Back to the AI Control Library
34 controls | 18 core | 16 supplemental
Why this family matters
An AI program needs direction that carries through into day-to-day work. This family establishes how an organization directs AI throughout its lifecycle, from policy and risk assessment through change approval, deployment, monitoring and recovery. It connects authority to day-to-day decisions so that responsibility remains clear when a model, vendor or use case changes.
What this family covers
The controls cover governance policies, accountability, impact assessments, change authorization, system baselines, documentation and post-deployment planning. Supplemental controls extend that foundation into continuity, backup, disaster recovery and supporting governance practices.
How the four control types apply
Operational controls appear in policies, risk assessments, approval processes, documentation and continuity planning. Technical mechanisms support baselines, rollback and backup. Governance controls supply binding external requirements that those practices must address. The family name describes its program-management subject; it does not mean every entry is a Governance-type control.
Where to begin
Establish who owns the AI program, how risks are assessed, and what must happen before a system or material change is approved.
Controls in this family
This family contains 18 core and 16 supplemental controls. Each linked page provides a requirement, practical implementation guidance, verification criteria, evidence, escalation actions and a worked example. Core and supplemental are catalogue designations; applicability depends on the system and its risks.
Program direction and accountability
- CF01-001: Governance Program Policy & Procedures (core)
- CF01-002: AI Risk Management Program (core)
- CF01-003: Organizational Policy Reviews (core)
- CF01-004: Policy Exception Process (core)
- CF01-005: AI Governance Responsibility Model (core)
- CF01-006: AI Regulatory & Standards Mapping (core)
- CF01-007: Acceptable Use Policy for AI Systems (core)
- CF01-008: AI Impact Assessment (core)
Change and configuration
- CF01-009: AI Change Management Policy & Procedures (core)
- CF01-010: AI Change Quality Testing & Approval (core)
- CF01-011: AI Change Authorization (core)
- CF01-012: AI System Baseline Management (core)
- CF01-013: AI System Rollback & Restoration (core)
- CF01-S01: Change Management Technology (supplemental)
- CF01-S02: Change Agreements for AI Systems (supplemental)
- CF01-S03: AI Baseline Deviation Detection (supplemental)
- CF01-S04: AI Change Exception Management (supplemental)
Continuity and recovery
- CF01-014: AI Business Continuity & Operational Resilience Policy (core)
- CF01-S05: AI Business Continuity Risk Assessment (supplemental)
- CF01-S06: AI Business Continuity Strategy (supplemental)
- CF01-S07: AI Continuity Planning (supplemental)
- CF01-S08: AI Continuity Documentation (supplemental)
- CF01-S09: AI Continuity Exercises (supplemental)
- CF01-S10: AI Continuity Communication (supplemental)
- CF01-S11: AI System Backup (supplemental)
- CF01-S12: AI Disaster Response Plan (supplemental)
- CF01-S13: AI Disaster Response Exercise (supplemental)
Documentation and validation
- CF01-015: AI Model Documentation (core)
- CF01-016: AI Model Documentation Requirements (core)
- CF01-S14: AI Model Documentation Validation (supplemental)
Lifecycle and operation
- CF01-017: AI System Lifecycle Stage Controls (core)
- CF01-018: Post-Deployment Monitoring Plan (core)
Security and external learning
- CF01-S15: AI Information Security Program (supplemental)
- CF01-S16: AI Special Interest Group Engagement (supplemental)
Applying this family
Begin with a clear scope, accountable owners and a risk process. Connect those decisions to lifecycle gates, approved baselines and observable monitoring. Use continuity planning and tested recovery to address both unavailable services and unreliable output. Documentation should reflect the system actually deployed.
About this guidance
The requirements are the author’s synthesis for this library, rather than quotations from a standard. Control-type labels describe the mechanisms in each page; a particular implementation may draw on additional types.
Version 1.0