AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational and Contextual
A generic provider description cannot explain a particular deployment. Documentation must help operators and decision makers understand what has been evaluated, what remains uncertain and where reliance is inappropriate.
Control requirement
Create and maintain documentation for each AI model as actually used, including intended purpose, provenance, capabilities, limitations, evaluation results, operating conditions and accountable ownership. Make the appropriate information available to its intended audiences.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls establish documentation responsibilities and reviews. Contextual controls shape the information and limitations that guide how people use the model.
When it applies
Internally developed and third-party models, including fine-tuned or adapted versions and models embedded in vendor applications.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The model or system owner maintains the record; technical, domain and assurance reviewers contribute and validate relevant sections.
Implementation guidance
- Record the exact model identity, provenance, intended uses, supported environment and relationship to the deployed baseline.
- Describe relevant training or adaptation information where known, evaluation scope, limitations, failure modes and unresolved information gaps.
- Document input assumptions, output interpretation, human-review needs and prohibited reliance in terms operators can use.
- Version the record with model or use changes and provide audience-appropriate access while protecting confidential details.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Compare the record with the deployed baseline | Identity, capabilities and operating conditions agree. |
| Ask an operator about a known limitation | The documentation gives a usable instruction or escalation route. |
| Inspect provider information gaps | They are explicit and addressed through evaluation or restrictions. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Model documentation and revision history
- Baseline references
- Evaluation and limitation records
- Audience access and review evidence
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate absent or misleading material information to the system owner. Limit consequential reliance where critical capability or limitation claims cannot be substantiated.
Example in practice
Hypothetical example: A provider advertises multilingual support. Deployment documentation records that only English cases were evaluated locally and directs other languages to manual handling until additional testing is complete.
Related controls
- CF01-016: AI Model Documentation Requirements
- CF01-S14: AI Model Documentation Validation
- CF06-005: AI Capability & Limitation Notices
Framework mappings
- CSA AICM (MDS-03)
- NIST AI RMF (MAP 1.1, MEASURE 2.2)
- EU AI Act (Art. 11(1))
- ISO 42001 (Cl. 8.2, A6.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0