AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational and Technical
A list of possible backups is not a strategy. The organization must select alternatives with known capacity, acceptable behavior and realistic dependencies, then resource their operation.
Control requirement
Select and approve a continuity strategy for important AI-supported services that meets defined business needs through a viable combination of resilience, alternative services, manual operation or safe suspension.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls define the process and decision authority; Technical controls enforce boundaries or produce the system evidence needed to verify it.
When it applies
AI-supported services with established continuity needs, including situations where full functionality cannot reasonably be preserved.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The business owner approves the strategy; continuity and technology teams evaluate feasibility, cost and residual limitations.
Implementation guidance
- Use the impact assessment to compare continuity options against recovery time, data needs, service quality and safety constraints.
- Evaluate alternate models or providers for permissions, privacy, quality and compatible outputs before treating them as substitutes.
- Identify common dependencies, staffing needs, switching conditions and costs, including the capacity of manual fallback.
- Approve the chosen strategy and residual limitations, assign resources and translate the decision into executable plans and tests.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Trace the strategy to business requirements | Chosen options address approved disruption tolerances or expose an accepted gap. |
| Exercise a substitute service | It meets its defined reduced-service criteria without inheriting uncontrolled permissions. |
| Review common dependencies | A supposedly independent fallback is not vulnerable to the same untreated failure. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Options and feasibility analysis
- Alternative-service evaluations
- Strategy approval and resourcing
- Residual-risk and dependency records
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate unworkable alternatives to the business owner. Limit service commitments and AI dependence until a feasible strategy or accepted restriction is established.
Example in practice
Hypothetical example: A legal-support team chooses a restricted search interface rather than an untested alternate language model during an outage. The reduced service preserves document access without producing unsupported generated advice.
Related controls
- CF01-S05: AI Business Continuity Risk Assessment
- CF01-S07: AI Continuity Planning
- CF01-013: AI System Rollback & Restoration
Framework mappings
- CSA AICM (BCR-03)
- NIST AI RMF (MANAGE 4.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0