Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
15 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-027 | Agent memory controls What an agent may write to persistent memory is restricted, validated and attributed, and stored memory can be inspected, corrected and cleared. | 10 Security & Resilience | Preventive |
| C-049 | AI decommissioning procedure Retirement of an AI system follows a plan that covers dependent processes, disposal of data and model artefacts, retention of records and any continuing obligations. | 05 Model & System Lifecycle | Directive |
| C-020 | Data minimisation and lawful basis review Before personal data is used to train, fine-tune, ground or run an AI system, a documented review confirms the lawful basis, the compatibility of the purpose and that only necessary data is used. | 04 Data & Data Governance | Directive |
| C-074 | Data protection impact assessment for AI A data protection impact assessment is completed before AI processing that is likely to result in high risk to individuals begins, and is kept current as the system changes. | 03 Regulatory & Legal Compliance | Directive |
| C-068 | Data quality and representativeness checks Training, test and reference data are assessed for accuracy, completeness, currency and coverage of the population the system will serve, before use and at each refresh. | 04 Data & Data Governance | Detective |
| C-073 | Data subject rights handling for AI A tested procedure locates and acts on a person's data in training sets, vector stores, logs and outputs when an access, rectification, erasure or objection request is received. | 04 Data & Data Governance | Corrective |
| C-069 | Dataset documentation Each dataset used for AI has a maintained record of its source, collection method, contents, rights, lawful basis, known limitations and permitted uses. | 04 Data & Data Governance | Directive |
| C-031 | Model and data access control Access to model weights, training data, pipelines and inference endpoints is granted by role, limited to need, logged and reviewed. | 10 Security & Resilience | Preventive |
| C-071 | Personal data redaction and pseudonymisation Personal data is removed, masked or pseudonymised before data is used for training, evaluation or logging, unless it is needed and the need is recorded, and the result is tested. | 04 Data & Data Governance | Preventive |
| C-040 | Privacy-preserving training techniques Where training data is personal or confidential, techniques that limit how much a model retains about any single record are applied, and the remaining exposure is measured. | 04 Data & Data Governance | Preventive |
| C-070 | Prompt and context data loss prevention Prompts, uploads and retrieved context are inspected before they reach a model, and blocked, redacted or flagged where they contain personal or restricted data. | 04 Data & Data Governance | Preventive |
| C-072 | Prompt and log retention limits Prompts, outputs and conversation histories are kept for defined periods and then deleted, by the organisation and by its providers, with deletion verified. | 04 Data & Data Governance | Preventive |
| C-037 | Tenant and session isolation Every stateful component of an AI system, including caches, memory, retrieval indexes and fine-tuned models, is partitioned by customer and user, and the partitioning is tested. | 10 Security & Resilience | Preventive |
| C-012 | Training data provenance checks The source, collection method, rights and integrity of every dataset are verified and recorded before it is used for training, fine-tuning or retrieval. | 04 Data & Data Governance | Preventive |
| C-013 | Vector store and embedding access controls A retrieval system's vector store is governed as a production data store: access is authenticated and authorised, source permissions are enforced at retrieval, and writes are restricted and recorded. | 04 Data & Data Governance | Preventive |