Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
12 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-028 | Agent action tracing Every agent action is recorded with the instruction, plan, tool call, result and identity that produced it, in a form that allows the sequence to be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-091 | AI cost and capacity monitoring Usage, latency and spend for each AI system are tracked against budgets and limits, with alerts and automatic caps before a limit is breached. | 11 Monitoring, Assurance & Incidents | Detective |
| C-092 | AI incident classification and playbooks The kinds of AI failure are defined in the incident process with severity criteria, each has a playbook, and responders are trained and exercised in using them. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-003 | AI incident response and rollback When an AI system fails or produces harmful output, a defined procedure contains it, restores a known good state, preserves the evidence and manages the consequences. | 11 Monitoring, Assurance & Incidents | Corrective |
| C-064 | AI record-keeping and audit trail Inputs, outputs, model and prompt versions, decisions and human interventions are recorded automatically and retained for a defined period, so that any past event can be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-001 | AI system monitoring and logging Every production AI system is instrumented to record its inputs, outputs, errors and usage, with thresholds that raise alerts to a named owner who must act. | 11 Monitoring, Assurance & Incidents | Detective |
| C-050 | Drift and performance monitoring Input distributions and output quality are measured in production against thresholds that trigger investigation, retraining or withdrawal. | 11 Monitoring, Assurance & Incidents | Detective |
| C-090 | Feedback and complaints channel for AI Users and affected people can report a problem with an AI system easily, and reports are triaged, linked to the system concerned and analysed for patterns. | 11 Monitoring, Assurance & Incidents | Detective |
| C-063 | Independent assurance and internal audit of AI Second-line review and internal audit cover AI governance and the highest-tier systems on a risk-based plan, test systems as well as documents, and track their findings to closure. | 11 Monitoring, Assurance & Incidents | Detective |
| C-066 | Periodic AI review and recertification Each AI system is reassessed on a cycle set by its tier, covering use, performance, risk and controls, and its approval lapses if the review is not completed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-065 | Post-market monitoring plan A documented plan sets out how evidence of a system's performance, use and effects is collected, reviewed and acted on throughout its life. | 11 Monitoring, Assurance & Incidents | Detective |
| C-093 | Root-cause analysis and lessons learned Significant AI incidents and near misses are analysed for their causes, including the control failures that let them happen, and the resulting actions are tracked to completion. | 11 Monitoring, Assurance & Incidents | Corrective |