AI Regulation TrackerControl library
40 controls. One programme.
Build these once and map them many times. Together they satisfy the 309 obligations we have broken down, and 24 of them build on controls an ISO 27001 programme already runs.
Governance9
- SC-AI-001AI governance policy approved by the board or top managementMedium effortISO 27001: Strong25 obligations in 10 policies
- SC-AI-002AI roles, accountability and oversight committeeMedium effortISO 27001: Strong20 obligations in 9 policies
- SC-AI-003AI system inventoryMedium effortISO 27001: Strong21 obligations in 12 policies
- SC-AI-004AI risk classification and use-case tieringLow effortISO 27001: New for AI21 obligations in 11 policies
- SC-AI-005AI risk assessmentMedium effortISO 27001: Strong25 obligations in 10 policies
- SC-AI-006AI impact assessment (people and society)Medium effortISO 27001: Partial9 obligations in 5 policies
- SC-AI-007Third-party and vendor AI due diligenceMedium effortISO 27001: Strong25 obligations in 12 policies
- SC-AI-008AI literacy and staff trainingLow effortISO 27001: Partial13 obligations in 9 policies
- SC-AI-009Regulatory applicability register and horizon scanningLow effortISO 27001: Partial14 obligations in 10 policies
Data4
- SC-AI-010Training and input data governance (provenance, quality)High effortISO 27001: Partial14 obligations in 10 policies
- SC-AI-011Lawful basis and consent for personal data used in AIMedium effortISO 27001: Strong8 obligations in 7 policies
- SC-AI-012Data minimisation and retention for AIMedium effortISO 27001: Strong5 obligations in 5 policies
- SC-AI-013Data bias and representativeness checksMedium effortISO 27001: New for AI9 obligations in 8 policies
Model lifecycle8
- SC-AI-014Model documentation (model cards, system cards)Medium effortISO 27001: New for AI19 obligations in 10 policies
- SC-AI-015Pre-deployment testing and validationHigh effortISO 27001: Strong12 obligations in 9 policies
- SC-AI-016Independent model validationHigh effortISO 27001: Strong18 obligations in 5 policies
- SC-AI-017Fairness and discrimination testing of outputsMedium effortISO 27001: New for AI8 obligations in 7 policies
- SC-AI-018Robustness and adversarial testing (red teaming)High effortISO 27001: Strong8 obligations in 5 policies
- SC-AI-019Change management and approval gatesMedium effortISO 27001: Strong17 obligations in 10 policies
- SC-AI-020Performance monitoring and drift detectionMedium effortISO 27001: Strong21 obligations in 9 policies
- SC-AI-021Model retirement and decommissioningLow effortISO 27001: Strong6 obligations in 4 policies
Transparency4
- SC-AI-022Disclose AI interaction to usersLow effortISO 27001: New for AI11 obligations in 8 policies
- SC-AI-023Label AI-generated and synthetic contentMedium effortISO 27001: New for AI11 obligations in 5 policies
- SC-AI-024Explain AI-assisted decisionsMedium effortISO 27001: New for AI11 obligations in 6 policies
- SC-AI-025Public AI transparency statement and noticesLow effortISO 27001: New for AI21 obligations in 10 policies
Human oversight3
- SC-AI-026Human oversight and overrideMedium effortISO 27001: New for AI19 obligations in 13 policies
- SC-AI-027Right to contest and human review for individualsMedium effortISO 27001: New for AI6 obligations in 5 policies
- SC-AI-028Customer grievance redressal for AIMedium effortISO 27001: New for AI9 obligations in 6 policies
Security and resilience5
- SC-AI-029AI-specific security controls (prompt injection, model abuse)High effortISO 27001: Strong13 obligations in 8 policies
- SC-AI-030Access control for AI systems and agentsMedium effortISO 27001: Strong5 obligations in 2 policies
- SC-AI-031AI incident management and regulator reportingMedium effortISO 27001: Strong19 obligations in 12 policies
- SC-AI-032Logging and record keepingMedium effortISO 27001: Strong22 obligations in 12 policies
- SC-AI-033Business continuity and fallback for AIMedium effortISO 27001: Strong6 obligations in 5 policies
Content and platform3
- SC-AI-034Unlawful and prohibited content safeguardsHigh effortISO 27001: New for AI11 obligations in 4 policies
- SC-AI-035Takedown and response timelinesMedium effortISO 27001: New for AI5 obligations in 2 policies
- SC-AI-036Deepfake and impersonation safeguardsHigh effortISO 27001: New for AI14 obligations in 7 policies
Assurance4
- SC-AI-037Internal audit of AIMedium effortISO 27001: Strong10 obligations in 4 policies
- SC-AI-038Independent bias auditHigh effortISO 27001: New for AI3 obligations in 1 policy
- SC-AI-039Conformity assessment and certification readinessHigh effortISO 27001: Strong6 obligations in 5 policies
- SC-AI-040Board reporting and AI risk metricsLow effortISO 27001: New for AI16 obligations in 8 policies