Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
19 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-083 | AI contract terms Contracts with AI suppliers cover data use, change notification, information and audit rights, sub-contracting, incident notification, liability and exit. | 06 Third Party & Supply Chain | Directive |
| C-091 | AI cost and capacity monitoring Usage, latency and spend for each AI system are tracked against budgets and limits, with alerts and automatic caps before a limit is breached. | 11 Monitoring, Assurance & Incidents | Detective |
| C-015 | AI impact assessment process A structured assessment of an AI system's effect on individuals, groups and society is completed and signed off before deployment, and revisited when the system or its use changes. | 03 Regulatory & Legal Compliance | Directive |
| C-055 | AI inventory and registration All AI systems and models, whether built, bought or embedded in other products, are recorded with owner, purpose, tier, data, supplier and status, and the record is reconciled periodically. | 02 Governance & Accountability | Detective |
| C-017 | AI ownership and accountability framework Every AI system has a named individual accountable for it as a whole, and a named senior individual is accountable for AI risk across the organisation, with defined reporting lines. | 02 Governance & Accountability | Directive |
| C-056 | AI risk tiering and classification Each system is assigned an internal risk tier and a regulatory class by documented criteria, the result is reviewed independently, and it is revisited whenever the system or its use changes. | 02 Governance & Accountability | Directive |
| C-052 | AI use-case intake and approval Every proposed AI use is registered, screened, tiered and approved by a named authority before build or purchase begins, and again before it goes live. | 01 Strategy & Risk Appetite | Preventive |
| C-019 | Automated decision-making safeguards Significant decisions taken with no meaningful human involvement are identified, and each has the safeguards the law requires: information, a chance to make representations, human intervention and a means to contest. | 09 Human Oversight & Contestability | Directive |
| C-020 | Data minimisation and lawful basis review Before personal data is used to train, fine-tune, ground or run an AI system, a documented review confirms the lawful basis, the compatibility of the purpose and that only necessary data is used. | 04 Data & Data Governance | Directive |
| C-074 | Data protection impact assessment for AI A data protection impact assessment is completed before AI processing that is likely to result in high risk to individuals begins, and is kept current as the system changes. | 03 Regulatory & Legal Compliance | Directive |
| C-075 | Fairness requirements and metric selection For each system that affects people, the relevant groups, the legal test, the fairness measures and their thresholds are defined and justified before testing begins. | 07 Fairness & Customer Outcomes | Directive |
| C-021 | Important business service impact-tolerance mapping The AI components each important business service depends on are identified in the resilience map, and impact tolerances are set that cover AI-specific disruption, including a model that is running and wrong. | 10 Security & Resilience | Directive |
| C-095 | Intellectual property and licence clearance Training data, models, components and significant outputs are checked for rights and licence terms before they are used, published or shipped. | 03 Regulatory & Legal Compliance | Preventive |
| C-047 | Intended-use definition and use restrictions The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins. | 05 Model & System Lifecycle | Directive |
| C-060 | Prohibited-practice screening Every proposed AI use is checked against the practices the law prohibits before it is approved, the check is recorded, and it is repeated when the use changes. | 03 Regulatory & Legal Compliance | Preventive |
| C-034 | Safe model loading and artefact scanning Model files and their dependencies are obtained only from approved sources, scanned before use, and loaded in formats and with settings that cannot execute embedded code. | 10 Security & Resilience | Preventive |
| C-005 | Third-party model and vendor due diligence Before an AI supplier, model or dataset is adopted, it is assessed against AI-specific criteria to a depth set by how material the use is, with evidence for the answers. | 06 Third Party & Supply Chain | Directive |
| C-022 | Vendor exit strategy and concentration management Each material AI supplier has a documented, costed and tested exit plan, and dependence on each provider is measured across the organisation and held within limits. | 06 Third Party & Supply Chain | Directive |
| C-104 | Workforce impact assessment and involvement Before AI is deployed in ways that change work, its effect on roles, skills, working conditions and monitoring of staff is assessed, with the people affected and their representatives informed and heard. | 12 Skills, Capability & Culture | Directive |