AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational
Approved strategy does not tell an on-call operator what to do. Plans must bridge the gap between a disruption decision and the people, access and resources needed to keep essential work moving.
Control requirement
Maintain an executable continuity plan for each important AI-supported service, identifying activation triggers, authority, prioritized actions, fallback operation, recovery dependencies and conditions for returning to normal service.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
AI-supported services requiring sustained or reduced operation during disruption; coordinate with disaster response and security incident plans.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The service owner is accountable; continuity coordinators maintain the plan and named operators execute its assigned actions.
Implementation guidance
- Translate approved strategy into ordered actions with decision points, contact routes, prerequisites and responsibility for each step.
- Define reduced-service workflows, work prioritization, manual capacity and limits on unsupported AI substitution.
- Specify dependency restoration order, data reconciliation, access requirements and return-to-service authorization.
- Exercise the plan, record operational gaps and update it after material service, supplier or staffing changes.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Give the plan to an alternate operator | Required actions can be executed without undocumented personal knowledge. |
| Invoke reduced service in an exercise | Priority work remains within defined capacity and quality limits. |
| Restore normal operation | Accumulated work and data differences are reconciled before resumption. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Approved continuity plan
- Operator responsibilities and prerequisites
- Exercise outcomes
- Plan maintenance and recovery decisions
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate failed activation or inadequate fallback capacity to the service owner and continuity lead. Use approved prioritization or safe suspension rather than uncontrolled workarounds.
Example in practice
Hypothetical example: A claims team’s plan routes urgent cases to trained staff during an AI outage and queues routine work. Recovery includes reviewing cases processed manually before reconnecting automated decisions.
Related controls
- CF01-S06: AI Business Continuity Strategy
- CF01-S08: AI Continuity Documentation
- CF01-S09: AI Continuity Exercises
Framework mappings
- CSA AICM (BCR-04)
- NIST AI RMF (MANAGE 4.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0