Skip to Content
Controls framework

AI governance controls framework

AlignAI ships with a base control template derived from the NIST AI Risk Management Framework and ISO 42001, rather than requiring you to build a controls library from scratch.

Controls framework — from standard to solution. A base template of NIST AI RMF and ISO 42001 leads to customization with your legal and architecture teams, then to selection by pattern (for example, customer-facing plus generative requires guardrails), and then to controls attached to the solution, human-reviewed before build handoff, with a line beneath that in the same box reading: (see Build Handoff in the developer guide). A note alongside the flow says second-line challenge of a control's effectiveness for a given pattern is supported at the upfront review stage today (voting/council review), and that tracking findings and remediation through to production is in active development. A caption below the flow reads: Which controls apply is driven by the solution's pattern — how it's implemented differs by technology (agentic vs. generative vs. rules-based), while the underlying risk objective stays the same.

  • Base template. The starting point is built from NIST AI RMF and ISO 42001, reflecting established best practice rather than a blank slate.
  • Customization. AlignAI works with your legal and architecture teams to adapt the base template to how your organization actually wants to define and enforce controls.
  • Selection by pattern. Which controls apply to a given use case is driven by its solution pattern and target architecture — a customer-facing generative solution and an internal rules-based automation don’t carry the same control set, even if the underlying risk objective (e.g., preventing unauthorized disclosure) is the same. This keeps the control logic granular enough to say precisely which controls apply to which kind of solution.
  • Human review before build handoff. Selected controls are reviewed and approved by a person before they’re handed to the development team as part of the build handoff (see the developer guide for that mechanism).

Second-line challenge of control effectiveness. Upfront review — including multi-person voting/council review — supports a second-line reviewer challenging whether a control set is adequate for a given use case, even one that otherwise fits an already-approved pattern. Carrying that challenge, and the resulting decision, through to a tracked finding and remediation on the way to production is an area of active development rather than a shipped, general-availability capability today — worth confirming current status directly if downstream findings-tracking is a hard requirement for your rollout timeline.

Last updated on
Audit & activity loggingSOC 2 & certifications