AI control matrix
Control, stage, owner, trigger, evidence and review frequency
03 / CONTROLS
Lifecycle controls.
Embed proportionate checkpoints and evidence into the way AI is designed, built, released and operated.
Explore the processHOW IT WORKS
Controls at every delivery gate
Controls should be built into existing delivery workflows, with evidence captured as work happens. A gate should define what must be true before the next stage proceeds.
STAGE01
CONTROL FOCUS
Discover
Confirm value and risk
EVIDENCE TO CAPTURE
Use-case intake, sponsor and initial risk classification
Select any stage to see its control focus and expected evidence.
QUESTIONS TO ANSWER
Make it operational.
Use these questions to turn governance principles into decisions that your organisation can evidence.
- Which gates are mandatory for this system's risk level?
- What evidence proves each control was performed?
- Who can authorise an exception and for how long?
TANGIBLE OUTPUTS
What good looks like.
Release assurance pack
Linked tests, risk decisions, approvals and rollback plan
Exception log
Time-bound waivers, rationale, compensating controls and expiry
MEASUREMENT
Signals worth tracking
Illustrative measures to adapt to your organisation's risk profile and delivery model.
Controls with complete evidenceOpen exceptions past expiryReleases without approval