Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
7 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-014 | AI acceptable use policy A policy approved by top management states what AI use is permitted, what is prohibited, what every system must pass through, who is accountable, and where to take a case the policy does not settle. | 02 Governance & Accountability | Directive |
| C-054 | AI governance forum and escalation A committee with defined membership, authority and escalation routes decides on high-tier approvals, risk acceptance and exceptions, and reports to the board. | 02 Governance & Accountability | Directive |
| C-055 | AI inventory and registration All AI systems and models, whether built, bought or embedded in other products, are recorded with owner, purpose, tier, data, supplier and status, and the record is reconciled periodically. | 02 Governance & Accountability | Detective |
| C-017 | AI ownership and accountability framework Every AI system has a named individual accountable for it as a whole, and a named senior individual is accountable for AI risk across the organisation, with defined reporting lines. | 02 Governance & Accountability | Directive |
| C-058 | AI policy exception management Departures from AI policy are requested in writing, risk-accepted by a named owner at the right level, time-limited, and tracked until they are closed. | 02 Governance & Accountability | Directive |
| C-056 | AI risk tiering and classification Each system is assigned an internal risk tier and a regulatory class by documented criteria, the result is reviewed independently, and it is revisited whenever the system or its use changes. | 02 Governance & Accountability | Directive |
| C-057 | Shadow AI discovery Network, procurement, expense and software records are reviewed on a set cycle to find AI tools and features in use that are absent from the inventory. | 02 Governance & Accountability | Detective |