AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational
A system can meet technical performance targets while creating unacceptable effects in the workflow around it. Impact assessment connects intended benefits to who bears the cost of error, exclusion or misuse.
Control requirement
Assess reasonably foreseeable effects of an AI system on people, organizations and the wider operating environment before consequential deployment and after material changes. Record affected parties, harms, benefits, mitigations, uncertainties and the resulting deployment decision.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
New AI uses, significant changes in purpose or population, and systems whose decisions or actions can materially affect people or services.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The business system owner is accountable; risk, domain specialists and representatives of affected perspectives contribute to the assessment.
Implementation guidance
- Define the intended purpose, decision context, affected groups and alternatives to AI use; document assumptions and information gaps.
- Examine failures, misuse, unequal effects, privacy, access to services and realistic human intervention; include downstream and indirect consequences.
- Select mitigations, measurable acceptance conditions and recourse routes; seek relevant stakeholder input in a proportionate, privacy-respecting manner.
- Record the deployment decision and residual impacts; reassess after incidents, material change or evidence that initial assumptions no longer hold.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Trace a deployment decision | Material impacts influenced conditions or rejection, rather than remaining descriptive. |
| Review a vulnerable or overlooked group | Effects and uncertainties are considered with a reasoned response. |
| Introduce a new intended use | The assessment is reopened before consequential expansion. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Impact assessment and scope
- Stakeholder and domain inputs
- Mitigation and deployment decisions
- Reassessment records
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate unmitigated material harm or unresolved impact uncertainty to the accountable risk authority. Restrict the relevant decision or workflow until acceptable conditions and accessible response routes are established.
Example in practice
Hypothetical example: A scheduling model improves overall staffing efficiency but repeatedly disadvantages workers with fixed care commitments. Assessment leads to revised constraints, a challenge route and evaluation of outcomes before broader rollout.
Related controls
- CF01-002: AI Risk Management Program
- CF02-003: Demographic Impact Assessment
- CF02-013: Societal Impact Assessment
Framework mappings
- CSA AICM (GRC-10)
- NIST AI RMF (MAP 1.1, MAP 5.1)
- EU AI Act (Art. 9(2)(a))
- ISO 42001 (Cl. 8.4)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0