AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational
Urgency can justify a different approval route, but it should not eliminate accountability. Repeated emergency labels can become a way to avoid testing and risk review.
Control requirement
Control exceptions to AI change procedures through a documented, time-limited process that identifies the bypassed gate, urgency, impact, compensating measures, authority and required post-change review.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
Emergency, expedited and exceptional AI changes that cannot follow the normal change workflow.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The change authority approves the exception with the relevant risk owner; implementers and reviewers complete follow-up duties.
Implementation guidance
- Define eligibility and limits for emergency changes; identify mandatory safeguards that remain in force.
- Record the reason normal timing is infeasible, the exact affected baseline, impact and minimum feasible validation.
- Authorize the exception through a reachable designated role and preserve implementation, monitoring and rollback records.
- Complete a post-change review by the approved deadline, remove temporary privileges and analyze repeated exceptions for process failure.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Inspect an expedited release | Authority, scope, minimum validation and follow-up are explicit. |
| Review temporary access after closure | It is removed or separately authorized. |
| Analyze repeated exceptions | Patterns trigger remediation rather than indefinite normalization. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Change exception request
- Expedited approval and validation
- Deployment and monitoring records
- Post-change review and closure
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate unauthorized bypasses or overdue review to the change and risk authorities. Contain harmful changes and suspend the exception route if its safeguards are ineffective.
Example in practice
Hypothetical example: A harmful prompt requires urgent replacement. A designated approver authorizes a narrowly scoped update with targeted tests, enhanced observation and a scheduled review; unrelated feature changes remain excluded.
Related controls
- CF01-004: Policy Exception Process
- CF01-009: AI Change Management Policy & Procedures
- CF01-013: AI System Rollback & Restoration
Framework mappings
- CSA AICM (CCC-08)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0