AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational
Without an agreed specification, teams produce inconsistent model records that omit the information reviewers need. A documentation requirement establishes what must be recorded; it is distinct from producing or validating a particular model’s documentation.
Control requirement
Define documentation requirements for AI models and deployments, specifying mandatory content, ownership, evidence quality, audience, update triggers and approval criteria. Tailor the required depth to risk and the organization’s actual role.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
AI model acquisition, development, adaptation and deployment, including supplier documentation and internally added records.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The AI program owner maintains the specification with technical, domain, legal and assurance functions.
Implementation guidance
- Define required fields for purpose, provenance, identity, evaluation, limitations, dependencies, oversight and change history.
- Specify required supporting evidence, acceptable source quality, treatment of unknown information and audience-specific versions.
- Define ownership, review and update gates; align requirements with applicable external obligations without assuming a template proves compliance.
- Integrate the specification into procurement and lifecycle gates, and test its usability against representative internal and vendor models.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Assess a completed model record against the specification | Mandatory information and evidence can be checked objectively. |
| Use a supplier record with missing fields | The gap has a documented treatment rather than silent acceptance. |
| Review a changed use case | Required documentation updates are triggered. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Documentation specification and templates
- Risk-based tailoring rules
- Procurement and lifecycle gate criteria
- Specification review records
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate gaps in the specification or repeated undocumented deployments to the program lead. Hold affected approval gates when reviewers lack information necessary for the decision.
Example in practice
Hypothetical example: A procurement template requires model limitations but not evaluation conditions. The program owner adds evidence and test-scope fields so a vendor’s broad performance claim cannot substitute for a relevant assessment.
Related controls
- CF01-006: AI Regulatory & Standards Mapping
- CF01-015: AI Model Documentation
- CF01-S14: AI Model Documentation Validation
Framework mappings
- CSA AICM (MDS-04)
- NIST AI RMF (MAP 1.1)
- EU AI Act (Art. 11(1))
- ISO 42001 (Cl. 8.2, A6.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0