Core message governance should be fast for low-risk AI and rigorous for high-risk AI — and leave a record either way.
VERITRAIL Control turns your AI policy into workflows. Every use case passes intake and triage; the risk tier determines assessment depth and the approver; approvals carry conditions that are checked before go-live; and material changes trigger reassessment. The result is a lifecycle that business teams can navigate and auditors can follow.
Capabilities
- Policy and operating-model kit. Templates for the AI governance policy (AO-01), forum charter (AO-02), RACI (AO-03), risk appetite and tier criteria (AO-04), escalation matrix (AO-06) and prohibited and restricted use list (AO-10).
- Intake and triage (EI-12, GL-01). Standard intake, prohibited-use screening, suggested tier and required assessment modules.
- Risk-tiered approval gates (GL-03). An approval matrix by tier; approvals recorded with conditions and approver identity.
- Go-live readiness (GL-07). Conditions of approval become a checklist that must be verified before launch.
- Change triggers (GL-04). Model, prompt, data, vendor, tool and agent changes route to reassessment when material.
- Exceptions with expiry (GL-10). Residual-risk acceptances with an accountable approver, compensating controls and an expiry date.
- Vendor AI due diligence (GL-11). AI-specific questionnaire and contract clause checklist integrated with intake.
- Recertification and retirement (GL-12, GL-09). Tier-based review calendar; restrict, remediate or retire decisions recorded.
Who it is for
- AI CoE heads who need a single intake-to-production path.
- Risk and compliance leaders who need approvals and exceptions to be consistent and evidenced.
- Engineering leads who want clear, early requirements instead of late-stage surprises.
Outputs
| Output | Evidence for |
|---|---|
| Intake register with status and screening outcome | EI-12, AO-10 |
| Triage decisions with rationale | GL-01 |
| Approval records with conditions and approver | GL-03 |
| Go-live condition verification | GL-07 |
| Change tickets linked to reassessment | GL-04 |
| Exception register with approver, expiry and compensating controls | GL-10 |
| Forum decision log (approve / restrict / stop) | AO-02 |
Example: an approval matrix
| Tier | Assessment | Approver | Conditions typically attached |
|---|---|---|---|
| Prohibited-review | Legal review before further work | Governance forum with Legal | Proceed only on documented legal opinion |
| High | Full assessment and all triggered modules | Governance forum | Human oversight design, adversarial testing, runtime policy in Enforce, monitoring thresholds, 6-month review |
| Medium | Standard assessment | Delegated risk lead | Disclosure, redaction, monitoring, annual review |
| Low | Intake and screening | Business owner | Attestation at review cadence |
This is an illustrative starting point; your forum should set and approve its own matrix in line with risk appetite (AO-04).
VERITRAIL controls cited
- AO-10 Prohibited and restricted AI use policyNIST AI RMF: GOVERN 1.1, MAP 1.1ISO/IEC 42001: A.9.4, A.2.2EU AI Act: Art. 5
- GL-01 Intake triage workflowNIST AI RMF: MAP 1.1, MAP 1.6ISO/IEC 42001: 8.1, A.6.1.3EU AI Act: Art. 9
- GL-03 Risk-tiered approval gatesNIST AI RMF: MANAGE 1.1, GOVERN 1.4ISO/IEC 42001: 8.1, A.6.2.5EU AI Act: Art. 9, Art. 43
- GL-04 Change management and reassessment triggersNIST AI RMF: GOVERN 1.4, MANAGE 2.4ISO/IEC 42001: 6.3, A.6.2.6EU AI Act: Art. 43
- GL-07 Deployment conditions and go-live readinessNIST AI RMF: MANAGE 1.2, MANAGE 2.1ISO/IEC 42001: A.6.2.5EU AI Act: Art. 26
- GL-10 Exceptions and risk acceptanceNIST AI RMF: MANAGE 1.3, MANAGE 1.4ISO/IEC 42001: 6.1.3EU AI Act: Art. 9
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
Example: change triggers that catch what release processes miss
Generative AI systems change in ways traditional change management does not notice. A typical VERITRAIL trigger set (GL-04) includes:
| Change | Default handling |
|---|---|
| New model or model version, including a vendor's silent upgrade | Reassessment of validation and adversarial testing results |
| Edited prompt or system instruction in production | Change ticket with diff; re-run of injection tests for High tier |
| New data source or retrieval index | Data and privacy module re-run |
| New agent tool, scope or operation | Tool manifest update, runtime policy change with human approval |
| Change of intended purpose or user population | Full re-triage; possible tier change, confirmed by a named approver |
VERITRAIL controls cited
- GL-04 Change management and reassessment triggersNIST AI RMF: GOVERN 1.4, MANAGE 2.4ISO/IEC 42001: 6.3, A.6.2.6EU AI Act: Art. 43
- EI-05 Model, prompt and component registryNIST AI RMF: MAP 4.1, GOVERN 1.6ISO/IEC 42001: A.4.4, A.6.2.3EU AI Act: Art. 11
- EI-07 Agent and tool registryNIST AI RMF: GOVERN 1.6, MAP 4.1ISO/IEC 42001: A.4.4, A.6.2.3EU AI Act: Art. 11
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
How it fits
Control consumes inventory records from VERITRAIL Register and assessments from VERITRAIL Assess, hands approved runtime conditions to VERITRAIL Shield, and feeds decision records to VERITRAIL Assurance. The lifecycle pillar and runbooks describe the underlying method.
Limitations
Workflows only produce evidence when teams use them. Control cannot detect AI deployed outside the process — that is why it is paired with shadow-AI reconciliation in Register. Approval quality depends on approvers having the time and information to challenge; VERITRAIL supplies the information, not the judgement.