Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
11 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-064 | AI record-keeping and audit trail Inputs, outputs, model and prompt versions, decisions and human interventions are recorded automatically and retained for a defined period, so that any past event can be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-018 | AI transparency and disclosure labelling People are told, clearly and at the point of contact, when they are dealing with an AI system and when content they are shown was generated by one. | 08 Transparency & Explainability | Directive |
| C-069 | Dataset documentation Each dataset used for AI has a maintained record of its source, collection method, contents, rights, lawful basis, known limitations and permitted uses. | 04 Data & Data Governance | Directive |
| C-098 | Explanation method validation The techniques used to explain a model are tested to confirm that they reflect the model's actual behaviour before explanations are relied on internally or given to anyone. | 08 Transparency & Explainability | Detective |
| C-097 | Explanations for affected individuals People subject to an AI-supported decision receive a meaningful explanation of what was decided, the main reasons in their case and how to challenge it. | 08 Transparency & Explainability | Directive |
| C-099 | Information for deployers and users Those who operate and use an AI system receive current, usable instructions covering its purpose, performance, limitations, the meaning of its outputs and the oversight it needs. | 08 Transparency & Explainability | Directive |
| C-046 | Model and system documentation Each AI system's purpose, design, data, test results and limitations are documented to a set standard that allows a validator, auditor or regulator to understand it without its authors. | 05 Model & System Lifecycle | Directive |
| C-100 | Public AI transparency record The organisation publishes and maintains a record of its significant AI uses, describing what each is for, what data it uses and what safeguards apply. | 08 Transparency & Explainability | Directive |
| C-048 | Retrieval grounding and citation The system answers only from retrieved, approved sources, cites the source for each statement, and declines where the sources do not support an answer. | 05 Model & System Lifecycle | Preventive |
| C-082 | Review of AI-generated communications Customer communications produced by AI are checked against content standards before use, in full or by sampling according to risk, and required wording is enforced. | 07 Fairness & Customer Outcomes | Preventive |
| C-096 | Synthetic content marking and provenance Generated and manipulated media carries machine-readable marking and provenance data, a visible disclosure where one is required, and the marking is tested for robustness. | 08 Transparency & Explainability | Preventive |