Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
10 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-020 | Data minimisation and lawful basis review Before personal data is used to train, fine-tune, ground or run an AI system, a documented review confirms the lawful basis, the compatibility of the purpose and that only necessary data is used. | 04 Data & Data Governance | Directive |
| C-068 | Data quality and representativeness checks Training, test and reference data are assessed for accuracy, completeness, currency and coverage of the population the system will serve, before use and at each refresh. | 04 Data & Data Governance | Detective |
| C-073 | Data subject rights handling for AI A tested procedure locates and acts on a person's data in training sets, vector stores, logs and outputs when an access, rectification, erasure or objection request is received. | 04 Data & Data Governance | Corrective |
| C-069 | Dataset documentation Each dataset used for AI has a maintained record of its source, collection method, contents, rights, lawful basis, known limitations and permitted uses. | 04 Data & Data Governance | Directive |
| C-071 | Personal data redaction and pseudonymisation Personal data is removed, masked or pseudonymised before data is used for training, evaluation or logging, unless it is needed and the need is recorded, and the result is tested. | 04 Data & Data Governance | Preventive |
| C-040 | Privacy-preserving training techniques Where training data is personal or confidential, techniques that limit how much a model retains about any single record are applied, and the remaining exposure is measured. | 04 Data & Data Governance | Preventive |
| C-070 | Prompt and context data loss prevention Prompts, uploads and retrieved context are inspected before they reach a model, and blocked, redacted or flagged where they contain personal or restricted data. | 04 Data & Data Governance | Preventive |
| C-072 | Prompt and log retention limits Prompts, outputs and conversation histories are kept for defined periods and then deleted, by the organisation and by its providers, with deletion verified. | 04 Data & Data Governance | Preventive |
| C-012 | Training data provenance checks The source, collection method, rights and integrity of every dataset are verified and recorded before it is used for training, fine-tuning or retrieval. | 04 Data & Data Governance | Preventive |
| C-013 | Vector store and embedding access controls A retrieval system's vector store is governed as a production data store: access is authenticated and authorised, source permissions are enforced at retrieval, and writes are restricted and recorded. | 04 Data & Data Governance | Preventive |