Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
7 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-015 | AI impact assessment process A structured assessment of an AI system's effect on individuals, groups and society is completed and signed off before deployment, and revisited when the system or its use changes. | 03 Regulatory & Legal Compliance | Directive |
| C-059 | AI regulatory obligations register and horizon scanning The AI obligations that apply to the organisation, and the dates from which they apply, are recorded, mapped to controls and owners, and updated as the law and guidance change. | 03 Regulatory & Legal Compliance | Directive |
| C-074 | Data protection impact assessment for AI A data protection impact assessment is completed before AI processing that is likely to result in high risk to individuals begins, and is kept current as the system changes. | 03 Regulatory & Legal Compliance | Directive |
| C-061 | High-risk conformity assessment and registration High-risk AI systems complete the required conformity assessment, declaration, marking and registration before they are placed on the market or used, and again after substantial modification. | 03 Regulatory & Legal Compliance | Preventive |
| C-095 | Intellectual property and licence clearance Training data, models, components and significant outputs are checked for rights and licence terms before they are used, published or shipped. | 03 Regulatory & Legal Compliance | Preventive |
| C-060 | Prohibited-practice screening Every proposed AI use is checked against the practices the law prohibits before it is approved, the check is recorded, and it is repeated when the use changes. | 03 Regulatory & Legal Compliance | Preventive |
| C-062 | Regulatory incident notification AI incidents are assessed against defined reporting criteria, and those that are reportable are notified to the relevant authority, and to the provider or deployer, within the time required. | 03 Regulatory & Legal Compliance | Corrective |