Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
19 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-006 | Adversarial robustness testing A defined battery of adversarial tests is run against an AI system before release and after every material change, and release depends on the results. | 10 Security & Resilience | Preventive |
| C-026 | Agent tool and skill vetting Tools, skills and connectors are reviewed, scanned and approved before an agent may load them, are loaded only from approved sources, and are re-reviewed when they change. | 06 Third Party & Supply Chain | Preventive |
| C-044 | AI change management Changes to models, prompts, data sources, tools and configuration are assessed, tested, approved and versioned before they reach production. | 05 Model & System Lifecycle | Preventive |
| C-083 | AI contract terms Contracts with AI suppliers cover data use, change notification, information and audit rights, sub-contracting, incident notification, liability and exit. | 06 Third Party & Supply Chain | Directive |
| C-054 | AI governance forum and escalation A committee with defined membership, authority and escalation routes decides on high-tier approvals, risk acceptance and exceptions, and reports to the board. | 02 Governance & Accountability | Directive |
| C-015 | AI impact assessment process A structured assessment of an AI system's effect on individuals, groups and society is completed and signed off before deployment, and revisited when the system or its use changes. | 03 Regulatory & Legal Compliance | Directive |
| C-058 | AI policy exception management Departures from AI policy are requested in writing, risk-accepted by a named owner at the right level, time-limited, and tracked until they are closed. | 02 Governance & Accountability | Directive |
| C-052 | AI use-case intake and approval Every proposed AI use is registered, screened, tiered and approved by a named authority before build or purchase begins, and again before it goes live. | 01 Strategy & Risk Appetite | Preventive |
| C-023 | Approval gates for high-impact agent actions Before an agent takes an action above a defined impact threshold, or one that cannot be reversed, a designated person reviews the exact action and approves or rejects it. | 09 Human Oversight & Contestability | Preventive |
| C-074 | Data protection impact assessment for AI A data protection impact assessment is completed before AI processing that is likely to result in high risk to individuals begins, and is kept current as the system changes. | 03 Regulatory & Legal Compliance | Directive |
| C-061 | High-risk conformity assessment and registration High-risk AI systems complete the required conformity assessment, declaration, marking and registration before they are placed on the market or used, and again after substantial modification. | 03 Regulatory & Legal Compliance | Preventive |
| C-002 | Human-in-the-loop review Consequential AI outputs and decisions are reviewed by a competent person, with the time, information and authority to change them, before they take effect. | 09 Human Oversight & Contestability | Preventive |
| C-041 | Independent model validation A function independent of the developers tests each model's conceptual soundness, data, performance and limitations before approval and periodically afterwards, to a depth set by the model's tier. | 05 Model & System Lifecycle | Detective |
| C-099 | Information for deployers and users Those who operate and use an AI system receive current, usable instructions covering its purpose, performance, limitations, the meaning of its outputs and the oversight it needs. | 08 Transparency & Explainability | Directive |
| C-047 | Intended-use definition and use restrictions The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins. | 05 Model & System Lifecycle | Directive |
| C-046 | Model and system documentation Each AI system's purpose, design, data, test results and limitations are documented to a set standard that allows a validator, auditor or regulator to understand it without its authors. | 05 Model & System Lifecycle | Directive |
| C-010 | Model artifact signing and integrity verification Approved model artefacts are cryptographically signed at validation, and the signature is verified before an artefact is loaded anywhere in production. | 10 Security & Resilience | Preventive |
| C-042 | Pre-deployment testing and acceptance Functional, safety, security and user tests defined in advance must pass, with results recorded, before an AI system is released. | 05 Model & System Lifecycle | Preventive |
| C-005 | Third-party model and vendor due diligence Before an AI supplier, model or dataset is adopted, it is assessed against AI-specific criteria to a depth set by how material the use is, with evidence for the answers. | 06 Third Party & Supply Chain | Directive |