Controls

An AI Control is a specific measure — policy, process, technical safeguard, or organizational practice — designed to manage the risks associated with AI systems. Controls bridge the gap between risk identification and risk mitigation.

Each control record captures:

• Control Identity — Auto-generated Control ID, name, description, objective, category, and type (Preventive, Detective, Corrective)
• Risk Classification — Risk tier (Critical, High, Medium, Low), risk domain (Data Privacy, Bias & Fairness, Security, Transparency, etc.), and risk narrative
• Ownership — Control owner, business sponsor, technical reviewer, operator, and escalation contact — all managed via centralized governance designations
• AI Asset Linkage — Direct association to specific AI systems and use cases via the asset bridge
• Testing & Monitoring — Testing frequency, last/next test dates, test results, effectiveness scores, and KCI (Key Control Indicator) metrics
• Compliance Mapping — EU AI Act classification, NIST AI RMF classification, regulatory references, and policy references
• Evidence — Uploaded evidence files (documents, screenshots, test reports) with type classification

Creating a new AI control uses a guided 8-step wizard that ensures all critical information is captured:

1. Control Identity

   Name, description, objective, category, type, and control domain

2. AI Use Case & System

   Link the control to specific AI use cases and systems from your registers

3. Risk Assessment

   Risk tier, risk score (impact × likelihood), business domain, data classification

4. Ownership & Governance

   Assign control owner, business sponsor, technical reviewer, operator, and escalation contact from governance designations

5. Implementation

   Implementation status, automation level, deployment scope, and implementation notes

6. Testing & Monitoring

   Testing frequency, last/next test dates, effectiveness score, and KCI metrics

7. Compliance & Regulatory

   EU AI Act classification, NIST classification, regulatory references, and policy references

8. Review & Submit

   Summary review of all entered data before submission into the workflow

Controls can be created by OrgAdmins, Reviewers, Approvers, and WorkflowAdmins.

Controls follow a rigorous 7-stage workflow from inception to deployment:

Each stage has a designated reviewer (assigned via governance designations), SLA tracking with breach detection, and full audit logging. Stage owners receive branded email notifications when action is required. SLA breaches trigger escalation emails to process owners.

Enterprise tenants can use Aslan AI to draft the most narrative-heavy fields of a new control directly inside the 8-step wizard. A "Draft with Aslan AI" button appears next to the relevant text fields.

• Step 1 — Control Identity: Drafts the Control Description and Control Objective.
• Step 5 — Implementation: Drafts the Implementation Notes as bulleted operational guidance.
• Context-aware: Uses control name, category, type, control domain, linked AI systems and use cases, risk tier, risk domain, and your organization's enabled frameworks (EU AI Act, NIST AI RMF, ISO 42001).
• Editable: All AI drafts populate as editable text — accept, edit, or regenerate.
• Audited: Both AI_CONTROL_DESCRIPTION_GENERATED and AI_CONTROL_DESCRIPTION_ACCEPTED events are written to the organization and platform audit logs.
• Tier enforcement: The button is greyed out for Starter and Professional tenants with a tooltip explaining the upgrade path. The generate-control-description Edge Function additionally validates the caller's tier server-side.

Controls progress through defined lifecycle stages:

• Draft — Under development, not yet submitted
• Active — Implemented and operational
• Under Review — Undergoing periodic effectiveness assessment
• Retired — Decommissioned with documented retirement reason and date

The platform supports re-approval workflows — controls with expiring approvals are flagged and require renewed authorization.

• AI Control Summary Report — Branded PDF with 35 fields covering identity, risk, ownership, and testing
• AI Control Coverage Report — Maps controls to AI systems/use cases to identify coverage gaps
  Professional+
• Control Effectiveness Trend — Tracks effectiveness scores over time
  Professional+
• Testing Compliance Report — Identifies controls with overdue or missing tests
  Professional+
• KCI Performance Dashboard — Visualizes Key Control Indicator metrics
  Professional+
• Full CSV Export — Complete data export aligned with the 35 summary report fields