Enterprise Controls Framework for the Emerging Technology Governance domain — the optimised set of process controls that give effect to its technical controls.
14 process controls, grouped by sub-policy and shown in full six-level lineage with operational artifacts.
CAO-500 Emerging Technology Governance
CAO-510 AI Policy
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51111 AI management system established to govern the responsible development and use of AI systems.
CAO-511111 · Examine the AI management system to confirm AI governance is established and maintained.
Method: Examine · Expected evidence: AI management system documentation
Operational controls: CAO-5111111 AI Management System — template
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51112 AI system resources identified and documented across the life cycle
CAO-511121 · Examine resource documentation to confirm all AI system resources are identified and current
Method: examine · Expected evidence: AI resource documentation and register
Operational controls: CAO-5111211 AI Resource Register
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51113 Objectives and processes for responsible AI development defined and applied
CAO-511131 · Examine development process records to confirm responsible-AI objectives are applied
Method: examine · Expected evidence: responsible AI development process records
Operational controls: CAO-5111311 Responsible AI Development Procedure — work instruction
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51114 AI system life-cycle documentation maintained from requirements to operation
CAO-511141 · Examine life-cycle documentation to confirm requirements, design and technical records are complete
Method: examine · Expected evidence: AI system life-cycle documentation
Operational controls: CAO-5111411 AI System Technical File — template
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51115 Responsible use of AI systems defined, communicated and enforced
CAO-511151 · Examine use policies and usage records to confirm responsible-use objectives are enforced
Method: examine · Expected evidence: AI acceptable-use policy and usage records
Operational controls: CAO-5111511 AI Acceptable Use Policy — template
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51116 Automatic event logging operated and retained across the AI system lifetime
CAO-511161 · Examine automatically generated logs and their retention against the logging design
Method: examine / test · Expected evidence: AI event logs; retention records
Operational controls: CAO-5111611 AI Event Log Register
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5112 Meet general-purpose AI model provider obligations › CAO-51121 GPAI model documentation, downstream information and copyright measures maintained
CAO-511211 · Examine GPAI model documentation, downstream information packs and copyright policy
Method: examine · Expected evidence: model documentation; downstream information; copyright policy
Operational controls: CAO-5112111 GPAI Model Documentation Register
CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-512 Human Oversight › CAO-5121 Ensure human oversight of AI › CAO-51211 Human oversight designed into AI systems so that decisions can be reviewed and overridden.
CAO-512111 · Examine AI system design to confirm human oversight mechanisms are in place.
Method: Examine · Expected evidence: Human oversight design records
Operational controls: CAO-5121111 Human Oversight Design Record
CAO-520 AI Risk Management Policy
CAO-500 Emerging Technology Governance › CAO-520 AI Risk Management Policy › CAO-521 AI Risk and Impact › CAO-5211 Manage AI risk and impact › CAO-52111 AI risks and impacts assessed and managed across the AI lifecycle.
CAO-521111 · Examine AI impact and risk assessments to confirm risks are assessed and managed.
Method: Examine · Expected evidence: AI impact and risk assessments
Operational controls: CAO-5211111 AI Impact Assessment Template
CAO-500 Emerging Technology Governance › CAO-520 AI Risk Management Policy › CAO-521 AI Risk and Impact › CAO-5211 Manage AI risk and impact › CAO-52112 AI systems verified and validated against defined criteria before deployment
CAO-521121 · Examine verification and validation results to confirm release criteria were met before deployment
Method: examine · Expected evidence: verification and validation results
Operational controls: CAO-5211211 AI Verification and Validation Report — template
CAO-500 Emerging Technology Governance › CAO-520 AI Risk Management Policy › CAO-521 AI Risk and Impact › CAO-5211 Manage AI risk and impact › CAO-52113 Post-market monitoring operated with serious-incident reporting
CAO-521131 · Examine the post-market monitoring plan, collected data and incident reports
Method: examine · Expected evidence: post-market monitoring plan; incident reports
Operational controls: CAO-5211311 Post-Market Monitoring Plan – template
CAO-530 AI Transparency and Explainability Policy
CAO-500 Emerging Technology Governance › CAO-530 AI Transparency and Explainability Policy › CAO-531 AI Transparency › CAO-5311 Ensure AI transparency and explainability › CAO-53111 AI transparency and explainability provided to affected parties.
CAO-531111 · Examine AI documentation and disclosures to confirm transparency and explainability.
Method: Examine · Expected evidence: AI transparency documentation
Operational controls: CAO-5311111 AI Transparency Notice — template
CAO-540 AI Data Governance Policy
CAO-500 Emerging Technology Governance › CAO-540 AI Data Governance Policy › CAO-541 AI Data and Fairness › CAO-5411 Address AI bias and ensure fairness in data and outcomes › CAO-54111 AI bias identified and mitigated to ensure fairness in data and outcomes.
CAO-541111 · Examine data governance and bias testing to confirm fairness in data and outcomes.
Method: Examine, test · Expected evidence: Bias testing and data governance records
Operational controls: CAO-5411111 AI Bias and Fairness Test Register
CAO-500 Emerging Technology Governance › CAO-540 AI Data Governance Policy › CAO-541 AI Data and Fairness › CAO-5411 Address AI bias and ensure fairness in data and outcomes › CAO-54112 AI data acquired, prepared and managed for quality and provenance across its life cycle
CAO-541121 · Examine data management records to confirm data quality, provenance and preparation controls operate
Method: examine · Expected evidence: data quality and provenance records
Operational controls: CAO-5411211 AI Data Provenance Register