Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
105 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-036 | Abuse monitoring Usage of an AI system is analysed for patterns of misuse, extraction or attack, and accounts are restricted when such patterns are detected. | 10 Security & Resilience | Detective |
| C-079 | Accessibility and inclusive design review AI-driven channels are designed and tested with assistive technology and with people who have access needs before release, and an equivalent alternative route is kept available. | 07 Fairness & Customer Outcomes | Preventive |
| C-006 | Adversarial robustness testing A defined battery of adversarial tests is run against an AI system before release and after every material change, and release depends on the results. | 10 Security & Resilience | Preventive |
| C-028 | Agent action tracing Every agent action is recorded with the instruction, plan, tool call, result and identity that produced it, in a form that allows the sequence to be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-027 | Agent memory controls What an agent may write to persistent memory is restricted, validated and attributed, and stored memory can be inspected, corrected and cleared. | 10 Security & Resilience | Preventive |
| C-025 | Agent sandboxing and isolation Code execution and tool use by agents run in isolated environments with restricted network, file and system access, so that a failure is contained where it occurs. | 10 Security & Resilience | Preventive |
| C-026 | Agent tool and skill vetting Tools, skills and connectors are reviewed, scanned and approved before an agent may load them, are loaded only from approved sources, and are re-reviewed when they change. | 06 Third Party & Supply Chain | Preventive |
| C-014 | AI acceptable use policy A policy approved by top management states what AI use is permitted, what is prohibited, what every system must pass through, who is accountable, and where to take a case the policy does not settle. | 02 Governance & Accountability | Directive |
| C-085 | AI bill of materials The models, datasets, libraries, tools and hosted components that make up each AI system are recorded and checked against known vulnerabilities, licence terms and supplier changes. | 06 Third Party & Supply Chain | Detective |
| C-044 | AI change management Changes to models, prompts, data sources, tools and configuration are assessed, tested, approved and versioned before they reach production. | 05 Model & System Lifecycle | Preventive |
| C-067 | AI competence and resourcing plan The skills, people, tooling and budget needed to build, validate, operate and oversee the organisation's AI are identified, compared with what exists, and the gaps are closed or the ambition reduced. | 12 Skills, Capability & Culture | Directive |
| C-083 | AI contract terms Contracts with AI suppliers cover data use, change notification, information and audit rights, sub-contracting, incident notification, liability and exit. | 06 Third Party & Supply Chain | Directive |
| C-091 | AI cost and capacity monitoring Usage, latency and spend for each AI system are tracked against budgets and limits, with alerts and automatic caps before a limit is breached. | 11 Monitoring, Assurance & Incidents | Detective |
| C-049 | AI decommissioning procedure Retirement of an AI system follows a plan that covers dependent processes, disposal of data and model artefacts, retention of records and any continuing obligations. | 05 Model & System Lifecycle | Directive |
| C-089 | AI failure scenario testing Severe but plausible AI failure scenarios are exercised against impact tolerances on a set cycle, and the lessons are acted on. | 10 Security & Resilience | Detective |
| C-054 | AI governance forum and escalation A committee with defined membership, authority and escalation routes decides on high-tier approvals, risk acceptance and exceptions, and reports to the board. | 02 Governance & Accountability | Directive |
| C-015 | AI impact assessment process A structured assessment of an AI system's effect on individuals, groups and society is completed and signed off before deployment, and revisited when the system or its use changes. | 03 Regulatory & Legal Compliance | Directive |
| C-092 | AI incident classification and playbooks The kinds of AI failure are defined in the incident process with severity criteria, each has a playbook, and responders are trained and exercised in using them. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-003 | AI incident response and rollback When an AI system fails or produces harmful output, a defined procedure contains it, restores a known good state, preserves the evidence and manages the consequences. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-055 | AI inventory and registration All AI systems and models, whether built, bought or embedded in other products, are recorded with owner, purpose, tier, data, supplier and status, and the record is reconciled periodically. | 02 Governance & Accountability | Detective |
| C-016 | AI literacy programme Everyone who uses, relies on or makes decisions about AI receives training in what these systems are, how they fail and what the organisation's rules require. | 12 Skills, Capability & Culture | Directive |
| C-017 | AI ownership and accountability framework Every AI system has a named individual accountable for it as a whole, and a named senior individual is accountable for AI risk across the organisation, with defined reporting lines. | 02 Governance & Accountability | Directive |
| C-058 | AI policy exception management Departures from AI policy are requested in writing, risk-accepted by a named owner at the right level, time-limited, and tracked until they are closed. | 02 Governance & Accountability | Directive |
| C-064 | AI record-keeping and audit trail Inputs, outputs, model and prompt versions, decisions and human interventions are recorded automatically and retained for a defined period, so that any past event can be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-032 | AI red teaming People skilled in attacking AI systems try to make the system fail as an adversary would, before release and periodically, and their findings are tracked to closure. | 10 Security & Resilience | Detective |
| C-059 | AI regulatory obligations register and horizon scanning The AI obligations that apply to the organisation, and the dates from which they apply, are recorded, mapped to controls and owners, and updated as the law and guidance change. | 03 Regulatory & Legal Compliance | Directive |
| C-051 | AI risk appetite statement and limits The board approves a statement of the AI risk the organisation will accept, with measurable limits that trigger escalation when they are approached. | 01 Strategy & Risk Appetite | Directive |
| C-053 | AI risk reporting to the board Key risk indicators, incidents, exceptions and the state of the inventory are reported to the board or its committee on a set cycle, in a form that supports challenge. | 01 Strategy & Risk Appetite | Detective |
| C-056 | AI risk tiering and classification Each system is assigned an internal risk tier and a regulatory class by documented criteria, the result is reviewed independently, and it is revisited whenever the system or its use changes. | 02 Governance & Accountability | Directive |
| C-001 | AI system monitoring and logging Every production AI system is instrumented to record its inputs, outputs, errors and usage, with thresholds that raise alerts to a named owner who must act. | 11 Monitoring, Assurance & Incidents | Detective |
| C-018 | AI transparency and disclosure labelling People are told, clearly and at the point of contact, when they are dealing with an AI system and when content they are shown was generated by one. | 08 Transparency & Explainability | Directive |
| C-052 | AI use-case intake and approval Every proposed AI use is registered, screened, tiered and approved by a named authority before build or purchase begins, and again before it goes live. | 01 Strategy & Risk Appetite | Preventive |
| C-023 | Approval gates for high-impact agent actions Before an agent takes an action above a defined impact threshold, or one that cannot be reversed, a designated person reviews the exact action and approves or rejects it. | 09 Human Oversight & Contestability | Preventive |
| C-019 | Automated decision-making safeguards Significant decisions taken with no meaningful human involvement are identified, and each has the safeguards the law requires: information, a chance to make representations, human intervention and a means to contest. | 09 Human Oversight & Contestability | Directive |
| C-007 | Bias testing and fairness monitoring A system's performance and outcomes are measured separately for each relevant group before release and on a set cycle in production, against thresholds that trigger investigation. | 07 Fairness & Customer Outcomes | Detective |
| C-035 | Content safety filtering Inputs and outputs are classified against defined harm categories by a mechanism independent of the main model, and are blocked, modified or escalated according to policy. | 10 Security & Resilience | Preventive |
| C-102 | Contestability and appeals process People affected by an AI-supported decision can challenge it and have it reviewed afresh by someone with the authority, information and independence to change it. | 09 Human Oversight & Contestability | Corrective |
| C-076 | Customer outcome monitoring The outcomes customers receive from AI-driven journeys are measured, broken down by customer group and compared with other channels, and poor outcomes are investigated and acted on. | 07 Fairness & Customer Outcomes | Detective |
| C-080 | Customer remediation for AI errors When an AI error is found, all affected customers are identified, told, and put back in the position they should have been in, whether or not they complained. | 07 Fairness & Customer Outcomes | Corrective |
| C-020 | Data minimisation and lawful basis review Before personal data is used to train, fine-tune, ground or run an AI system, a documented review confirms the lawful basis, the compatibility of the purpose and that only necessary data is used. | 04 Data & Data Governance | Directive |
| C-074 | Data protection impact assessment for AI A data protection impact assessment is completed before AI processing that is likely to result in high risk to individuals begins, and is kept current as the system changes. | 03 Regulatory & Legal Compliance | Directive |
| C-068 | Data quality and representativeness checks Training, test and reference data are assessed for accuracy, completeness, currency and coverage of the population the system will serve, before use and at each refresh. | 04 Data & Data Governance | Detective |
| C-073 | Data subject rights handling for AI A tested procedure locates and acts on a person's data in training sets, vector stores, logs and outputs when an access, rectification, erasure or objection request is received. | 04 Data & Data Governance | Corrective |
| C-069 | Dataset documentation Each dataset used for AI has a maintained record of its source, collection method, contents, rights, lawful basis, known limitations and permitted uses. | 04 Data & Data Governance | Directive |
| C-039 | Deepfake-resistant verification Identity and instruction verification never rests on voice, image or video alone, and high-value actions require confirmation through a separate, pre-agreed channel. | 10 Security & Resilience | Preventive |
| C-050 | Drift and performance monitoring Input distributions and output quality are measured in production against thresholds that trigger investigation, retraining or withdrawal. | 11 Monitoring, Assurance & Incidents | Detective |
| C-087 | Embedded AI feature review Supplier release notes, terms and product settings are monitored for new AI features in products already in use, and each feature is assessed and approved before it is enabled. | 06 Third Party & Supply Chain | Detective |
| C-078 | Escalation to a human Automated channels offer a prompt, unobstructed route to a person, available on request and triggered automatically by defined signals, with the conversation handed over. | 09 Human Oversight & Contestability | Preventive |
| C-043 | Evaluation suite and regression testing A maintained set of test cases with expected results is run on every change to model, prompt, data or tools, and the results are compared with the approved baseline. | 05 Model & System Lifecycle | Detective |
| C-098 | Explanation method validation The techniques used to explain a model are tested to confirm that they reflect the model's actual behaviour before explanations are relied on internally or given to anyone. | 08 Transparency & Explainability | Detective |
| C-097 | Explanations for affected individuals People subject to an AI-supported decision receive a meaningful explanation of what was decided, the main reasons in their case and how to challenge it. | 08 Transparency & Explainability | Directive |
| C-008 | Factuality and hallucination verification Claims, figures and citations in AI-generated output are checked against a trusted source before the output is relied on for a consequential decision or sent to a customer. | 05 Model & System Lifecycle | Detective |
| C-075 | Fairness requirements and metric selection For each system that affects people, the relevant groups, the legal test, the fairness measures and their thresholds are defined and justified before testing begins. | 07 Fairness & Customer Outcomes | Directive |
| C-088 | Fallback and manual workaround A tested alternative, such as a manual process, a simpler model or a degraded mode, is ready to take over when an AI component fails or has to be withdrawn. | 10 Security & Resilience | Corrective |
| C-090 | Feedback and complaints channel for AI Users and affected people can report a problem with an AI system easily, and reports are triaged, linked to the system concerned and analysed for patterns. | 11 Monitoring, Assurance & Incidents | Detective |
| C-061 | High-risk conformity assessment and registration High-risk AI systems complete the required conformity assessment, declaration, marking and registration before they are placed on the market or used, and again after substantial modification. | 03 Regulatory & Legal Compliance | Preventive |
| C-094 | Human override and stop mechanism A designated person can pause, override or shut down an AI system at any time through a tested mechanism, with the authority to do so settled in advance. | 09 Human Oversight & Contestability | Corrective |
| C-002 | Human-in-the-loop review Consequential AI outputs and decisions are reviewed by a competent person, with the time, information and authority to change them, before they take effect. | 09 Human Oversight & Contestability | Preventive |
| C-021 | Important business service impact-tolerance mapping The AI components each important business service depends on are identified in the resilience map, and impact tolerances are set that cover AI-specific disruption, including a model that is running and wrong. | 10 Security & Resilience | Directive |
| C-063 | Independent assurance and internal audit of AI Second-line review and internal audit cover AI governance and the highest-tier systems on a risk-based plan, test systems as well as documents, and track their findings to closure. | 11 Monitoring, Assurance & Incidents | Detective |
| C-041 | Independent model validation A function independent of the developers tests each model's conceptual soundness, data, performance and limitations before approval and periodically afterwards, to a depth set by the model's tier. | 05 Model & System Lifecycle | Detective |
| C-009 | Inference usage quotas and rate limiting Limits on request rate, input size, output size and spend are enforced for each user, tenant and system, with alerts as limits are approached. | 10 Security & Resilience | Preventive |
| C-099 | Information for deployers and users Those who operate and use an AI system receive current, usable instructions covering its purpose, performance, limitations, the meaning of its outputs and the oversight it needs. | 08 Transparency & Explainability | Directive |
| C-029 | Input filtering and injection defence User input and all retrieved or tool-supplied content are screened for hostile instructions and passed to the model marked as data, separate from the system's own instructions. | 10 Security & Resilience | Preventive |
| C-095 | Intellectual property and licence clearance Training data, models, components and significant outputs are checked for rights and licence terms before they are used, published or shipped. | 03 Regulatory & Legal Compliance | Preventive |
| C-047 | Intended-use definition and use restrictions The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins. | 05 Model & System Lifecycle | Directive |
| C-024 | Least-privilege agent identity and permissions Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement. | 10 Security & Resilience | Preventive |
| C-031 | Model and data access control Access to model weights, training data, pipelines and inference endpoints is granted by role, limited to need, logged and reviewed. | 10 Security & Resilience | Preventive |
| C-046 | Model and system documentation Each AI system's purpose, design, data, test results and limitations are documented to a set standard that allows a validator, auditor or regulator to understand it without its authors. | 05 Model & System Lifecycle | Directive |
| C-010 | Model artifact signing and integrity verification Approved model artefacts are cryptographically signed at validation, and the signature is verified before an artefact is loaded anywhere in production. | 10 Security & Resilience | Preventive |
| C-084 | Model version pinning and change notification Hosted models are called by a fixed version, and a provider's new version is adopted only after the organisation's own regression tests have passed. | 06 Third Party & Supply Chain | Preventive |
| C-086 | Ongoing AI vendor monitoring Each AI supplier's performance, incidents, model changes, terms and financial and operational standing are reviewed on a cycle set by how material the supplier is. | 06 Third Party & Supply Chain | Detective |
| C-004 | Output validation and guardrails Every model output is validated against a schema and sanitised by deterministic code before any downstream system, tool or user interface acts on it. | 10 Security & Resilience | Preventive |
| C-066 | Periodic AI review and recertification Each AI system is reassessed on a cycle set by its tier, covering use, performance, risk and controls, and its approval lapses if the review is not completed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-071 | Personal data redaction and pseudonymisation Personal data is removed, masked or pseudonymised before data is used for training, evaluation or logging, unless it is needed and the need is recorded, and the result is tested. | 04 Data & Data Governance | Preventive |
| C-065 | Post-market monitoring plan A documented plan sets out how evidence of a system's performance, use and effects is collected, reviewed and acted on throughout its life. | 11 Monitoring, Assurance & Incidents | Detective |
| C-042 | Pre-deployment testing and acceptance Functional, safety, security and user tests defined in advance must pass, with results recorded, before an AI system is released. | 05 Model & System Lifecycle | Preventive |
| C-081 | Pricing fairness review AI-driven prices and offers are reviewed, before use and on a set cycle, for differences between customer groups that cost or risk does not justify. | 07 Fairness & Customer Outcomes | Detective |
| C-040 | Privacy-preserving training techniques Where training data is personal or confidential, techniques that limit how much a model retains about any single record are applied, and the remaining exposure is measured. | 04 Data & Data Governance | Preventive |
| C-060 | Prohibited-practice screening Every proposed AI use is checked against the practices the law prohibits before it is approved, the check is recorded, and it is repeated when the use changes. | 03 Regulatory & Legal Compliance | Preventive |
| C-070 | Prompt and context data loss prevention Prompts, uploads and retrieved context are inspected before they reach a model, and blocked, redacted or flagged where they contain personal or restricted data. | 04 Data & Data Governance | Preventive |
| C-072 | Prompt and log retention limits Prompts, outputs and conversation histories are kept for defined periods and then deleted, by the organisation and by its providers, with deletion verified. | 04 Data & Data Governance | Preventive |
| C-100 | Public AI transparency record The organisation publishes and maintains a record of its significant AI uses, describing what each is for, what data it uses and what safeguards apply. | 08 Transparency & Explainability | Directive |
| C-062 | Regulatory incident notification AI incidents are assessed against defined reporting criteria, and those that are reportable are notified to the relevant authority, and to the provider or deployer, within the time required. | 03 Regulatory & Legal Compliance | Corrective |
| C-048 | Retrieval grounding and citation The system answers only from retrieved, approved sources, cites the source for each statement, and declines where the sources do not support an answer. | 05 Model & System Lifecycle | Preventive |
| C-038 | Review of AI-generated code Code produced with an AI assistant passes the same human review, security scanning and dependency checks as any other code before it is merged. | 10 Security & Resilience | Detective |
| C-082 | Review of AI-generated communications Customer communications produced by AI are checked against content standards before use, in full or by sampling according to risk, and required wording is enforced. | 07 Fairness & Customer Outcomes | Preventive |
| C-101 | Reviewer effectiveness testing Override rates, review times and seeded test cases are used to confirm that human reviewers actually detect and correct the system's errors. | 09 Human Oversight & Contestability | Detective |
| C-103 | Role-based AI training Reviewers, developers, risk and assurance staff, approvers and front-line teams receive training specific to their AI responsibilities, with competence assessed and completion tracked. | 12 Skills, Capability & Culture | Directive |
| C-093 | Root-cause analysis and lessons learned Significant AI incidents and near misses are analysed for their causes, including the control failures that let them happen, and the resulting actions are tracked to completion. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-034 | Safe model loading and artefact scanning Model files and their dependencies are obtained only from approved sources, scanned before use, and loaded in formats and with settings that cannot execute embedded code. | 10 Security & Resilience | Preventive |
| C-030 | Secrets management for AI Credentials used by AI systems are held in a vault, supplied at run time, kept out of prompts, configuration and notebooks, scoped narrowly and rotated. | 10 Security & Resilience | Preventive |
| C-033 | Secure AI development pipeline The pipelines and tooling that train, evaluate and deploy models are subject to the security controls of production software delivery, including review, scanning and segregation of environments. | 10 Security & Resilience | Preventive |
| C-057 | Shadow AI discovery Network, procurement, expense and software records are reviewed on a set cycle to find AI tools and features in use that are absent from the inventory. | 02 Governance & Accountability | Detective |
| C-105 | Speak-up route for AI concerns Staff can raise concerns about how AI is being built or used, in confidence and without fear of reprisal, and each concern is assessed, investigated where warranted and answered. | 12 Skills, Capability & Culture | Detective |
| C-045 | Staged rollout New AI systems and material changes are released first to a limited population under close monitoring, and extended only when defined criteria are met. | 05 Model & System Lifecycle | Preventive |
| C-096 | Synthetic content marking and provenance Generated and manipulated media carries machine-readable marking and provenance data, a visible disclosure where one is required, and the marking is tested for robustness. | 08 Transparency & Explainability | Preventive |
| C-011 | System prompt hardening System prompts are written to contain no secrets and no security decisions, are placed under version control and review, and are tested against extraction before release. | 10 Security & Resilience | Preventive |
| C-037 | Tenant and session isolation Every stateful component of an AI system, including caches, memory, retrieval indexes and fine-tuned models, is partitioned by customer and user, and the partitioning is tested. | 10 Security & Resilience | Preventive |
| C-005 | Third-party model and vendor due diligence Before an AI supplier, model or dataset is adopted, it is assessed against AI-specific criteria to a depth set by how material the use is, with evidence for the answers. | 06 Third Party & Supply Chain | Directive |
| C-012 | Training data provenance checks The source, collection method, rights and integrity of every dataset are verified and recorded before it is used for training, fine-tuning or retrieval. | 04 Data & Data Governance | Preventive |
| C-013 | Vector store and embedding access controls A retrieval system's vector store is governed as a production data store: access is authenticated and authorised, source permissions are enforced at retrieval, and writes are restricted and recorded. | 04 Data & Data Governance | Preventive |
| C-022 | Vendor exit strategy and concentration management Each material AI supplier has a documented, costed and tested exit plan, and dependence on each provider is measured across the organisation and held within limits. | 06 Third Party & Supply Chain | Directive |
| C-077 | Vulnerable customer safeguards Automated journeys detect indicators of vulnerability, adapt what they do, and route the customer to appropriate human support, with the disclosure recorded. | 07 Fairness & Customer Outcomes | Preventive |
| C-104 | Workforce impact assessment and involvement Before AI is deployed in ways that change work, its effect on roles, skills, working conditions and monitoring of staff is assessed, with the people affected and their representatives informed and heard. | 12 Skills, Capability & Culture | Directive |