AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational
A policy can remain formally current while its assumptions become obsolete. Review must examine how the policy performs in real decisions, rather than merely changing the approval date.
Control requirement
Review AI policies and procedures at an approved risk-based interval and when material changes occur. Record findings, approval decisions, required revisions and verification that affected teams have adopted the changes.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
All AI program policies and procedures, including policies inherited from security, procurement, privacy and business operations.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The policy owner conducts review; affected functions contribute evidence and the designated approver accepts revisions.
Implementation guidance
- Maintain a policy inventory with owners, dependencies, review dates and triggers such as incidents, new AI capabilities or external obligation changes.
- Collect exceptions, audit findings, incident lessons and operator feedback to identify gaps between policy and practice.
- Assess whether scope, approval criteria and assigned responsibilities remain adequate; document reasons for retaining or changing requirements.
- Publish approved revisions, notify affected roles and confirm that procedures, training and system gates are updated consistently.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Inspect an overdue review | An owner and escalation decision are recorded. |
| Trace an incident-driven policy change | The revision addresses the identified gap and reaches affected teams. |
| Compare related procedures | Approval rules and responsibilities do not contradict the current policy. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Policy inventory
- Review findings and supporting inputs
- Approved revisions
- Adoption and communication records
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Refer overdue or unresolved policy gaps to the program lead. Introduce interim instructions or restrictions where the existing policy cannot safely support an active use case.
Example in practice
Hypothetical example: A policy review finds that a team treats a new autonomous feature as a routine software update. The owner revises the change criteria and checks that procurement and release procedures now trigger an autonomy review.
Related controls
- CF01-001: Governance Program Policy & Procedures
- CF01-004: Policy Exception Process
- CF01-009: AI Change Management Policy & Procedures
Framework mappings
- CSA AICM (GRC-03)
- NIST AI RMF (GOVERN 1.2)
- EU AI Act (Art. 9(2))
- ISO 42001 (Cl. 9.3)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0