The minimum controls required to approve AI.
Use this section as a governance baseline. Each control maps to requirements in EU AI Act, NIST AI RMF, and ISO 42001.
Framework alignment
Controls are mapped to these recognized standards — the frameworks regulators and auditors expect.
EU AI Act
European regulation requiring risk classification, transparency, human oversight, and record-keeping for AI systems.
View guidance →NIST AI RMF
US framework with four functions: Govern, Map, Measure, Manage — providing structure for AI risk management.
View standard ↗ISO/IEC 42001
International standard specifying requirements for AI management systems including risk, data, and operational controls.
View standard ↗Core controls
Data classification and zoning
Define green, amber, and red zones. Tie every AI use-case to a zone and deployment model.
Private tenant or on-prem for confidential data
Client and regulated data only in environments with contractual retention, logging, and access controls.
Prompt security and DLP
Redaction, token filtering, and automated blocking before data leaves your network.
Audit logging and evidence
Log prompt, model, output, and reviewer decisions for each AI interaction.
Model risk and change control
Version control and approval before model updates or prompt template changes.
Human acceptance gates
No AI output is production-ready without accountable human signoff.
Best practices
Prompt templates only
Disallow free-form prompting for sensitive workflows. Use approved templates with redaction.
Zero secrets in prompts
Never paste API keys, tokens, certificates, or internal URLs into chat systems.
Proof before trust
Require test results and diff-based code review for every AI-generated change.
Control the tools
Tools must prove file writes and test runs. If a tool is unavailable, treat output as unverified.
Governance checklist
Use this checklist to verify minimum governance requirements are in place.
AI use-case registry with risk rating
EU AI Act Art. 9Vendor risk assessment and contractual data restrictions
NIST RMF Govern 4Retention policy aligned with regulatory requirements
EU AI Act Art. 12Security review for any AI integrations
ISO 42001 A.6Training and usage policy for staff
EU AI Act Art. 4Incident response plan for AI failures
NIST RMF Manage 4Separation of environments (dev/test/prod)
ISO 42001 A.6.2Continuous monitoring of model outputs
EU AI Act Art. 9Need help implementing these controls?
Use the Governance Pack for copy-ready policy templates, or start with the Decision Flow to classify your use-cases.