AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational
A shared responsibility model fails when every participant assumes another party owns the decision. Accountability must remain identifiable across business teams, technology functions and providers.
Control requirement
Define and maintain accountable roles for AI program direction and system-level decisions, including risk acceptance, deployment, operation, intervention and retirement. Give assigned personnel the authority, resources and cover needed to discharge their responsibilities.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
Internal teams, service providers and business owners involved in AI decisions, including changes in staffing and outsourced operation.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The executive sponsor approves the responsibility model; the program lead maintains it with business and technical owners.
Implementation guidance
- Map lifecycle decisions to accountable roles, responsible operators, consulted specialists and notification recipients; name a single accountable role for each decision.
- Define limits of authority, escalation paths, deputies and out-of-hours coverage for urgent interventions.
- Reconcile internal assignments with supplier agreements; document responsibilities the organization retains even when a provider performs technical work.
- Review assignments after reorganizations, vendor changes or ownership transfers; verify training, access and capacity rather than recording names alone.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Ask who can halt a consequential deployment | An authorized role and reachable deputy are identified. |
| Trace a supplier-supported incident | Internal and supplier duties connect without an ownership gap. |
| Inspect a role transition | Accountability, access and outstanding decisions transfer explicitly. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Approved responsibility matrix
- Role descriptions and authority limits
- Supplier responsibility records
- Handover and coverage evidence
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate unowned decisions to the executive sponsor. Hold consequential deployment or expansion until an accountable owner and functioning intervention route are established.
Example in practice
Hypothetical example: A hosted screening model is technically operated by a vendor. The employer still assigns a business owner for its use, an internal reviewer for disputed outcomes and an authorized operator for suspension.
Related controls
- CF01-001: Governance Program Policy & Procedures
- CF01-011: AI Change Authorization
- CF07-006: AI System Kill Switch & Emergency Stop
Framework mappings
- CSA AICM (GRC-06)
- NIST AI RMF (GOVERN 1.1, 6.1)
- EU AI Act (Art. 9(1)(b))
- ISO 42001 (Cl. 5.3)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0