Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
5 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-014 | AI acceptable use policy A policy approved by top management states what AI use is permitted, what is prohibited, what every system must pass through, who is accountable, and where to take a case the policy does not settle. | 02 Governance & Accountability | Directive |
| C-051 | AI risk appetite statement and limits The board approves a statement of the AI risk the organisation will accept, with measurable limits that trigger escalation when they are approached. | 01 Strategy & Risk Appetite | Directive |
| C-053 | AI risk reporting to the board Key risk indicators, incidents, exceptions and the state of the inventory are reported to the board or its committee on a set cycle, in a form that supports challenge. | 01 Strategy & Risk Appetite | Detective |
| C-052 | AI use-case intake and approval Every proposed AI use is registered, screened, tiered and approved by a named authority before build or purchase begins, and again before it goes live. | 01 Strategy & Risk Appetite | Preventive |
| C-104 | Workforce impact assessment and involvement Before AI is deployed in ways that change work, its effect on roles, skills, working conditions and monitoring of staff is assessed, with the people affected and their representatives informed and heard. | 12 Skills, Capability & Culture | Directive |