156 Controls That Make AI Governance Auditable

A compliance lead gets the assignment: build an AI governance control library. They're smart, thorough, and methodical. So they create three spreadsheets.

Spreadsheet one maps controls to the EU AI Act. Articles 6 through 15, Article 49, Article 62. Every obligation traced to a control statement, evidence requirement, and responsible party.

Spreadsheet two maps controls to ISO 42001. Clauses 4 through 10, Annex A, Annex B. Same drill. Different numbering, different language, substantial overlap with spreadsheet one.

Spreadsheet three maps controls to NIST AI RMF. Govern, Map, Measure, Manage. Four functions, 19 categories, dozens of subcategories. Again, massive overlap. Again, maintained separately.

Three months later they have three beautiful spreadsheets, a weekly reconciliation meeting to keep them aligned, and the sinking realization that they've built three parallel governance programs for what is fundamentally the same set of obligations. As we argue in AI Governance Beyond the Policy PDF, the gap between documenting controls and operating them is where most programs stall.

There's a better way.

One control set, three frameworks

The Secure Controls Framework (SCF) maintains 1,470+ controls across 80+ frameworks. Within that library, the Artificial & Autonomous Technologies (AAT) domain contains 156 controls specifically designed for AI governance.

Here's what makes these controls useful: they're pre-mapped. Each AAT control traces to the specific articles, clauses, and subcategories it satisfies across the EU AI Act, ISO 42001, and NIST AI RMF. Define the control once. Collect evidence once. Attest once. The mapping does the translation work for each framework.

This isn't a proprietary invention. The SCF is openly maintained and built on NIST IR 8477's Set Theory Relationship Mapping methodology. The crosswalks are based on actual requirement analysis, not loose thematic grouping.

The 156 controls organize into six families: AI system inventory (identification, registration, tracking), risk classification (assessment methodology, scoring, approval workflows), bias assessment (testing, demographic analysis, fairness metrics, remediation), transparency (model documentation, disclosures, explainability), human oversight (override mechanisms, escalation, intervention), and incident reporting (detection, documentation, notification, root cause analysis).

These six families map directly to the core obligation areas where all three frameworks converge.

Control deep dives

Abstract descriptions don't help auditors. Let's look at specific controls, what they require, what evidence satisfies them, and which framework obligations they address.

Control: AI System Registration and Inventory

What it requires: Maintain a register of all AI systems including description, purpose, data sources, deployment context, risk classification, owner, and deployment date. Update when systems change.

Evidence: System register (structured data, not narrative), owner assignment records, change logs, quarterly review records.

You can't govern what you haven't inventoried. An auditor's first question is always: show me your register. If you can't produce it in minutes, every subsequent control assessment is suspect.

Control: AI Risk Classification and Assessment

What it requires: Classify each AI system by risk tier using documented criteria. Apply the EU AI Act four-tier model per Article 6 and Annex III. Document classification rationale and who approved it. Reassess when system characteristics change.

Evidence: Classification decision records with rationale, approval records, assessment methodology, reassessment triggers and records, risk scoring outputs.

Risk classification drives the scope of everything else. Get it wrong, and you're either over-governing low-risk systems (wasting resources) or under-governing high-risk ones (creating regulatory exposure). With the EU AI Act deadline just 15 months away, getting classification right is urgent.

Control: Algorithmic Bias Testing and Mitigation

What it requires: Test AI systems for bias across protected characteristics before deployment and on a recurring schedule. Define fairness metrics. Document methodology, results, identified biases, and mitigation actions.

Evidence: Testing methodology, test results with demographic breakdowns, fairness metric definitions, bias documentation with severity ratings, mitigation action plans, post-mitigation re-testing results.

Saying "our AI systems are fair" in a policy means nothing without test results. The evidence chain must be complete: methodology, results, remediation, re-testing.

Control: Human Oversight and Intervention Mechanisms

What it requires: Mechanisms for authorized humans to understand outputs, override decisions, intervene during operation, and halt the system. Define authority levels. Maintain logs of all oversight actions and interventions.

Evidence: Oversight mechanism documentation, authority matrix, escalation procedures, override/intervention logs with timestamps, training records for oversight personnel.

Human oversight is the regulatory backstop. If your mechanism is "a human reviews the output" but you have no logs proving reviews actually happen, the control isn't operating. It's documented at best.

The crosswalk summary

Here's the full picture of how the six AAT control families map across frameworks:

156 controls total. One assessment cycle. Three frameworks satisfied.

"Can't we just map these ourselves in a spreadsheet?"

Sure. And you can. The SCF mappings are publicly available. A skilled analyst can build the crosswalk in a few weeks.

But the mapping is the easy part.

The hard part is evidence. Specifically, collecting it continuously, tracking its freshness, and linking it to specific controls.

A spreadsheet can record that you completed a bias test on March 15. It can't tell you that evidence is now 47 days old and stale. It can't flag that three high-risk systems haven't had oversight reviews this quarter. It can't calculate control maturity scores across all three frameworks.

And when the auditor arrives, a spreadsheet can't produce the evidence itself. It can only point to wherever the evidence lives, assuming the file hasn't moved.

The operational reality of AI governance isn't mapping controls to framework clauses. It's maintaining evidence freshness across 156 controls for every AI system in your inventory, continuously, with traceability. That's a systems problem, not a spreadsheet problem.

How Kyudo makes this operational

Kyudo deploys inside your Azure tenant. Sovereignty-grade. Six modules, one Compliance Graph.

Controls Hub and STRM. The 156 AAT controls live in the Controls Hub with STRM (per NIST IR 8477) handling the framework crosswalk. Each control maps to its EU AI Act articles, ISO 42001 clauses, and NIST AI RMF subcategories. Controls are scored 0-100 based on evidence completeness, freshness, and assessment outcomes. Scores update automatically as evidence ages.

Evidence Hub for continuous collection. Every artifact carries a cryptographic hash, full lineage, and a confidence score. Freshness thresholds: less than 7 days is fresh, 8-30 is aging, over 30 is stale. When bias testing evidence hits day 31, the control score reflects it immediately.

CMCAE for continuous assessment. One assessment run evaluates a control against all mapped framework obligations simultaneously. No separate cycles for EU AI Act, ISO 42001, and NIST AI RMF. The engine flags controls below maturity thresholds and generates remediation priorities.

Two-Layer Trust. Layer 1 (deterministic) handles scoring, validation, and crosswalk logic. No AI involved. Layer 2 (advisory) handles policy drafting, gap analysis, and recommendations, with confidence scores on every output. Anything below 0.7 gets flagged for human review.

PolicyPilot. Generates AI-specific policy drafts grounded in your control mappings. Every citation traces back to the Controls Hub and the framework articles it satisfies.

The result: one control set, one evidence collection process, one assessment cycle, three frameworks satisfied.

Your Monday morning checklist

Moving from three spreadsheets to one operational program:

Week 1: Consolidate

• Audit your current AI governance control documentation (how many separate lists exist?)
• Map existing controls to the SCF AAT domain to identify coverage and gaps
• Count unique obligations across all three frameworks (expect 60-70% overlap)

Week 2: Evidence audit

• For each control family, identify what evidence currently exists
• Check evidence age (anything older than 30 days needs refreshing)
• Flag controls with no evidence at all, especially those where you can't even define what evidence would look like

Week 3: Operationalize

• Define evidence collection mechanisms for each control family
• Set assessment frequency (quarterly for standard, monthly for high-risk)
• Assign control owners accountable for evidence freshness

Week 4: Validate

• Run a tabletop: pretend an auditor asks for your Article 14 human oversight evidence
• Time how long it takes to produce. If the answer is more than an hour, your program isn't operational yet
• Identify the three weakest control families and prioritize remediation

The organizations running one program across three frameworks will spend a third of the effort. The ones maintaining three spreadsheets will burn analyst time on reconciliation instead of actual governance.

---

Want to see the full 156-control mapping? Download the framework map showing every AAT control mapped to EU AI Act articles, ISO 42001 clauses, and NIST AI RMF subcategories, with evidence requirements for each.