Controls and obligations
A control mapped once to CPS 230, CPS 234 or FAR shows on every AI system it governs. The second line starts from a library, not a blank page.
Frameworks, obligations and controls#
| Object | What it is | Example |
|---|---|---|
| Framework | A regulation or standard, with its source instrument, regulator, version and effective date | APRA CPS 230 |
| Obligation | A requirement inside a framework, with its source clause | Manage material service providers |
| Control | A specific measure that satisfies one or more obligations | Third-party AI provider due diligence |
| Implementation | How a control is in place for a given system or area, with an owner | Due diligence done for the call notes vendor |
| Policy | A runtime rule derived from a control, enforced before an agent acts | Human approval above a payment threshold |
Ready-mapped library#
81 controls come mapped: APRA CPS 230 (41), CPS 234 (24) and the Financial Accountability Regime (16, insurance key functions). Your own AI policy is recorded the same way. See Frameworks.
Provenance before publication#
A control cannot be published without its issuing authority, instrument, edition, clause, source link and a dated snapshot of the source. Published controls are versioned, never overwritten, and an effective date can never be earlier than the date a version was published.
Implementations and proof#
An implementation records how a control is in place, with an owner. Its status is draft, active, suspended or retired. How far it is proven is a separate scale, the proof level, from declared to effective. See Assurance and evidence.