AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational
A filled template can contain unsupported claims or describe a different model configuration. Validation establishes whether the record is reliable enough to support the decisions and operations that depend on it.
Control requirement
Validate model documentation against defined requirements and the actual deployment before approval and after material changes. Check completeness, consistency, supporting evidence and the usability of stated limitations.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
Model and deployment documentation for internal and third-party systems, including revisions following changed purpose or configuration.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
A qualified reviewer assesses the record with technical and domain support; the system owner resolves findings before approval.
Implementation guidance
- Compare the record against the documentation specification and identify required fields, evidence and unresolved information gaps.
- Reconcile model identity, intended use, evaluation conditions and dependency descriptions with the approved deployment baseline.
- Check material capability and limitation claims against evaluations and provider evidence; test whether operator instructions are actionable.
- Record findings, approval status and required updates; revalidate affected sections after material changes rather than reusing a stale approval.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Compare a model record with live configuration | Material identifiers, scope and dependencies agree. |
| Inspect a capability claim | Relevant evidence supports it and limits are clearly stated. |
| Present an operator with a documented failure mode | The record supports the intended response. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Validation checklist and reviewer record
- Baseline and evidence comparisons
- Findings and corrections
- Documentation approval history
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate misleading or unsupported material claims to the system owner and approver. Hold affected release or reliance until documentation and underlying evidence support the decision.
Example in practice
Hypothetical example: A vendor model card reports a test on a different language and population. The reviewer rejects its use as local performance evidence and requires either suitable evaluation or a narrower deployment claim.
Related controls
- CF01-015: AI Model Documentation
- CF01-016: AI Model Documentation Requirements
- CF01-010: AI Change Quality Testing & Approval
Framework mappings
- CSA AICM (MDS-05)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2, A6.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0