Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
50 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-079 | Accessibility and inclusive design review AI-driven channels are designed and tested with assistive technology and with people who have access needs before release, and an equivalent alternative route is kept available. | 07 Fairness & Customer Outcomes | Preventive |
| C-028 | Agent action tracing Every agent action is recorded with the instruction, plan, tool call, result and identity that produced it, in a form that allows the sequence to be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-027 | Agent memory controls What an agent may write to persistent memory is restricted, validated and attributed, and stored memory can be inspected, corrected and cleared. | 10 Security & Resilience | Preventive |
| C-025 | Agent sandboxing and isolation Code execution and tool use by agents run in isolated environments with restricted network, file and system access, so that a failure is contained where it occurs. | 10 Security & Resilience | Preventive |
| C-026 | Agent tool and skill vetting Tools, skills and connectors are reviewed, scanned and approved before an agent may load them, are loaded only from approved sources, and are re-reviewed when they change. | 06 Third Party & Supply Chain | Preventive |
| C-085 | AI bill of materials The models, datasets, libraries, tools and hosted components that make up each AI system are recorded and checked against known vulnerabilities, licence terms and supplier changes. | 06 Third Party & Supply Chain | Detective |
| C-064 | AI record-keeping and audit trail Inputs, outputs, model and prompt versions, decisions and human interventions are recorded automatically and retained for a defined period, so that any past event can be reconstructed. | 11 Monitoring, Assurance & Incidents | Detective |
| C-018 | AI transparency and disclosure labelling People are told, clearly and at the point of contact, when they are dealing with an AI system and when content they are shown was generated by one. | 08 Transparency & Explainability | Directive |
| C-023 | Approval gates for high-impact agent actions Before an agent takes an action above a defined impact threshold, or one that cannot be reversed, a designated person reviews the exact action and approves or rejects it. | 09 Human Oversight & Contestability | Preventive |
| C-019 | Automated decision-making safeguards Significant decisions taken with no meaningful human involvement are identified, and each has the safeguards the law requires: information, a chance to make representations, human intervention and a means to contest. | 09 Human Oversight & Contestability | Directive |
| C-035 | Content safety filtering Inputs and outputs are classified against defined harm categories by a mechanism independent of the main model, and are blocked, modified or escalated according to policy. | 10 Security & Resilience | Preventive |
| C-102 | Contestability and appeals process People affected by an AI-supported decision can challenge it and have it reviewed afresh by someone with the authority, information and independence to change it. | 09 Human Oversight & Contestability | Corrective |
| C-020 | Data minimisation and lawful basis review Before personal data is used to train, fine-tune, ground or run an AI system, a documented review confirms the lawful basis, the compatibility of the purpose and that only necessary data is used. | 04 Data & Data Governance | Directive |
| C-068 | Data quality and representativeness checks Training, test and reference data are assessed for accuracy, completeness, currency and coverage of the population the system will serve, before use and at each refresh. | 04 Data & Data Governance | Detective |
| C-073 | Data subject rights handling for AI A tested procedure locates and acts on a person's data in training sets, vector stores, logs and outputs when an access, rectification, erasure or objection request is received. | 04 Data & Data Governance | Corrective |
| C-069 | Dataset documentation Each dataset used for AI has a maintained record of its source, collection method, contents, rights, lawful basis, known limitations and permitted uses. | 04 Data & Data Governance | Directive |
| C-039 | Deepfake-resistant verification Identity and instruction verification never rests on voice, image or video alone, and high-value actions require confirmation through a separate, pre-agreed channel. | 10 Security & Resilience | Preventive |
| C-078 | Escalation to a human Automated channels offer a prompt, unobstructed route to a person, available on request and triggered automatically by defined signals, with the conversation handed over. | 09 Human Oversight & Contestability | Preventive |
| C-043 | Evaluation suite and regression testing A maintained set of test cases with expected results is run on every change to model, prompt, data or tools, and the results are compared with the approved baseline. | 05 Model & System Lifecycle | Detective |
| C-097 | Explanations for affected individuals People subject to an AI-supported decision receive a meaningful explanation of what was decided, the main reasons in their case and how to challenge it. | 08 Transparency & Explainability | Directive |
| C-008 | Factuality and hallucination verification Claims, figures and citations in AI-generated output are checked against a trusted source before the output is relied on for a consequential decision or sent to a customer. | 05 Model & System Lifecycle | Detective |
| C-075 | Fairness requirements and metric selection For each system that affects people, the relevant groups, the legal test, the fairness measures and their thresholds are defined and justified before testing begins. | 07 Fairness & Customer Outcomes | Directive |
| C-088 | Fallback and manual workaround A tested alternative, such as a manual process, a simpler model or a degraded mode, is ready to take over when an AI component fails or has to be withdrawn. | 10 Security & Resilience | Corrective |
| C-094 | Human override and stop mechanism A designated person can pause, override or shut down an AI system at any time through a tested mechanism, with the authority to do so settled in advance. | 09 Human Oversight & Contestability | Corrective |
| C-002 | Human-in-the-loop review Consequential AI outputs and decisions are reviewed by a competent person, with the time, information and authority to change them, before they take effect. | 09 Human Oversight & Contestability | Preventive |
| C-009 | Inference usage quotas and rate limiting Limits on request rate, input size, output size and spend are enforced for each user, tenant and system, with alerts as limits are approached. | 10 Security & Resilience | Preventive |
| C-029 | Input filtering and injection defence User input and all retrieved or tool-supplied content are screened for hostile instructions and passed to the model marked as data, separate from the system's own instructions. | 10 Security & Resilience | Preventive |
| C-095 | Intellectual property and licence clearance Training data, models, components and significant outputs are checked for rights and licence terms before they are used, published or shipped. | 03 Regulatory & Legal Compliance | Preventive |
| C-024 | Least-privilege agent identity and permissions Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement. | 10 Security & Resilience | Preventive |
| C-031 | Model and data access control Access to model weights, training data, pipelines and inference endpoints is granted by role, limited to need, logged and reviewed. | 10 Security & Resilience | Preventive |
| C-046 | Model and system documentation Each AI system's purpose, design, data, test results and limitations are documented to a set standard that allows a validator, auditor or regulator to understand it without its authors. | 05 Model & System Lifecycle | Directive |
| C-084 | Model version pinning and change notification Hosted models are called by a fixed version, and a provider's new version is adopted only after the organisation's own regression tests have passed. | 06 Third Party & Supply Chain | Preventive |
| C-004 | Output validation and guardrails Every model output is validated against a schema and sanitised by deterministic code before any downstream system, tool or user interface acts on it. | 10 Security & Resilience | Preventive |
| C-071 | Personal data redaction and pseudonymisation Personal data is removed, masked or pseudonymised before data is used for training, evaluation or logging, unless it is needed and the need is recorded, and the result is tested. | 04 Data & Data Governance | Preventive |
| C-040 | Privacy-preserving training techniques Where training data is personal or confidential, techniques that limit how much a model retains about any single record are applied, and the remaining exposure is measured. | 04 Data & Data Governance | Preventive |
| C-070 | Prompt and context data loss prevention Prompts, uploads and retrieved context are inspected before they reach a model, and blocked, redacted or flagged where they contain personal or restricted data. | 04 Data & Data Governance | Preventive |
| C-072 | Prompt and log retention limits Prompts, outputs and conversation histories are kept for defined periods and then deleted, by the organisation and by its providers, with deletion verified. | 04 Data & Data Governance | Preventive |
| C-048 | Retrieval grounding and citation The system answers only from retrieved, approved sources, cites the source for each statement, and declines where the sources do not support an answer. | 05 Model & System Lifecycle | Preventive |
| C-038 | Review of AI-generated code Code produced with an AI assistant passes the same human review, security scanning and dependency checks as any other code before it is merged. | 10 Security & Resilience | Detective |
| C-082 | Review of AI-generated communications Customer communications produced by AI are checked against content standards before use, in full or by sampling according to risk, and required wording is enforced. | 07 Fairness & Customer Outcomes | Preventive |
| C-103 | Role-based AI training Reviewers, developers, risk and assurance staff, approvers and front-line teams receive training specific to their AI responsibilities, with competence assessed and completion tracked. | 12 Skills, Capability & Culture | Directive |
| C-034 | Safe model loading and artefact scanning Model files and their dependencies are obtained only from approved sources, scanned before use, and loaded in formats and with settings that cannot execute embedded code. | 10 Security & Resilience | Preventive |
| C-030 | Secrets management for AI Credentials used by AI systems are held in a vault, supplied at run time, kept out of prompts, configuration and notebooks, scoped narrowly and rotated. | 10 Security & Resilience | Preventive |
| C-033 | Secure AI development pipeline The pipelines and tooling that train, evaluate and deploy models are subject to the security controls of production software delivery, including review, scanning and segregation of environments. | 10 Security & Resilience | Preventive |
| C-096 | Synthetic content marking and provenance Generated and manipulated media carries machine-readable marking and provenance data, a visible disclosure where one is required, and the marking is tested for robustness. | 08 Transparency & Explainability | Preventive |
| C-011 | System prompt hardening System prompts are written to contain no secrets and no security decisions, are placed under version control and review, and are tested against extraction before release. | 10 Security & Resilience | Preventive |
| C-037 | Tenant and session isolation Every stateful component of an AI system, including caches, memory, retrieval indexes and fine-tuned models, is partitioned by customer and user, and the partitioning is tested. | 10 Security & Resilience | Preventive |
| C-012 | Training data provenance checks The source, collection method, rights and integrity of every dataset are verified and recorded before it is used for training, fine-tuning or retrieval. | 04 Data & Data Governance | Preventive |
| C-013 | Vector store and embedding access controls A retrieval system's vector store is governed as a production data store: access is authenticated and authorised, source permissions are enforced at retrieval, and writes are restricted and recorded. | 04 Data & Data Governance | Preventive |
| C-077 | Vulnerable customer safeguards Automated journeys detect indicators of vulnerability, adapt what they do, and route the customer to appropriate human support, with the disclosure recorded. | 07 Fairness & Customer Outcomes | Preventive |