Control library32 controls
AI policy and risk appetite
Set enterprise rules, prohibited uses, and escalation thresholds.
Accountability and decision rights
Assign accountable executives, control owners, reviewers, and escalation paths.
AI inventory governance
Maintain a complete inventory of models, agents, vendors, uses, owners, and status.
Training and competency
Match training requirements to each role's authority and AI responsibilities.
Business purpose and scope
Document the intended decision, users, affected parties, jurisdictions, and boundaries.
Risk tier assignment
Classify impact using decision consequence, autonomy, data sensitivity, scale, and reversibility.
Prohibited and restricted use screening
Stop or escalate uses that conflict with law, policy, contracts, or risk appetite.
Material change assessment
Define changes that require reclassification, revalidation, or new approval.
Data provenance and rights
Verify permitted collection, acquisition, use, retention, and sharing.
Data quality and representativeness
Assess completeness, accuracy, timeliness, coverage, and material gaps.
Privacy and minimization
Limit personal and sensitive data to what the approved purpose requires.
Fairness and discrimination testing
Test relevant groups, proxies, outcomes, and decision policies for harmful disparities.
Evaluation plan
Define task metrics, counter-metrics, thresholds, datasets, and approval criteria before testing.
Independent validation
Use qualified review independent from primary development for higher-risk systems.
Robustness and misuse testing
Test edge cases, adversarial inputs, out-of-scope behavior, and recovery.
Business outcome validation
Confirm the system improves the intended insurance outcome without unacceptable counter-effects.
Authority boundary
Specify whether the system drafts, recommends, approves, changes records, communicates, or pays.
Human review design
Define qualified review, information presented, time available, and ability to disagree.
Escalation and exception handling
Route uncertainty, conflicts, protected decisions, and unusual cases to qualified staff.
Override and appeal monitoring
Track overrides, disagreements, complaints, appeals, and overturned outcomes.
Identity and least privilege
Give users, models, agents, and services only the access and actions required.
AI security testing
Test prompt injection, data exfiltration, model abuse, unsafe tool calls, and dependency risk.
Secrets and data protection
Protect credentials, prompts, retrieved content, logs, and model inputs and outputs.
Continuity and fail-safe behavior
Define timeouts, limits, fallback modes, manual operation, and recovery from failure.
Production monitoring
Monitor quality, drift, fairness, safety, cost, latency, volume, and business outcomes.
Run logging and traceability
Retain inputs, outputs, versions, retrieval, tool calls, approvals, and consequential actions.
Incident response
Detect, contain, investigate, notify, recover, and learn from AI incidents.
Change release and rollback
Evaluate changes, approve releases, preserve versions, and restore safe service.
Vendor due diligence
Assess provider governance, data use, testing, security, resilience, and subcontractors.
Contractual controls
Set requirements for data, changes, audit, incidents, performance, deletion, and exit.
Third party performance monitoring
Monitor provider changes, incidents, service quality, and unresolved control gaps.
Exit and substitution planning
Preserve data, records, continuity, and control when a provider or model changes.