AI Control Library / CF-07: Human Oversight & Escalation
Designation: Supplemental | Control types represented: Operational
Control requirement
Operate a controlled process for personnel AI agreements, assigning approved terms, acknowledgement, versioning, access linkage, updates and departure handling. Verify that required agreement steps precede covered access or responsibility.
Why this matters
An approved agreement template has little effect if it is never presented to the relevant contractor or cannot be traced to the version accepted. The process makes coverage and change handling demonstrable.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
Personnel agreements governing AI duties, acceptable use, confidentiality or other reviewed obligations, including contractors and outsourced operators.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
HR or the agreement process owner coordinates legal-approved content, managers and identity provisioning.
Implementation guidance
- Identify roles and relationships requiring agreements and the approved content applicable to each.
- Present terms accessibly and obtain the required acceptance or acknowledgement before covered authority is granted.
- Record version, scope and identity securely, managing updates through review and communication rather than silent replacement.
- Reconcile agreement coverage with current roles and suppliers, including departure and retained obligations where applicable.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a sensitive-role onboarding | Required agreement coverage precedes the relevant access. |
| Inspect a revised agreement | Accepted version and necessary update actions are identifiable. |
| Review a contractor population | Coverage matches actual personnel rather than only the supplier company name. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Agreement workflow and applicability
- Approved templates
- Acceptance and version records
- Coverage and departure reconciliations
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate missing required coverage to HR, legal and the role owner. Limit affected duties until the approved process is completed or an authorized alternative is established.
Example in practice
Hypothetical example: A supplier assigns a new model operator. The onboarding process verifies the individual’s required agreement coverage before issuing privileged access, rather than relying on a record for a previous operator.
Related controls
- CF07-S08: AI Personnel Agreement Content
- CF07-S10: AI Personnel Non-Disclosure Agreements
- CF07-S06: AI Role Change Access Revocation
Framework mappings
- CSA AICM (HRS-07)
- NIST AI RMF (GOVERN 5.2)
- ISO 42001 (Cl. 7.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0