This requirement exists to govern decisions involving approval, modification, deployment, and risk management of AI systems, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.
Establish and document the process to govern decisions involving approval, modification, deployment, and risk management of AI systems. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context; 1.2 GV.RR: Roles, Responsibilities and Authorities; 1.3 GV.PO: Policy; 1.4 GV.OV: Oversight |
India
Regulation
|
vLatest | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.04 – Define and implement the organizational structures. 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.02 – Define and manage an information security and privacy risk treatment plan. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.RM – Risk Management Strategy | GV.RM-03 – Cybersecurity risk management activities and outcomes are included in enterprise risk management processes GV.RM – Risk Management Strategy | GV.RM-04 – Strategic direction that describes appropriate risk response options is established and communicated |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-1 – INFORMATION SECURITY PROGRAM PLAN, PM-2 – INFORMATION SECURITY PROGRAM LEADERSHIP ROLE |
NIST
Control Catalog
|
vRev. 5 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 22 – Automated individual decision-making, including profiling; Article 25(1) – Data protection by design and by default |
EU
Regulation
|
vCurrent | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC1.3 – Control Environment – COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. |
AICPA
Audit Framework
|
vLatest | View → |