AI Governance Controls
Choose a control domain to see what your team needs to implement. Each control includes regulatory mappings, maturity levels, and implementation guidance.
See how controls form an AI governance framework. You can also compare tools organized by the same control domains.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 136 governance controls. Score maturity, assign owners, and set deadlines, with EU AI Act, NIST and ISO 42001 coverage on a dashboard.
- 136 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
Human Oversight
Review gates, approval workflows, and override mechanisms for AI decisions.
7 controls
AGTAgentic AI
Goal constraints, action boundaries, and escalation paths for autonomous AI agents.
30 controls
SECSecurity
Defenses against crafted inputs that trick AI into misbehaving, including prompt injection, plus controls on who can use each model.
7 controls
ALCAudit & Logging
Tamper-proof records of AI decisions, inputs, outputs, and which model version produced them.
5 controls
CHMChange Management
Model release governance, version rollback, and change approval workflows.
5 controls
DGCData Governance
Training data provenance, privacy controls, and data retention policies.
6 controls
MONMonitoring & Drift
Catching AI accuracy that slips over time (drift), alerts on unusual behavior, and operational dashboards.
6 controls
SAFSafety & Reliability
Safe fallbacks when AI fails, output checks, and reliable behavior when someone tries to trick the system.
6 controls
IRCIncident Response
Containment, investigation, and remediation procedures for AI system failures.
6 controls
PRCProcurement
Third-party AI vendor due diligence, contractual obligations, and offboarding.
18 controls
CMPRegulatory Compliance
Multi-jurisdiction regulatory mapping, standards monitoring, and compliance architecture for AI systems.
10 controls
BRDBoard & Executive Governance
Board education, committee charters, executive reporting, risk appetite, and enterprise-wide AI governance program design.
11 controls
MGVModel & Program Governance
Model lifecycle policy, intake and approval workflows, evaluation frameworks, and program-level AI governance maturity.
10 controls
SCTSector-Specific & Emerging
Healthcare, insurance, critical infrastructure, national security, and emerging-use-case controls not covered by domain-general frameworks.
9 controls
23 controls matching filters
Human Oversight
2 controlsAI Output Review Workflow
Define a structured, documented process for reviewing AI outputs before they are acted upon or distributed.
Override and Escalation Procedures
Document the procedures, authority levels, and logging requirements when humans reject, modify, or escalate AI-generated decisions.
Agentic AI
2 controlsHuman Oversight Classification Rationale Log
Document why each AI agent action requires human-in-the-loop (approval first) or human-on-the-loop (monitoring) oversight. Retain an auditable record of the reasoning behind those choices.
Agent Ownership and Accountability Register
Keep a register that names an accountable person for every deployed AI agent. Record who owns its outcomes, who sponsors it at executive level, and what happens when either person leaves.
Security
2 controlsAI API Credential Management
Securely manage, regularly replace, and audit API keys and credentials used to access AI services and model providers.
Deepfake Impersonation Defense for Approvals and Payments
Require a check through a separate, trusted channel before acting on voice, video, or message requests to move money, change payment details, or grant access. Do not accept a familiar voice or face as proof of identity.
Audit & Logging
1 controlChange Management
3 controlsAI Model Version Control
Track model versions, configurations, prompts, and deployment history so that any past live setup can be recreated and compared.
AI Model Change Documentation
Record what changed between model versions, why the change was made, what testing was performed, and who approved the deployment.
Model Deprecation Procedure
Define the process for retiring AI models from production, including notification, data handling, audit trail preservation, and transition planning.
Monitoring & Drift
1 controlIncident Response
3 controlsAI Incident Classification
Classify AI incidents by type and severity. Use the categories to set response urgency and notification requirements.
AI Post-Incident Review
Conduct a structured review after every significant AI incident to identify root causes, contributing factors, and systemic improvements.
AI Incident Log and Tracking
Maintain a centralized, structured log of all AI incidents, near-misses, and governance concerns, accessible to the AI governance function.
Procurement
7 controlsVendor AI Incident Notification Requirements
Require AI vendors to notify the organization of incidents affecting their AI systems within defined timeframes and with specified information.
Vendor Governance Change Monitoring
Monitor vendor changes to governance structures, safety leadership, and policies. Assess their effects on deployed system risks.
AI Vendor Financial Stability Assessment
Assess vendors’ financial stability and organizational viability during selection and recurring reviews. Consider market consolidation, regulatory costs, and dependence on further investor funding.
AI Safety Index and Benchmark Monitoring
Track external safety indices, benchmarks, and independent evaluations for your AI vendors and models. Include material findings in initial and recurring vendor risk assessments.
AI Platform Conflict-of-Interest Assessment
Assess conflicts when an AI vendor also supplies oversight, monitoring, or safety evaluations for its own models. Ensure governance decisions can be made without depending entirely on vendor-controlled evidence.
AI Evaluator and Auditor Independence Assessment
Before relying on an outside AI evaluation, audit, or safety assessment, check that the assessor is qualified and independent of the vendor. Discount findings that fail the check.
Vendor Regulatory and Legal Exposure Notification Standard
Require AI vendors to notify you, on a set timeline, when the vendor itself faces a regulatory investigation, an adverse government safety finding, a material legal proceeding, or discontinues a product you depend on, and trigger a compliance-impact reassessment when they do.