Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
25 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-036 | Abuse monitoring Usage of an AI system is analysed for patterns of misuse, extraction or attack, and accounts are restricted when such patterns are detected. | 10 Security & Resilience | Detective |
| C-028 | Agent action tracing Every agent action is recorded with the instruction, plan, tool call, result and identity that produced it, in a form that allows the sequence to be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-091 | AI cost and capacity monitoring Usage, latency and spend for each AI system are tracked against budgets and limits, with alerts and automatic caps before a limit is breached. | 11 Monitoring, Assurance & Incidents | Detective |
| C-089 | AI failure scenario testing Severe but plausible AI failure scenarios are exercised against impact tolerances on a set cycle, and the lessons are acted on. | 10 Security & Resilience | Detective |
| C-092 | AI incident classification and playbooks The kinds of AI failure are defined in the incident process with severity criteria, each has a playbook, and responders are trained and exercised in using them. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-003 | AI incident response and rollback When an AI system fails or produces harmful output, a defined procedure contains it, restores a known good state, preserves the evidence and manages the consequences. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-064 | AI record-keeping and audit trail Inputs, outputs, model and prompt versions, decisions and human interventions are recorded automatically and retained for a defined period, so that any past event can be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-053 | AI risk reporting to the board Key risk indicators, incidents, exceptions and the state of the inventory are reported to the board or its committee on a set cycle, in a form that supports challenge. | 01 Strategy & Risk Appetite | Detective |
| C-001 | AI system monitoring and logging Every production AI system is instrumented to record its inputs, outputs, errors and usage, with thresholds that raise alerts to a named owner who must act. | 11 Monitoring, Assurance & Incidents | Detective |
| C-007 | Bias testing and fairness monitoring A system's performance and outcomes are measured separately for each relevant group before release and on a set cycle in production, against thresholds that trigger investigation. | 07 Fairness & Customer Outcomes | Detective |
| C-076 | Customer outcome monitoring The outcomes customers receive from AI-driven journeys are measured, broken down by customer group and compared with other channels, and poor outcomes are investigated and acted on. | 07 Fairness & Customer Outcomes | Detective |
| C-080 | Customer remediation for AI errors When an AI error is found, all affected customers are identified, told, and put back in the position they should have been in, whether or not they complained. | 07 Fairness & Customer Outcomes | Corrective |
| C-050 | Drift and performance monitoring Input distributions and output quality are measured in production against thresholds that trigger investigation, retraining or withdrawal. | 11 Monitoring, Assurance & Incidents | Detective |
| C-090 | Feedback and complaints channel for AI Users and affected people can report a problem with an AI system easily, and reports are triaged, linked to the system concerned and analysed for patterns. | 11 Monitoring, Assurance & Incidents | Detective |
| C-063 | Independent assurance and internal audit of AI Second-line review and internal audit cover AI governance and the highest-tier systems on a risk-based plan, test systems as well as documents, and track their findings to closure. | 11 Monitoring, Assurance & Incidents | Detective |
| C-041 | Independent model validation A function independent of the developers tests each model's conceptual soundness, data, performance and limitations before approval and periodically afterwards, to a depth set by the model's tier. | 05 Model & System Lifecycle | Detective |
| C-009 | Inference usage quotas and rate limiting Limits on request rate, input size, output size and spend are enforced for each user, tenant and system, with alerts as limits are approached. | 10 Security & Resilience | Preventive |
| C-086 | Ongoing AI vendor monitoring Each AI supplier's performance, incidents, model changes, terms and financial and operational standing are reviewed on a cycle set by how material the supplier is. | 06 Third Party & Supply Chain | Detective |
| C-066 | Periodic AI review and recertification Each AI system is reassessed on a cycle set by its tier, covering use, performance, risk and controls, and its approval lapses if the review is not completed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-065 | Post-market monitoring plan A documented plan sets out how evidence of a system's performance, use and effects is collected, reviewed and acted on throughout its life. | 11 Monitoring, Assurance & Incidents | Detective |
| C-062 | Regulatory incident notification AI incidents are assessed against defined reporting criteria, and those that are reportable are notified to the relevant authority, and to the provider or deployer, within the time required. | 03 Regulatory & Legal Compliance | Corrective |
| C-101 | Reviewer effectiveness testing Override rates, review times and seeded test cases are used to confirm that human reviewers actually detect and correct the system's errors. | 09 Human Oversight & Contestability | Detective |
| C-093 | Root-cause analysis and lessons learned Significant AI incidents and near misses are analysed for their causes, including the control failures that let them happen, and the resulting actions are tracked to completion. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-105 | Speak-up route for AI concerns Staff can raise concerns about how AI is being built or used, in confidence and without fear of reprisal, and each concern is assessed, investigated where warranted and answered. | 12 Skills, Capability & Culture | Detective |
| C-045 | Staged rollout New AI systems and material changes are released first to a limited population under close monitoring, and extended only when defined criteria are met. | 05 Model & System Lifecycle | Preventive |