This requirement exists to report AI governance status, strategy, risk, compliance, and performance to relevant stakeholders, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.
Establish and document the process to report AI governance status, strategy, risk, compliance, and performance to relevant stakeholders. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.4 – Communication |
ISO
Standard
|
v2022 | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context; 1.2 GV.RR: Roles, Responsibilities and Authorities; 1.3 GV.PO: Policy; 1.4 GV.OV: Oversight |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(4)(f) – Documented policies for patches and updates |
EU
Regulation
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.04 – Define and implement the organizational structures. 4.2 – Align, Plan and Organize (APO) > APO12 – Managed Risk > APO12.04 – Articulate risk. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-2 – INFORMATION SECURITY PROGRAM LEADERSHIP ROLE, PM-6 – MEASURES OF PERFORMANCE |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC1.3 – Control Environment – COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. CC2.2 – Information and Communication – COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. |
AICPA
Audit Framework
|
vLatest | View → |