AI Governance Controls
Choose a control domain to see what your team needs to implement. Each control includes regulatory mappings, maturity levels, and implementation guidance.
See how controls form an AI governance framework. You can also compare tools organized by the same control domains.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 132 governance controls. Score maturity, assign owners, and set deadlines, with EU AI Act, NIST and ISO 42001 coverage on a dashboard.
- 132 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
Human Oversight
Review gates, approval workflows, and override mechanisms for AI decisions.
7 controls
AGTAgentic AI
Goal constraints, action boundaries, and escalation paths for autonomous AI agents.
28 controls
SECSecurity
Defenses against crafted inputs that trick AI into misbehaving, including prompt injection, plus controls on who can use each model.
6 controls
ALCAudit & Logging
Tamper-proof records of AI decisions, inputs, outputs, and which model version produced them.
5 controls
CHMChange Management
Model release governance, version rollback, and change approval workflows.
5 controls
DGCData Governance
Training data provenance, privacy controls, and data retention policies.
6 controls
MONMonitoring & Drift
Catching AI accuracy that slips over time (drift), alerts on unusual behavior, and operational dashboards.
6 controls
SAFSafety & Reliability
Safe fallbacks when AI fails, output checks, and reliable behavior when someone tries to trick the system.
6 controls
IRCIncident Response
Containment, investigation, and remediation procedures for AI system failures.
6 controls
PRCProcurement
Third-party AI vendor due diligence, contractual obligations, and offboarding.
17 controls
CMPRegulatory Compliance
Multi-jurisdiction regulatory mapping, standards monitoring, and compliance architecture for AI systems.
10 controls
BRDBoard & Executive Governance
Board education, committee charters, executive reporting, risk appetite, and enterprise-wide AI governance program design.
11 controls
MGVModel & Program Governance
Model lifecycle policy, intake and approval workflows, evaluation frameworks, and program-level AI governance maturity.
10 controls
SCTSector-Specific & Emerging
Healthcare, insurance, critical infrastructure, national security, and emerging-use-case controls not covered by domain-general frameworks.
9 controls
27 controls matching filters
Human Oversight
1 controlAgentic AI
6 controlsAgent Permission Boundaries
Define and enforce the tools, APIs, data sources, and actions each agent may use, granting only the minimum needed (least privilege).
Multi-Agent Trust Hierarchy
Define explicit rules for which AI agents can instruct, call on, or delegate authority to other agents in multi-agent systems.
Agent Environment Isolation
Run AI agents in isolated environments. Limit system, network, and data access to what their tasks require.
Agent and Non-Human Identity Management
Give each agent a distinct identity with narrowly limited credentials, access controls, and a defined lifecycle. Avoid shared service accounts and user identities.
Agent Behavior Monitoring and Anomaly Detection
Monitor deployed AI agents for behavioral drift, unusual use of connected tools, unexpected resource use, and actions outside their permitted scope.
Agentic AI Security Assessment, CBRN and Cyber Espionage
Assess AI agent deployments for high-consequence misuse, including chemical, biological, radiological, and nuclear facilitation or AI-orchestrated cyber espionage. Implement mitigations proportionate to identified risks.
Audit & Logging
1 controlData Governance
2 controlsTraining Data Provenance
Track and document the origin, composition, licensing, and preparation history of data used to train or fine-tune AI models.
Cross-Border Data Transfer Controls for AI
Govern international personal-data transfers through AI systems. Include transfers to AI service providers, model training systems, and cloud infrastructure in other jurisdictions.
Monitoring & Drift
2 controlsAI Bias and Fairness Monitoring
Continuously monitor AI system outputs for discriminatory patterns across protected demographic attributes in live use.
Behavioral Anomaly Detection for Agentic Systems
Monitor AI agents for unexpected action sequences, data or system access, and behavior inconsistent with assigned tasks.
Safety & Reliability
2 controlsHallucination Detection and Mitigation
Implement controls to detect, reduce, and manage AI-generated factual errors and fabrications before they reach end users or inform decisions.
Post-Deployment Adversarial Testing Cadence
Schedule recurring red-teaming (simulated attacks) of live systems by risk tier. Continue this testing after pre-deployment assessments.
Procurement
1 controlRegulatory Compliance
4 controlsMulti-Jurisdiction AI Regulatory Compliance Mapping
Map AI obligations across operating jurisdictions. Identify differing requirements, conflicts, and duties requiring simultaneous compliance.
EU AI Act Conformity Assessment and FRIA Process
Implement applicable EU AI Act assessment requirements for high-risk systems. Prepare technical documentation, engage notified bodies where required, and address fundamental rights impact assessments.
AI Hardware Provenance and Export Control Compliance
Document the origin and supply chain of AI hardware, including GPUs (graphics processing units) and specialized chips. Screen infrastructure purchases against applicable export controls.
AI Use in Regulatory Reporting and Risk Modeling
Map AI uses in regulatory reporting, stress testing, and risk modeling to supervisory expectations. Document validation of outputs before regulatory submission.
Board & Executive Governance
2 controlsFederated AI Governance Design
Define accountability across distributed AI deployments. Allocate central and business-unit responsibilities, and set escalation routes when local governance is insufficient.
Unified Multi-Framework AI Risk Register
Consolidate the NIST AI Risk Management Framework (RMF), ISO 42001, EU AI Act, and sector obligations in one risk register. Remove duplication and identify controls satisfying several requirements.
Model & Program Governance
2 controlsContinuous AI Assurance Function Design
Operate an ongoing assurance function that produces regular evidence of control effectiveness. Give boards, regulators, and enterprise customers current records of the governance program’s performance.
RAI Benchmark-Aligned Evaluation Framework
Map AI system evaluations to published benchmarks such as HELM Safety, AIR-Bench, and FACTS. Produce evidence regulators, auditors, and enterprise customers can compare against independent standards.
Sector-Specific & Emerging
3 controlsClinical AI Governance Committee Charter
Create a healthcare AI committee with clinical and technical expertise. Define quorum, decision rights, and escalation authority over clinical support and patient-care systems. Schedule reviews around applicable FDA Software as a Medical Device (SaMD) guidance and state clinical standards.
Critical Infrastructure AI Risk Assessment and Containment
Assess AI risks in energy, water, transport, and financial market infrastructure. Cover limiting AI's reach into operational technology, consequences of failure, and dependencies across sectors. Address these alongside standard enterprise AI risks.
National Security and Dual-Use AI Risk Assessment
Assess AI systems and research with both commercial and national security or weapons applications. Address export controls from the US Commerce Department's Bureau of Industry and Security (BIS), defense-related ITAR arms export duties, dual-use research protocols, and monitoring for foreign adversarial misuse.