AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational
Employees may adopt useful tools before the organization understands the information or authority involved. Clear rules reduce uncertainty, but they need accessible workflows and observable enforcement to influence daily behavior.
Control requirement
Define, communicate and enforce acceptable use rules for AI systems, covering permitted services, information handling, output reliance, consequential actions and prohibited uses. Give users a practical way to request approval and report mistakes.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
Employees, contractors and other authorized users of organizational AI, including external assistants and AI features embedded in ordinary applications.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The AI policy owner is accountable; security, privacy, HR and business owners define rules and managers support adoption.
Implementation guidance
- List approved services and use categories; specify prohibited information and activities in terms users can recognize.
- Set verification and human-review expectations for generated outputs, including when AI must not make or execute the final decision.
- Provide scenario-based training and a straightforward approval route for new uses; define how users report unintended disclosure or unauthorized activity.
- Apply proportionate technical restrictions through approved identities, access settings or data controls and review evidence of actual use.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Present common employee scenarios | Users can identify the approved tool, handling rule and escalation route. |
| Attempt a prohibited action in an authorized test | The chosen enforcement or detection process responds as designed. |
| Inspect a new-use request | It receives a documented decision and applicable conditions. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Acceptable use policy
- Approved tool and use register
- Training and request records
- Enforcement and incident evidence
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Route suspected disclosure or unsafe reliance to the relevant response team immediately. Restrict the affected access when exposure continues, and address policy ambiguity as well as individual behavior.
Example in practice
Hypothetical example: An employee wants to summarize a client contract. The policy points to an approved organizational service, explains the permitted data handling and requires review before the summary is sent outside the company.
Related controls
- CF01-001: Governance Program Policy & Procedures
- CF01-004: Policy Exception Process
- CF01-S15: AI Information Security Program
Framework mappings
- CSA AICM (GRC-09)
- NIST AI RMF (GOVERN 1.2)
- EU AI Act (Art. 13(1))
- ISO 42001 (Cl. 8.4)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0