐字稿、聲音）Record which data enters the AI system (audio, transcripts, voices) |
| A.5.2～A.5.5 AI 系統影響評估AI system impact assessment (process, documentation, individuals, society)A.5.2–A.5.5 AI system impact assessment (process, documentation, individuals, society) | BENCHMARKS 的已知限制與本頁的檢查清單可以做為評估的輸入Known limits in BENCHMARKS and the checklist on this page are inputs | 進行評估、文件化，並定期更新Run, document and update the assessment |
| A.6.2.4 AI 系統驗證與確認AI system verification and validationA.6.2.4 AI system verification and validation | 公開的實測（辨識錯誤率、講者辨識錯誤率、使用的語料與方法）；發版前的守門測試（結果沒有公開）Published measurements (recognition and diarization error rates, corpora and methods); the release gate (results not published) | 導入前用自己的錄音驗證是否夠用Validate on your own recordings before adopting it |
| A.6.2.5、A.6.2.6 AI 系統部署、運作及監督AI system deployment; AI system operation and monitoringA.6.2.5, A.6.2.6 AI system deployment; AI system operation and monitoring | 操作手冊的部署方式；用戶端與 GPU 伺服器版本不一致時會提醒；處理失敗時畫面會顯示（例如翻譯失敗照樣顯示原文並標示）Documented deployment; a warning when client and GPU server versions differ; failures are shown (a failed translation still shows the source, marked) | 部署計畫、運作監督、問題回報管道Deployment plan, operational monitoring, issue reporting |
| A.6.2.7 AI 系統技術文件AI system technical documentationA.6.2.7 AI system technical documentation | README、操作手冊、REST API 介面規格（jtlw_api/schemas/）README, manual, REST API specification (jtlw_api/schemas/) | 依需要提供給相關人員Provide it to the people who need it |
| A.6.2.8 AI 系統事件紀錄（部分）AI system recording of event logsA.6.2.8 AI system recording of event logs | REST API 的日誌記錄每個請求與每件作業的每個步驟（時間、狀態、錯誤）；用戶端與 GPU 伺服器版本不一致時會提醒。WebUI 與命令列沒有另外的事件紀錄（錯誤顯示在畫面與終端機）；逐字稿與摘要是工作產出，不是事件紀錄Partial. REST API logs record every request and every job step (time, status, errors); a warning appears when client and GPU server versions differ. The WebUI and command line keep no separate event log (errors are shown on screen and in the terminal); transcripts and summaries are work output, not event logs | 決定要記錄哪些事件（作業、使用的模型與版本、錯誤、操作）、保存多久、誰可以看；需要時用主機的紀錄補上Decide which events to record (jobs, models and versions used, errors, operations), how long to keep them and who can read them; use host logs to fill gaps |
| A.7.3、A.7.5 資料取得、資料來源（部分）Acquisition of data; Data provenanceA.7.3, A.7.5 Acquisition of data; Data provenance | 匯入朗讀用的聲音時記錄同意聲明與錄音來源（程式不查驗同意書）；內建聲音是 AI 依文字描述產生；BENCHMARKS 列出實測用的公開語料與授權。上游模型的訓練資料以各模型自己的說明為準，本工具箱沒有額外資訊Partial. Importing a voice records the consent statement and the recording's source (the consent form itself is not checked); built-in voices are AI-generated; BENCHMARKS lists the public corpora used and their licenses. For upstream models' training data, see each model's own documentation; the toolbox has no further information | 保存同意書；記錄進到 AI 系統的資料（錄音、逐字稿、聲音）從哪裡來；評估上游模型訓練資料的已知資訊與缺口Keep consent forms; record where data entering the AI system (audio, transcripts, voices) comes from; assess what is known and unknown about upstream training data |
| A.8.2 給使用者的系統文件及資訊System documentation and information for usersA.8.2 System documentation and information for users | 文件與畫面說明用途與限制；AI 輸出用在重要場合前要人工確認Docs and on-screen text explain purpose and limits; AI output needs human review before important use | 讓使用者知道限制與正確用法Make sure users know the limits and proper use |
| A.8.5 給利害關係人的資訊Information for interested partiesA.8.5 Information for interested parties | 雙向語音口譯第一次念給對方聽之前，預設先說明這是 AI 口譯Two-way interpretation tells the other side it is an AI interpreter before speaking, by default | 會議前告知與會者有 AI 轉錄、翻譯或口譯Tell participants before the meeting that AI transcription, translation or interpretation is used |
| A.9.2、A.9.4 負責任使用 AI 系統的流程、預期用途Processes for responsible use of AI systems; Intended use of the AI systemA.9.2, A.9.4 Processes for responsible use of AI systems; Intended use of the AI system | 摘要可以追溯到原文，引用驗證不過的不輸出、找不到依據的數字或名詞會標示；校正後保留原始辨識結果，方便人工覆核Summaries trace back to the transcript, unverified citations are dropped and ungrounded numbers or names flagged; raw recognition is kept for human review | 訂出 AI 使用政策、預期用途與人工覆核流程Set an AI use policy, intended use and a human review process |
| A.10.3 供應者SuppliersA.10.3 Suppliers | 原始碼公開；上游模型、套件與授權列在文件（NLLB 600M 僅限非商業用途）Open source; upstream models, packages and licenses documented (NLLB 600M is non-commercial only) | 把本工具箱與它使用的模型、套件列入供應者評估Include the toolbox, its models and packages in supplier assessment |