Controls
One control, many legal duties
A law says what must be true. A control is what an organisation operates to make it true, and the evidence is how it proves it. Each control below is linked to every recorded duty it satisfies or supports, across every jurisdiction, so the work done once can be counted once.
Original catalogue. Standards are cited by clause number only; the official text of a duty decides whether a control is enough.
- Controls
- 5
- original catalogue
- Evidence types
- 8
- from the evidence taxonomy
-
Technical measure Quality or testing lead · at launch and on material change
Accuracy, robustness, fairness and security testing
Verifies before release, and again after material change, that a system performs to declared accuracy levels, behaves consistently across groups and conditions, and resists the attacks specific to AI.
- Duties
- 15
- Binding
- 10
- Jurisdictions
- 9
Australia, European Union, India, Singapore, United Kingdom, Colorado (United States) and 3 more
Evidence: Pre-release test report, Test plan and acceptance criteria, Release test sign-off
-
Technical measure AI security or safety lead · at launch and on material change
Adversarial and red-team testing for generative AI
Finds the ways a generative or general-purpose model can be made to produce harmful, deceptive or dangerous output before users or attackers do, and feeds the findings back into mitigations.
- Duties
- 8
- Binding
- 7
- Jurisdictions
- 5
European Union, South Korea, California (United States), Texas (United States), United States
Evidence: Red-team exercise report, Red-team rules of engagement and scenario library, Adversarial findings tracker
-
Technical measure Engineering lead · continuous
Automatic event logging and record retention
Captures what an AI system did, when and with what inputs, and keeps those records long enough to reconstruct a decision, investigate an incident and demonstrate ongoing monitoring.
- Duties
- 8
- Binding
- 8
- Jurisdictions
- 1
European Union
Evidence: AI system event logs, Log schema and retention standard, Log integrity and retention check
-
Technical measure AI system owner · continuous
Post-deployment monitoring and drift detection
Watches a live AI system for falling performance, shifting data, emerging bias and unexpected use, and turns what it sees into corrective action, incident reports and documentation updates.
- Duties
- 10
- Binding
- 8
- Jurisdictions
- 4
European Union, Singapore, Colorado (United States), United States
Evidence: Post-market monitoring plan, Monitoring dashboard or periodic monitoring report, Monitoring review decision
-
Technical measure Engineering lead · continuous
Synthetic content labelling and provenance marking
Makes AI-generated or manipulated audio, image, video and text identifiable as such, both to people looking at it and to software checking it, so that it cannot easily be passed off as authentic.
- Duties
- 5
- Binding
- 4
- Jurisdictions
- 3
European Union, Singapore, South Korea
Evidence: Content labelling and provenance standard, Watermark and provenance robustness test, Visible AI-generated content label
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.