AI Control Library / CF-11: Objective & Policy Constraints
Designation: Core | Control types represented: Governance, Operational and Technical
Control requirement
Assess AI uses against applicable prohibited-practice requirements under the EU AI Act and prevent in-scope prohibited activity. Obtain qualified review of scope, definitions and any narrowly applicable conditions before approving use.
Why this matters
A broad product label does not establish whether a deployment is prohibited or permitted. The actual purpose, methods, affected people and setting determine the relevant legal assessment.
How the control types work together
Governance controls establish applicable external obligations. Operational controls define ownership, review and response. Technical controls enforce data boundaries or provide the evidence needed to verify the actual operation.
When it applies
AI development, procurement, deployment and changed uses potentially within the Act’s scope and prohibited-practice provisions.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
Legal or compliance determines applicability; business and release owners implement decisions and engineering enforces restrictions.
Implementation guidance
- Document intended and reasonably foreseeable use, methods, data, audience, role and jurisdiction for qualified Article 5 review.
- Record the applicable prohibition analysis and any relevant statutory conditions; do not treat an internal exception as authority to waive a legal ban.
- Translate decisions into acquisition, feature, data and permission controls, preventing prohibited capability or deployment.
- Test enforcement and reassess material changes, supplier features and credible misuse before continued expansion.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a relevant use decision | Qualified analysis addresses the actual practice and scope. |
| Attempt a prohibited enabled capability in a controlled test | System and release controls prevent the assessed use. |
| Change the purpose or setting | The applicability review reopens before deployment. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Use and applicability assessment
- Qualified legal decision
- Restriction and release configuration
- Enforcement and change tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate suspected in-scope prohibited activity to legal and business authorities immediately. Suspend the affected use while scope and corrective action are resolved.
Example in practice
Hypothetical example: A vendor introduces a people-scoring feature into an existing service. The organization disables it while qualified reviewers assess the actual proposed practice rather than assuming the prior procurement approval covers the new use.
Related controls
- CF01-006: AI Regulatory & Standards Mapping
- CF11-005: Prohibited Use Case Technical Enforcement
- CF01-017: AI System Lifecycle Stage Controls
Framework mappings
- NIST AI RMF (MAP 1.1)
- EU AI Act (Art. 5)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Objective & Policy Constraints
Version 1.0