Establishes the processes for governing, securing, and managing artificial intelligence systems and AI-related risks across the enterprise.
Governs AI-specific risks, including model governance, transparency, fairness, security, and human oversight. It ensures AI is aligned with business goals and managed responsibly.
AI systems introduce unique risks, including algorithmic bias, adversarial attacks, model poisoning, and prompt injection, while regulatory requirements for AI are rapidly evolving.
| Control ID | Control Name | Category & Type | Criticality | Status | Requirements | Action |
|---|---|---|---|---|---|---|
| AIG-001 | AI Governance & Oversight Establishes AI governance including fram... |
Administrative
Detective
|
Critical | Active | 📋 10 Reqs | View → |
| AIG-002 | AI Risk & Impact Management Establishes AI risk management including... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| AIG-003 | AI Asset & Lifecycle Management Establishes AI lifecycle management incl... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| AIG-004 | Responsible AI Management Establishes responsible AI including pri... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| AIG-005 | AI Security & Operational Resilience Establishes AI security including advers... |
Administrative
Corrective
|
Critical | Active | 📋 10 Reqs | View → |
| AIG-006 | AI Performance Monitoring & Continuous Improvement Establishes AI performance monitoring in... |
Operational
Detective
|
High | Active | 📋 10 Reqs | View → |
The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.
| REQUIREMENT ID | REQUIREMENT TITLE & DETAILS | MAPPED CONTROL | TYPICAL OWNER | ACTION |
|---|---|---|---|---|
| AIG-001-R001 | AI Governance Framework The organization shall establish an AI g... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R002 | AI Governance Committee The organization shall establish an AI g... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R003 | AI Policies The organization shall establish AI poli... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R004 | AI Roles & Responsibilities The organization shall clearly define an... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R005 | AI Decision Governance The organization shall establish governa... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R006 | Executive Oversight The organization shall ensure executive... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R007 | AI Compliance The organization shall ensure AI systems... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R008 | AI Reporting The organization shall report on AI gove... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R009 | AI Review The organization shall conduct periodic... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-001-R010 | Continuous Improvement The organization shall establish a conti... | AIG-001 AI Governance & Oversight | AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics | View ↗ |
| AIG-002-R001 | AI Risk Framework The organization shall establish an AI r... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R002 | AI Risk Assessment The organization shall conduct regular r... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R003 | AI Impact Assessment The organization shall conduct impact as... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R004 | AI Risk Treatment The organization shall treat AI risks, i... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R005 | AI Risk Acceptance The organization shall accept AI risks t... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R006 | AI Risk Monitoring The organization shall monitor AI risks... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R007 | AI Risk Reporting The organization shall report on AI risk... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R008 | AI Risk Review The organization shall conduct periodic... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R009 | Regulatory Assessment The organization shall conduct regular a... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-002-R010 | Continuous Improvement The organization shall establish a conti... | AIG-002 AI Risk & Impact Management | AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance | View ↗ |
| AIG-003-R001 | AI Inventory The organization shall maintain a compre... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R002 | AI Asset Classification The organization shall establish a class... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R003 | AI Ownership The organization shall assign explicit o... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R004 | AI Registration The organization shall register AI asset... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R005 | AI Version Management The organization shall manage versions o... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R006 | AI Deployment The organization shall deploy AI models... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R007 | AI Change Management The organization shall manage changes to... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R008 | AI Retirement The organization shall retire AI models... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R009 | Lifecycle Review The organization shall conduct periodic... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-003-R010 | Continuous Improvement The organization shall establish a conti... | AIG-003 AI Asset & Lifecycle Managemen... | AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance | View ↗ |
| AIG-004-R001 | Responsible AI Principles The organization shall define responsibl... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R002 | Transparency The organization shall ensure transparen... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R003 | Explainability The organization shall ensure AI systems... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R004 | Fairness The organization shall ensure fairness i... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R005 | Bias Management The organization shall identify, assess,... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R006 | Human Oversight The organization shall ensure appropriat... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R007 | Ethical AI The organization shall ensure AI systems... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R008 | Accountability The organization shall establish account... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R009 | Responsible AI Review The organization shall conduct periodic... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-004-R010 | Continuous Improvement The organization shall establish a conti... | AIG-004 Responsible AI Management | Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners | View ↗ |
| AIG-005-R001 | AI Security Framework The organization shall establish an AI s... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R002 | Adversarial Attack Protection The organization shall implement protect... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R003 | Prompt Injection Protection The organization shall implement protect... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R004 | Model Poisoning Protection The organization shall implement protect... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R005 | AI Access Security The organization shall implement access... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R006 | AI Monitoring The organization shall monitor AI system... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R007 | AI Incident Response The organization shall respond to AI-rel... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R008 | AI Resilience Testing The organization shall conduct resilienc... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R009 | AI Security Review The organization shall conduct periodic... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-005-R010 | Continuous Improvement The organization shall establish a conti... | AIG-005 AI Security & Operational Resi... | AI Security, Security Operations, AI Engineering, Incident Response, CISO | View ↗ |
| AIG-006-R001 | Performance Metrics The organization shall define and track... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R002 | Drift Detection The organization shall detect performanc... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R003 | Model Validation The organization shall validate AI model... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R004 | Accuracy Monitoring The organization shall monitor AI model... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R005 | Reliability Monitoring The organization shall monitor AI model... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R006 | Business Value Assessment The organization shall assess AI busines... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R007 | Performance Reporting The organization shall report on AI perf... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R008 | Model Optimization The organization shall optimize AI model... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R009 | Periodic Review The organization shall conduct periodic... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| AIG-006-R010 | Continuous Improvement The organization shall establish a conti... | AIG-006 AI Performance Monitoring & Co... | AI Engineering, Model Owners, Data Science, Business Owners, AI Governance | View ↗ |
| Framework Code | Framework Name & Description | Family / Category | Version | Action |
|---|---|---|---|---|
| MAPPED | EU AI Act Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | NIST AI RMF Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | ISO 42001 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | OECD AI Principles Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | IEEE AI Ethics Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| COBIT2019 | COBIT (APO13) COBIT is an enterprise governance and ma... |
COBIT
Governance Framework
|
v2019 | View → |
| MAPPED | G7 AI Principles Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |