Control Tiers

Not every organisation needs all 46 controls on day one. Each control carries a Tier field in the Control Library. This page is generated from those fields, so it cannot drift from them.

• Baseline controls are the ones to have before any AI system, agent or workforce AI use goes into production: know what is running and who owns it, give it identity and least privilege, enforce authority outside the model, keep logs, and be able to respond.
• Advanced controls add depth for higher-risk use cases, regulated sectors, model builders and mature programmes: model and pipeline protection, fairness and rights assessment, supply-chain depth, resilience and assurance evidence.

The split is the author's judgement, not a requirement of any framework. A high-risk use case under the risk tiering can need an Advanced control early (for example, impact assessment for a system that decides on people). The ten controls used in the Builder Track are all Baseline.

Baseline (22 controls)

Advanced (24 controls)