This requirement exists to monitor AI risk levels, control effectiveness, and emerging AI risks and report changes to stakeholders, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.
Establish and document the process to monitor AI risk levels, control effectiveness, and emerging AI risks and report changes to stakeholders. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2022 | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.8-III – Technology Risk Assessment Process; §1.8-V – Risk Treatment; §1.8-VI – Continuous Monitoring and review |
India
Guideline
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.5 GV.RM: Risk Management; 2.2 ID.RA: Risk Assessment |
India
Regulation
|
vLatest | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(2) Standard: Risk analysis |
US
Law
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.16 – Monitoring activities |
ISO
Standard
|
v2022 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.3.2 – A targeted risk analysis is performed for each |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO12 – Managed Risk > APO12.05 – Define a risk management action portfolio. 4.2 – Align, Plan and Organize (APO) > APO12 – Managed Risk > APO12.02 – Analyze risk. |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 6.1.1 – Determining risks and opportunities; 6.1.2 – Addressing risks and opportunities |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: DE.CM – Continuous Monitoring | DE.CM-09 – Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT; RA-3 – RISK ASSESSMENT |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Logging and Monitoring – Alerts and Tracking |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. CC7.2 – System Operations – The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. |
AICPA
Audit Framework
|
vLatest | View → |