Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
12 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-028 | Agent action tracing Every agent action is recorded with the instruction, plan, tool call, result and identity that produced it, in a form that allows the sequence to be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-014 | AI acceptable use policy A policy approved by top management states what AI use is permitted, what is prohibited, what every system must pass through, who is accountable, and where to take a case the policy does not settle. | 02 Governance & Accountability | Directive |
| C-054 | AI governance forum and escalation A committee with defined membership, authority and escalation routes decides on high-tier approvals, risk acceptance and exceptions, and reports to the board. | 02 Governance & Accountability | Directive |
| C-015 | AI impact assessment process A structured assessment of an AI system's effect on individuals, groups and society is completed and signed off before deployment, and revisited when the system or its use changes. | 03 Regulatory & Legal Compliance | Directive |
| C-055 | AI inventory and registration All AI systems and models, whether built, bought or embedded in other products, are recorded with owner, purpose, tier, data, supplier and status, and the record is reconciled periodically. | 02 Governance & Accountability | Detective |
| C-017 | AI ownership and accountability framework Every AI system has a named individual accountable for it as a whole, and a named senior individual is accountable for AI risk across the organisation, with defined reporting lines. | 02 Governance & Accountability | Directive |
| C-058 | AI policy exception management Departures from AI policy are requested in writing, risk-accepted by a named owner at the right level, time-limited, and tracked until they are closed. | 02 Governance & Accountability | Directive |
| C-056 | AI risk tiering and classification Each system is assigned an internal risk tier and a regulatory class by documented criteria, the result is reviewed independently, and it is revisited whenever the system or its use changes. | 02 Governance & Accountability | Directive |
| C-052 | AI use-case intake and approval Every proposed AI use is registered, screened, tiered and approved by a named authority before build or purchase begins, and again before it goes live. | 01 Strategy & Risk Appetite | Preventive |
| C-087 | Embedded AI feature review Supplier release notes, terms and product settings are monitored for new AI features in products already in use, and each feature is assessed and approved before it is enabled. | 06 Third Party & Supply Chain | Detective |
| C-047 | Intended-use definition and use restrictions The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins. | 05 Model & System Lifecycle | Directive |
| C-057 | Shadow AI discovery Network, procurement, expense and software records are reviewed on a set cycle to find AI tools and features in use that are absent from the inventory. | 02 Governance & Accountability | Detective |