{"slug":"accuracy-robustness-security-testing","title":"Accuracy, robustness, fairness and security testing","kind":"technical","purpose":"Verifies before release, and again after material change, that a system performs to declared accuracy levels, behaves consistently across groups and conditions, and resists the attacks specific to AI.","owner_role":"Quality or testing lead","frequency":"on_material_change","risk_subdomains":["7.3","1.3","2.2","1.1"],"evidence_types":["evaluation_report","procedure","approval_record"],"framework_references":["iso_42001: Annex A.6.2.4","nist_ai_rmf: MEASURE 2.5, 2.6, 2.7, 2.11","iso_27001: Clause 8.1; Annex A 8.29 Security testing in development","mitre_atlas: AML.M0008 Validate ML Model, AML.M0003 Model Hardening, AML.M0015 Adversarial Input Detection","owasp_llm_top10: LLM04 Data and Model Poisoning"],"obligations":["us-nist-ai-rmf-measure","eu-ai-act-art-50-2-synthetic-content-marking","singapore-mgf-operations-management","eu-ai-act-accuracy-robustness-cybersecurity","australia-vaiss-testing-human-control-transparency","eu-ai-act-risk-management-system","us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition","us-omb-m-25-21-high-impact-ai-practices","eu-ai-act-art-55-systemic-risk-cybersecurity","india-dpdp-security-and-breach-notification","uk-principles-safety-security-robustness","uk-principles-fairness","us-colorado-ai-act-developer-reasonable-care","us-new-york-city-local-law-144-bias-audit","us-new-york-city-local-law-144-publish-audit-summary"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing","context_url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing.md"}
{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","purpose":"Gives the organisation a single approved statement of how it will develop, buy and use AI, and names the people who are answerable for it, so that every other AI control has a mandate and an owner.","owner_role":"Executive sponsor for AI","frequency":"annual","risk_subdomains":["6.5","5.2"],"evidence_types":["policy_document","approval_record","meeting_record","register_entry"],"framework_references":["iso_42001: Clause 5.1, 5.2, 5.3, 9.3; Annex A.2, A.3","nist_ai_rmf: GOVERN 1.1, 1.2, 1.3, 2.1, 3.1","oecd_ai_principles: Principle 1.5 Accountability"],"obligations":["eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","eu-ai-act-art-16-provider-obligations","eu-ai-act-art-21-cooperation-with-authorities","eu-ai-act-quality-management-system","australia-vaiss-accountability-and-risk-management","us-eo-14179-agency-review-of-prior-actions","us-nist-ai-rmf-govern","india-ai-guidelines-principles-and-risk-based-governance","nepal-ai-policy-responsible-ai-principles","singapore-mgf-internal-governance","south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","uae-ai-strategy-ethics-and-governance-commitment","uk-principles-accountability-governance","us-california-sb-53-whistleblower-protections","us-colorado-deployer-risk-management-program","us-colorado-ai-act-deployer-reasonable-care"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability","context_url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability.md"}
{"slug":"ai-impact-assessment","title":"AI impact and fundamental-rights impact assessment","kind":"process","purpose":"Examines how a planned AI use will affect the people, groups and communities it touches, with particular attention to discrimination and rights, and records the mitigations chosen before the system goes live.","owner_role":"AI system owner","frequency":"per_system","risk_subdomains":["1.1","1.3","5.2","6.2"],"evidence_types":["impact_assessment","approval_record","procedure"],"framework_references":["iso_42001: Clause 6.1.4, 8.4; Annex A.5","iso_42005: ISO/IEC 42005 Clause 5, 6","nist_ai_rmf: MAP 5.1, 5.2; MEASURE 2.11","oecd_ai_principles: Principle 1.2 Human-centred values and fairness"],"obligations":["eu-ai-act-art-26-7-worker-information","eu-ai-act-art-26-9-dpia-using-provider-information","us-nist-ai-rmf-map","eu-ai-act-fundamental-rights-impact-assessment","us-omb-m-25-21-high-impact-ai-practices","india-dpdp-significant-data-fiduciary-duties","south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment","uae-pdpl-impact-assessment-new-technologies","uk-principles-fairness","uk-ico-dpia-for-ai","us-colorado-deployer-impact-assessment"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-impact-assessment","context_url":"https://aipolicytracker.org/controls/ai-impact-assessment.md"}
{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","purpose":"Ensures that harm or near-harm caused by an AI system is detected, contained, investigated and, where a rule requires it, reported to the right authority and affected people within the applicable time limit.","owner_role":"Incident coordinator","frequency":"continuous","risk_subdomains":["6.5","7.3","2.2","4.2"],"evidence_types":["procedure","incident_record","regulatory_filing"],"framework_references":["iso_42001: Clause 10.2; Annex A.8.3, A.8.4","nist_ai_rmf: MANAGE 4.1, 4.3; GOVERN 4.3, 6.2","iso_27001: Annex A 5.24 to 5.28 Information security incident management"],"obligations":["eu-ai-act-art-26-5-deployer-monitoring-and-suspension","singapore-mgf-genai-incident-reporting-and-provenance","us-nist-ai-rmf-manage","eu-ai-act-gpai-systemic-risk","eu-ai-act-post-market-monitoring","eu-ai-act-serious-incident-reporting","eu-ai-act-art-20-corrective-actions-and-information","eu-ai-act-art-55-systemic-risk-incident-reporting","south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","us-california-sb-53-critical-safety-incident-reporting","india-dpdp-security-and-breach-notification","us-california-sb-53-whistleblower-protections","us-colorado-ai-act-developer-disclosure-to-attorney-general","us-colorado-ai-act-deployer-disclosure-to-attorney-general"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting","context_url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting.md"}
{"slug":"ai-interaction-and-use-disclosure","title":"AI interaction and use disclosure notices","kind":"process","purpose":"Tells people, in plain language and at the right moment, that they are interacting with an AI system, that AI is being used in a decision about them or that their data feeds an AI system.","owner_role":"Product owner","frequency":"on_material_change","risk_subdomains":["7.4","4.3","5.2"],"evidence_types":["disclosure_notice","register_entry","approval_record"],"framework_references":["iso_42001: Annex A.8.2, A.8.5","nist_ai_rmf: MEASURE 2.8; GOVERN 5.1","oecd_ai_principles: Principle 1.3 Transparency and explainability"],"obligations":["eu-ai-act-art-26-7-worker-information","singapore-pdpc-ai-notification","south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","eu-ai-act-art-26-11-notice-to-affected-persons","eu-ai-act-art-50-3-emotion-recognition-notice","eu-ai-act-deployer-obligations","eu-ai-act-transparency-article-50","australia-vaiss-testing-human-control-transparency","us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","uk-principles-transparency-explainability","uk-ico-automated-decision-safeguards","us-colorado-consumer-notice-and-adverse-decision-explanation","us-colorado-ai-act-deployer-public-statement","us-colorado-ai-act-consumer-ai-interaction-disclosure","us-colorado-admt-advance-notice","us-new-york-city-local-law-144-publish-audit-summary","us-new-york-city-local-law-144-candidate-notice","us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure","context_url":"https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure.md"}
{"slug":"ai-literacy-and-role-based-training","title":"AI literacy and role-based training programme","kind":"training","purpose":"Gives everyone who builds, buys, operates or is overseen by AI systems the knowledge they need for their role, from general awareness to the specific skills of overseeing a high-risk system.","owner_role":"Learning and development lead","frequency":"annual","risk_subdomains":["5.1","6.5","4.3"],"evidence_types":["training_record","procedure","policy_document"],"framework_references":["iso_42001: Clause 7.2, 7.3; Annex A.4.6","nist_ai_rmf: GOVERN 2.2, 4.1","mitre_atlas: AML.M0018 User Training"],"obligations":["eu-ai-act-human-oversight","eu-ai-act-ai-literacy","us-nist-ai-rmf-govern","singapore-mgf-internal-governance"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-literacy-and-role-based-training","context_url":"https://aipolicytracker.org/controls/ai-literacy-and-role-based-training.md"}
{"slug":"ai-quality-management-system","title":"Quality management system for AI development and supply","kind":"policy","purpose":"Binds the organisation's AI processes into one documented, audited management system so that compliance is repeatable across products rather than reinvented for each one.","owner_role":"Quality lead","frequency":"annual","risk_subdomains":["6.5","7.3"],"evidence_types":["policy_document","audit_report","meeting_record"],"framework_references":["iso_42001: Clause 4 to 10","nist_ai_rmf: GOVERN 1.4, 1.5, 1.7"],"obligations":["eu-ai-act-art-16-provider-obligations","eu-ai-act-quality-management-system","eu-ai-act-conformity-assessment-registration"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-quality-management-system","context_url":"https://aipolicytracker.org/controls/ai-quality-management-system.md"}
{"slug":"ai-risk-assessment","title":"AI risk assessment and lifecycle risk register","kind":"process","purpose":"Identifies, rates and treats the risks that a specific AI system poses to health, safety, rights and the organisation itself, and keeps that analysis alive from design through retirement.","owner_role":"AI system owner","frequency":"per_system","risk_subdomains":["1.1","1.3","5.1","7.3","6.5"],"evidence_types":["risk_assessment","risk_register","approval_record"],"framework_references":["iso_42001: Clause 6.1.2, 6.1.3, 8.2, 8.3","iso_23894: Clause 6.4, 6.5, 6.6","nist_ai_rmf: MAP 3, MAP 4, MANAGE 1.2, 1.3, 2.1"],"obligations":["us-nist-ai-rmf-map","us-nist-ai-rmf-manage","australia-vaiss-accountability-and-risk-management","eu-ai-act-risk-management-system","singapore-mgf-human-involvement","south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","india-ai-guidelines-principles-and-risk-based-governance","singapore-mgf-internal-governance","uk-principles-safety-security-robustness","us-colorado-deployer-risk-management-program","us-colorado-ai-act-developer-reasonable-care","us-colorado-ai-act-deployer-reasonable-care"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-risk-assessment","context_url":"https://aipolicytracker.org/controls/ai-risk-assessment.md"}
{"slug":"ai-system-inventory","title":"AI system inventory and classification","kind":"process","purpose":"Ensures the organisation knows every AI system it builds, buys or embeds, who owns it, what it is for and which legal risk tier it falls into, so that obligations can be assigned rather than discovered after the fact.","owner_role":"AI governance lead","frequency":"continuous","risk_subdomains":["6.5","7.4"],"evidence_types":["register_entry","approval_record","procedure"],"framework_references":["iso_42001: Clause 4.1, 4.3, 8.1; Annex A.6.2.2, A.9.4","nist_ai_rmf: MAP 1.1, 1.5; GOVERN 1.6","mitre_atlas: AML.M0023 AI Bill of Materials"],"obligations":["south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","us-nist-ai-rmf-map","eu-ai-act-art-25-value-chain-becoming-provider","australia-vaiss-contestability-supply-chain-records","eu-ai-act-prohibited-practices","eu-ai-act-art-6-4-non-high-risk-assessment-documentation","south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","us-omb-m-25-21-use-case-inventory","uk-principles-accountability-governance","us-colorado-ai-act-deployer-public-statement"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/ai-system-inventory","context_url":"https://aipolicytracker.org/controls/ai-system-inventory.md"}
{"slug":"conformity-assessment-and-registration","title":"Conformity assessment, declaration and registration","kind":"process","purpose":"Takes a regulated system through the applicable pre-market assessment, produces the signed declaration or certificate and completes any registration with authorities before the system is placed on the market.","owner_role":"Regulatory compliance lead","frequency":"per_system","risk_subdomains":["6.5","7.3"],"evidence_types":["conformity_declaration","regulatory_filing","technical_file"],"framework_references":["iso_42001: Clause 9.2; Annex A.6.2.7","nist_ai_rmf: GOVERN 1.1; MAP 4.1"],"obligations":["eu-ai-act-importer-distributor-obligations","eu-ai-act-art-22-authorised-representative","eu-ai-act-conformity-assessment-registration","eu-ai-act-art-6-4-non-high-risk-assessment-documentation"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/conformity-assessment-and-registration","context_url":"https://aipolicytracker.org/controls/conformity-assessment-and-registration.md"}
{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","purpose":"Writes into supplier and customer agreements who does what on documentation, testing, notification, data rights and cooperation, so that legal duties do not fall into the gap between organisations.","owner_role":"Legal counsel","frequency":"per_system","risk_subdomains":["6.5","6.4"],"evidence_types":["contract_clause","contract_clause","register_entry"],"framework_references":["iso_42001: Annex A.10.2, A.10.3, A.10.4","nist_ai_rmf: GOVERN 6.1; MANAGE 3.1"],"obligations":["eu-ai-act-art-25-4-written-agreements-with-component-suppliers","eu-ai-act-art-54-gpai-authorised-representative","eu-ai-act-importer-distributor-obligations","eu-ai-act-art-22-authorised-representative","eu-ai-act-transparency-to-deployers","eu-ai-act-art-25-value-chain-becoming-provider","australia-vaiss-contestability-supply-chain-records","south-korea-ai-basic-act-art-36-domestic-representative","us-colorado-admt-developer-documentation"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties","context_url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties.md"}
{"slug":"data-governance-and-dataset-documentation","title":"Data governance and dataset documentation","kind":"process","purpose":"Makes sure the data used to train, tune, validate and test an AI system is fit for purpose, understood and documented, so that quality and bias problems are found in the data before they surface in decisions.","owner_role":"Data governance lead","frequency":"per_system","risk_subdomains":["1.1","1.3","7.3","2.1"],"evidence_types":["dataset_documentation","evaluation_report","approval_record"],"framework_references":["iso_42001: Annex A.7.2, A.7.3, A.7.4, A.7.6","nist_ai_rmf: MAP 2.3; MEASURE 2.1, 2.2, 2.11","mitre_atlas: AML.M0007 Sanitize Training Data","owasp_llm_top10: LLM04 Data and Model Poisoning"],"obligations":["eu-ai-act-art-26-4-deployer-input-data","singapore-pdpc-consent-or-exception-for-ai-data","eu-ai-act-technical-documentation","eu-ai-act-data-governance","singapore-mgf-operations-management","india-dpdp-consent-and-notice","uk-principles-fairness","us-new-york-city-local-law-144-data-policy-disclosure"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation","context_url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation.md"}
{"slug":"decision-explanation-and-appeal-route","title":"Decision explanation, human review and appeal route","kind":"process","purpose":"Gives people affected by a significant automated or AI-assisted decision a meaningful explanation, a way to correct the data behind it, and a route to have a person reconsider it.","owner_role":"Customer operations lead","frequency":"per_system","risk_subdomains":["5.2","1.1","7.4"],"evidence_types":["disclosure_notice","procedure","monitoring_record"],"framework_references":["iso_42001: Annex A.8.2, A.8.3, A.9.2","nist_ai_rmf: MEASURE 2.9; GOVERN 5.1; MANAGE 4.1","oecd_ai_principles: Principle 1.3 Transparency and explainability"],"obligations":["eu-ai-act-art-26-11-notice-to-affected-persons","australia-vaiss-contestability-supply-chain-records","south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures","us-colorado-admt-adverse-decision-disclosure","us-colorado-admt-human-review","eu-ai-act-art-86-right-to-explanation","uae-pdpl-automated-decision-objection","uk-principles-transparency-explainability","uk-principles-contestability-redress","uk-ico-automated-decision-safeguards","us-colorado-consumer-notice-and-adverse-decision-explanation","us-new-york-city-local-law-144-alternative-process-request"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route","context_url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route.md"}
{"slug":"frontier-model-safety-framework","title":"Frontier model safety and security framework","kind":"policy","purpose":"Commits a developer of the most capable general-purpose models to a published, regularly reviewed description of how it identifies catastrophic and systemic risks, decides when a model is safe to train further or release, and protects model weights.","owner_role":"Head of AI safety","frequency":"annual","risk_subdomains":["7.2","7.1","4.2","6.1"],"evidence_types":["policy_document","evaluation_report","regulatory_filing","register_entry"],"framework_references":["nist_ai_rmf: GOVERN 1.3, 1.4; MAP 5.1; MEASURE 2.6; MANAGE 1.3","iso_42001: Clause 5.2, 6.1.2; Annex A.6.1.2","mitre_atlas: AML.M0001 Limit Model Artifact Release, AML.M0005 Control Access to ML Models and Data at Rest"],"obligations":["eu-ai-act-art-52-systemic-risk-notification","eu-ai-act-gpai-systemic-risk","south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","eu-ai-act-art-55-systemic-risk-incident-reporting","eu-ai-act-art-55-systemic-risk-cybersecurity","us-california-sb-53-frontier-ai-framework","us-california-sb-53-critical-safety-incident-reporting","us-california-sb-53-transparency-report","us-california-sb-53-catastrophic-risk-assessment-summaries"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/frontier-model-safety-framework","context_url":"https://aipolicytracker.org/controls/frontier-model-safety-framework.md"}
{"slug":"genai-red-team-testing","title":"Adversarial and red-team testing for generative AI","kind":"technical","purpose":"Finds the ways a generative or general-purpose model can be made to produce harmful, deceptive or dangerous output before users or attackers do, and feeds the findings back into mitigations.","owner_role":"AI security or safety lead","frequency":"on_material_change","risk_subdomains":["2.2","4.2","4.3","1.2","7.2"],"evidence_types":["evaluation_report","procedure","risk_register"],"framework_references":["nist_ai_rmf: MEASURE 2.6, 2.7; MANAGE 2.2","iso_42001: Annex A.6.2.4","owasp_llm_top10: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage","mitre_atlas: AML.M0020 Generative AI Guardrails, AML.M0022 Generative AI Model Alignment"],"obligations":["us-nist-ai-rmf-measure","eu-ai-act-gpai-systemic-risk","eu-ai-act-accuracy-robustness-cybersecurity","us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition","south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition","us-california-sb-53-frontier-ai-framework","us-california-sb-53-catastrophic-risk-assessment-summaries"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/genai-red-team-testing","context_url":"https://aipolicytracker.org/controls/genai-red-team-testing.md"}
{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","purpose":"Ensures that competent people can understand, question, correct, stop or decline to use an AI system's output, and that the degree of human involvement is chosen deliberately for each decision point.","owner_role":"AI system owner","frequency":"per_system","risk_subdomains":["5.1","5.2","7.3"],"evidence_types":["procedure","approval_record","training_record"],"framework_references":["iso_42001: Annex A.6.2.5, A.9.2, A.9.3","nist_ai_rmf: GOVERN 3.2; MAP 3.5; MANAGE 2.4","oecd_ai_principles: Principle 1.2 Human-centred values and fairness","owasp_llm_top10: LLM06 Excessive Agency"],"obligations":["eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","eu-ai-act-human-oversight","eu-ai-act-deployer-obligations","australia-vaiss-testing-human-control-transparency","south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","us-colorado-admt-human-review","us-omb-m-25-21-high-impact-ai-practices","singapore-mgf-human-involvement","uae-pdpl-automated-decision-objection","uk-ico-automated-decision-safeguards","us-new-york-city-local-law-144-alternative-process-request"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/human-oversight-and-override","context_url":"https://aipolicytracker.org/controls/human-oversight-and-override.md"}
{"slug":"model-release-and-change-management-gate","title":"Model release and change-management gate","kind":"process","purpose":"Makes every release, retraining and material change to an AI system pass through a documented decision that confirms the required assessments, tests and documentation are complete and current.","owner_role":"Release manager","frequency":"on_material_change","risk_subdomains":["7.3","6.5"],"evidence_types":["approval_record","procedure"],"framework_references":["iso_42001: Clause 8.1; Annex A.6.2.5, A.6.1.3","nist_ai_rmf: MANAGE 1.1, 2.3; GOVERN 1.7","iso_27001: Annex A 8.32 Change management"],"obligations":["eu-ai-act-art-25-value-chain-becoming-provider","eu-ai-act-art-53-gpai-technical-and-downstream-documentation","eu-ai-act-art-20-corrective-actions-and-information","eu-ai-act-quality-management-system","us-california-sb-53-transparency-report"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate","context_url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate.md"}
{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","purpose":"Watches a live AI system for falling performance, shifting data, emerging bias and unexpected use, and turns what it sees into corrective action, incident reports and documentation updates.","owner_role":"AI system owner","frequency":"continuous","risk_subdomains":["7.3","1.3","5.1","6.5"],"evidence_types":["procedure","monitoring_record","approval_record"],"framework_references":["iso_42001: Clause 9.1; Annex A.6.2.6","nist_ai_rmf: MEASURE 3.1, 3.3; MANAGE 4.1","iso_23894: Clause 6.6"],"obligations":["eu-ai-act-art-26-4-deployer-input-data","eu-ai-act-art-26-5-deployer-monitoring-and-suspension","us-nist-ai-rmf-measure","singapore-mgf-operations-management","eu-ai-act-post-market-monitoring","eu-ai-act-risk-management-system","eu-ai-act-accuracy-robustness-cybersecurity","eu-ai-act-deployer-obligations","us-colorado-deployer-impact-assessment","us-colorado-ai-act-developer-disclosure-to-attorney-general"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection","context_url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection.md"}
{"slug":"privacy-and-data-protection-for-ai","title":"Privacy and data-protection controls for AI","kind":"process","purpose":"Ensures that personal data used to train, tune or run an AI system is processed on a documented lawful basis, with the assessments, notices, security and individual rights that data-protection law requires.","owner_role":"Data protection officer","frequency":"per_system","risk_subdomains":["2.1","1.1","4.1"],"evidence_types":["data_protection_assessment","register_entry","disclosure_notice","audit_report"],"framework_references":["iso_42001: Annex A.7.2, A.7.3; Clause 6.1.4","nist_ai_rmf: MEASURE 2.10; MAP 4.1; GOVERN 1.1","iso_27001: Annex A 5.34 Privacy and protection of PII","owasp_llm_top10: LLM02 Sensitive Information Disclosure"],"obligations":["eu-ai-act-art-26-9-dpia-using-provider-information","singapore-pdpc-ai-notification","eu-ai-act-art-50-3-emotion-recognition-notice","singapore-pdpc-consent-or-exception-for-ai-data","eu-ai-act-fundamental-rights-impact-assessment","us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition","india-dpdp-consent-and-notice","india-dpdp-security-and-breach-notification","india-dpdp-significant-data-fiduciary-duties","nepal-privacy-act-consent-and-purpose","uae-pdpl-impact-assessment-new-technologies","uk-ico-dpia-for-ai","us-new-york-city-local-law-144-data-policy-disclosure"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai","context_url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai.md"}
{"slug":"prohibited-use-screening-gate","title":"Prohibited and unacceptable-use screening gate","kind":"process","purpose":"Stops the organisation from building, buying or operating an AI use that the law bans or that its own policy rules out, by checking every proposed and existing use against a maintained list.","owner_role":"AI governance lead","frequency":"per_system","risk_subdomains":["4.1","5.2","1.1","6.5"],"evidence_types":["approval_record","procedure"],"framework_references":["iso_42001: Clause 6.1.4; Annex A.5.2, A.9.3","nist_ai_rmf: GOVERN 1.1; MAP 1.1"],"obligations":["us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition","us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition","eu-ai-act-art-50-3-emotion-recognition-notice","eu-ai-act-prohibited-practices","us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition","us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition","us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/prohibited-use-screening-gate","context_url":"https://aipolicytracker.org/controls/prohibited-use-screening-gate.md"}
{"slug":"public-sector-ai-use-case-register","title":"Public-sector AI use-case register and algorithmic transparency","kind":"process","purpose":"Lets a public body account for the AI it uses by keeping an inventory of use cases, flagging those that affect rights or services, and publishing what the public and oversight bodies are entitled to see.","owner_role":"Agency AI officer","frequency":"annual","risk_subdomains":["6.5","7.4","5.2"],"evidence_types":["register_entry","disclosure_notice","approval_record"],"framework_references":["nist_ai_rmf: MAP 1.1, 1.5; GOVERN 1.6, 5.1","iso_42001: Clause 4.1; Annex A.8.5","oecd_ai_principles: Principle 1.3 Transparency and explainability"],"obligations":["eu-ai-act-art-26-8-public-authority-registration-before-use","us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition","us-eo-14179-agency-review-of-prior-actions","us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure","us-omb-m-25-21-use-case-inventory","nepal-ai-policy-responsible-ai-principles"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/public-sector-ai-use-case-register","context_url":"https://aipolicytracker.org/controls/public-sector-ai-use-case-register.md"}
{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","purpose":"Captures what an AI system did, when and with what inputs, and keeps those records long enough to reconstruct a decision, investigate an incident and demonstrate ongoing monitoring.","owner_role":"Engineering lead","frequency":"continuous","risk_subdomains":["7.4","6.5","2.2"],"evidence_types":["access_log","procedure","audit_report"],"framework_references":["iso_42001: Annex A.6.2.8","iso_27001: Annex A 8.15 Logging, 8.16 Monitoring activities","nist_ai_rmf: MEASURE 2.4; MANAGE 4.1","mitre_atlas: AML.M0024 AI Telemetry Logging"],"obligations":["eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","eu-ai-act-post-market-monitoring","eu-ai-act-serious-incident-reporting","eu-ai-act-art-18-documentation-keeping","eu-ai-act-art-19-provider-log-retention","eu-ai-act-art-21-cooperation-with-authorities","eu-ai-act-record-keeping","eu-ai-act-art-86-right-to-explanation","us-colorado-admt-record-keeping"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/record-keeping-and-logging","context_url":"https://aipolicytracker.org/controls/record-keeping-and-logging.md"}
{"slug":"synthetic-content-labelling-and-provenance","title":"Synthetic content labelling and provenance marking","kind":"technical","purpose":"Makes AI-generated or manipulated audio, image, video and text identifiable as such, both to people looking at it and to software checking it, so that it cannot easily be passed off as authentic.","owner_role":"Engineering lead","frequency":"continuous","risk_subdomains":["3.1","3.2","4.1","4.3"],"evidence_types":["procedure","evaluation_report","disclosure_notice"],"framework_references":["iso_42001: Annex A.8.2, A.9.3","nist_ai_rmf: MEASURE 2.8; MANAGE 4.1","owasp_llm_top10: LLM09 Misinformation"],"obligations":["south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice","eu-ai-act-art-50-2-synthetic-content-marking","eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","singapore-mgf-genai-incident-reporting-and-provenance","eu-ai-act-transparency-article-50"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/synthetic-content-labelling-and-provenance","context_url":"https://aipolicytracker.org/controls/synthetic-content-labelling-and-provenance.md"}
{"slug":"technical-documentation-and-model-cards","title":"Technical documentation, model cards and instructions for use","kind":"process","purpose":"Produces and maintains the documentation that lets a regulator, a customer or a deployer understand what a system is, how it was built and tested, what it is for and how to use it safely.","owner_role":"Product or model owner","frequency":"on_material_change","risk_subdomains":["7.4","5.1","7.3"],"evidence_types":["technical_file","model_documentation","disclosure_notice"],"framework_references":["iso_42001: Clause 7.5; Annex A.6.2.3, A.6.2.7, A.8.2","nist_ai_rmf: GOVERN 1.4; MAP 2.2; MEASURE 2.8"],"obligations":["eu-ai-act-art-53-gpai-technical-and-downstream-documentation","eu-ai-act-art-54-gpai-authorised-representative","eu-ai-act-gpai-provider-obligations","eu-ai-act-art-18-documentation-keeping","eu-ai-act-art-21-cooperation-with-authorities","eu-ai-act-technical-documentation","eu-ai-act-transparency-to-deployers","eu-ai-act-conformity-assessment-registration","south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures","south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","uk-principles-transparency-explainability","us-california-sb-53-transparency-report","us-colorado-developer-documentation-and-disclosure","us-colorado-admt-developer-documentation"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards","context_url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards.md"}
{"slug":"third-party-ai-due-diligence","title":"Vendor and third-party AI due diligence","kind":"process","purpose":"Checks, before an external model, dataset, component or AI service is adopted or resold, that the supplier has met its own duties and that the organisation understands what it is taking on.","owner_role":"Procurement or vendor risk lead","frequency":"per_system","risk_subdomains":["6.5","2.2","7.3"],"evidence_types":["supplier_assessment","register_entry","approval_record"],"framework_references":["iso_42001: Annex A.10.2, A.10.3","nist_ai_rmf: GOVERN 6.1, 6.2; MAP 4.1, 4.2; MANAGE 3.1","iso_27001: Annex A 5.19 to 5.22 Supplier relationships","owasp_llm_top10: LLM03 Supply Chain"],"obligations":["eu-ai-act-art-25-4-written-agreements-with-component-suppliers","eu-ai-act-art-26-8-public-authority-registration-before-use","us-nist-ai-rmf-govern","eu-ai-act-importer-distributor-obligations","us-nist-ai-rmf-manage","us-new-york-city-local-law-144-bias-audit"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence","context_url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence.md"}
{"slug":"training-data-provenance-and-copyright-register","title":"Training-data provenance and copyright register","kind":"process","purpose":"Records the origin, licence and rights status of every source used to train or fine-tune a model so that the organisation can honour opt-outs, answer downstream questions and publish a truthful summary of training content.","owner_role":"Model development lead","frequency":"on_material_change","risk_subdomains":["6.3","2.1","6.5"],"evidence_types":["register_entry","policy_document","disclosure_notice"],"framework_references":["iso_42001: Annex A.7.3, A.7.5","nist_ai_rmf: MAP 4.1; GOVERN 6.1","mitre_atlas: AML.M0025 Maintain AI Dataset Provenance"],"obligations":["eu-ai-act-data-governance","eu-ai-act-gpai-provider-obligations","us-colorado-developer-documentation-and-disclosure","nepal-privacy-act-consent-and-purpose"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","url":"https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register","context_url":"https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register.md"}