AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational
A service may be technically available yet unusable because data is stale or outputs cannot be trusted. Continuity assessment needs to examine the business process and its alternatives, not only infrastructure uptime.
Control requirement
Assess disruption risks and business impacts for AI-supported services, including loss of availability, trustworthy output, dependencies and recovery capability. Use the findings to establish continuity priorities and resilience requirements.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
Critical and important AI-supported processes and their suppliers, data sources, infrastructure and human dependencies.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The business process owner is accountable; continuity, technical and supplier owners contribute dependency and impact evidence.
Implementation guidance
- Identify AI-supported activities, affected users, dependency chains and the consequences of interrupted or unreliable service over time.
- Examine outages, malicious changes, provider withdrawal, data corruption and loss of review staff; record correlated failure paths.
- Determine acceptable disruption, data loss and minimum service requirements with the affected business owners.
- Assess whether existing fallback capacity can meet those needs and track gaps into strategy, investment or restricted reliance.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Inspect a critical workflow | Impact analysis covers both outage and unreliable output. |
| Test a shared dependency failure scenario | Combined effects on primary and fallback services are recognized. |
| Compare objectives with available capacity | Unsupported recovery assumptions are explicit and treated. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Business impact and disruption assessment
- Dependency map
- Approved tolerance decisions
- Fallback capacity and gap analysis
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate excessive disruption exposure to the continuity sponsor. Reduce dependence or establish an alternative where business tolerance cannot be met.
Example in practice
Hypothetical example: A fraud-review model and its backup both use the same identity provider. The assessment reveals that switching models alone cannot restore service during an identity outage.
Related controls
- CF01-014: AI Business Continuity & Operational Resilience Policy
- CF01-S06: AI Business Continuity Strategy
- CF01-S07: AI Continuity Planning
Framework mappings
- CSA AICM (BCR-02)
- NIST AI RMF (MAP 5.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0