Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
14 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-014 | AI acceptable use policy A policy approved by top management states what AI use is permitted, what is prohibited, what every system must pass through, who is accountable, and where to take a case the policy does not settle. | 02 Governance & Accountability | Directive |
| C-067 | AI competence and resourcing plan The skills, people, tooling and budget needed to build, validate, operate and oversee the organisation's AI are identified, compared with what exists, and the gaps are closed or the ambition reduced. | 12 Skills, Capability & Culture | Directive |
| C-054 | AI governance forum and escalation A committee with defined membership, authority and escalation routes decides on high-tier approvals, risk acceptance and exceptions, and reports to the board. | 02 Governance & Accountability | Directive |
| C-055 | AI inventory and registration All AI systems and models, whether built, bought or embedded in other products, are recorded with owner, purpose, tier, data, supplier and status, and the record is reconciled periodically. | 02 Governance & Accountability | Detective |
| C-016 | AI literacy programme Everyone who uses, relies on or makes decisions about AI receives training in what these systems are, how they fail and what the organisation's rules require. | 12 Skills, Capability & Culture | Directive |
| C-017 | AI ownership and accountability framework Every AI system has a named individual accountable for it as a whole, and a named senior individual is accountable for AI risk across the organisation, with defined reporting lines. | 02 Governance & Accountability | Directive |
| C-059 | AI regulatory obligations register and horizon scanning The AI obligations that apply to the organisation, and the dates from which they apply, are recorded, mapped to controls and owners, and updated as the law and guidance change. | 03 Regulatory & Legal Compliance | Directive |
| C-051 | AI risk appetite statement and limits The board approves a statement of the AI risk the organisation will accept, with measurable limits that trigger escalation when they are approached. | 01 Strategy & Risk Appetite | Directive |
| C-052 | AI use-case intake and approval Every proposed AI use is registered, screened, tiered and approved by a named authority before build or purchase begins, and again before it goes live. | 01 Strategy & Risk Appetite | Preventive |
| C-087 | Embedded AI feature review Supplier release notes, terms and product settings are monitored for new AI features in products already in use, and each feature is assessed and approved before it is enabled. | 06 Third Party & Supply Chain | Detective |
| C-047 | Intended-use definition and use restrictions The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins. | 05 Model & System Lifecycle | Directive |
| C-060 | Prohibited-practice screening Every proposed AI use is checked against the practices the law prohibits before it is approved, the check is recorded, and it is repeated when the use changes. | 03 Regulatory & Legal Compliance | Preventive |
| C-005 | Third-party model and vendor due diligence Before an AI supplier, model or dataset is adopted, it is assessed against AI-specific criteria to a depth set by how material the use is, with evidence for the answers. | 06 Third Party & Supply Chain | Directive |
| C-104 | Workforce impact assessment and involvement Before AI is deployed in ways that change work, its effect on roles, skills, working conditions and monitoring of staff is assessed, with the people affected and their representatives informed and heard. | 12 Skills, Capability & Culture | Directive |