AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational
A policy can express good intentions while leaving actual decisions untouched. The program needs a clear path from an AI proposal to assessment, approval, monitoring and retirement, including what happens when a requirement is not met.
Control requirement
Establish, approve and maintain an AI program policy and supporting procedures that define scope, responsibilities, decision authority, risk criteria and lifecycle requirements. Translate the policy into activities that teams can perform and demonstrate.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
Organizations developing, buying, integrating or using AI, including pilots and employee use of external services.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The executive AI sponsor is accountable; the program lead maintains procedures, and system owners implement them.
Implementation guidance
- Identify covered systems, business units and external services; reconcile the scope against procurement, development and existing AI inventories.
- Define approval gates, minimum assessment requirements, escalation routes and policy exceptions, with accountable roles for each decision.
- Write usable procedures for intake, release, material change and retirement; include required records and where teams obtain help.
- Approve the policy, communicate it to affected teams, and review it at an approved interval and after significant organizational or technology changes.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Trace a recent AI deployment from intake to operation | Required decisions, owners and records can be located. |
| Ask a team to process an unfamiliar AI use case | The procedure produces an identified decision path without relying on personal contacts. |
| Review an unmet requirement | The system is held, remediated or handled through an authorized exception. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Approved policy and procedures
- Scope and inventory reconciliation
- Decision records and communications
- Review schedule and revision history
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate uncovered AI use to the program lead and system owner. Hold consequential deployment where required decisions have no assigned authority; document remediation and any authorized temporary restrictions.
Example in practice
Hypothetical example: A procurement team proposes an embedded writing assistant. The policy brings purchased features into scope, assigns an owner and requires a data-use review before staff upload client records. The proposal follows the same recorded intake path as internally developed applications.
Related controls
- CF01-002: AI Risk Management Program
- CF01-005: AI Governance Responsibility Model
- CF01-017: AI System Lifecycle Stage Controls
Framework mappings
- CSA AICM (GRC-01)
- NIST AI RMF (GOVERN 1.1, 1.2)
- EU AI Act (Art. 9(1))
- ISO 42001 (Cl. 5.2, 6.1)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0