Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
12 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-083 | AI contract terms Contracts with AI suppliers cover data use, change notification, information and audit rights, sub-contracting, incident notification, liability and exit. | 06 Third Party & Supply Chain | Directive |
| C-015 | AI impact assessment process A structured assessment of an AI system's effect on individuals, groups and society is completed and signed off before deployment, and revisited when the system or its use changes. | 03 Regulatory & Legal Compliance | Directive |
| C-059 | AI regulatory obligations register and horizon scanning The AI obligations that apply to the organisation, and the dates from which they apply, are recorded, mapped to controls and owners, and updated as the law and guidance change. | 03 Regulatory & Legal Compliance | Directive |
| C-056 | AI risk tiering and classification Each system is assigned an internal risk tier and a regulatory class by documented criteria, the result is reviewed independently, and it is revisited whenever the system or its use changes. | 02 Governance & Accountability | Directive |
| C-019 | Automated decision-making safeguards Significant decisions taken with no meaningful human involvement are identified, and each has the safeguards the law requires: information, a chance to make representations, human intervention and a means to contest. | 09 Human Oversight & Contestability | Directive |
| C-020 | Data minimisation and lawful basis review Before personal data is used to train, fine-tune, ground or run an AI system, a documented review confirms the lawful basis, the compatibility of the purpose and that only necessary data is used. | 04 Data & Data Governance | Directive |
| C-074 | Data protection impact assessment for AI A data protection impact assessment is completed before AI processing that is likely to result in high risk to individuals begins, and is kept current as the system changes. | 03 Regulatory & Legal Compliance | Directive |
| C-073 | Data subject rights handling for AI A tested procedure locates and acts on a person's data in training sets, vector stores, logs and outputs when an access, rectification, erasure or objection request is received. | 04 Data & Data Governance | Corrective |
| C-061 | High-risk conformity assessment and registration High-risk AI systems complete the required conformity assessment, declaration, marking and registration before they are placed on the market or used, and again after substantial modification. | 03 Regulatory & Legal Compliance | Preventive |
| C-095 | Intellectual property and licence clearance Training data, models, components and significant outputs are checked for rights and licence terms before they are used, published or shipped. | 03 Regulatory & Legal Compliance | Preventive |
| C-060 | Prohibited-practice screening Every proposed AI use is checked against the practices the law prohibits before it is approved, the check is recorded, and it is repeated when the use changes. | 03 Regulatory & Legal Compliance | Preventive |
| C-062 | Regulatory incident notification AI incidents are assessed against defined reporting criteria, and those that are reportable are notified to the relevant authority, and to the provider or deployer, within the time required. | 03 Regulatory & Legal Compliance | Corrective |