Who owns AI security as a program, and what happens when it is ignored?
Baseline: 1Enhanced: 5Advanced: 17 controls
Who it applies to
Enter once, for the organisation as a whole. Go as deep as your organisation letter, and implement in your mode.
Why it exists
Give AI security an owner, a budget, and consequences — or accept that it will be practised only in the weeks after each incident. The technical work of securing AI — the hardening, the testing, the runtime defences — is specified in the Technical Security domain; what this dimension mandates is the standing program that guarantees the work happens: that the people who build AI are trained to attack it, that deployed systems are exercised against real adversaries on a schedule, that a rehearsed way out exists when a model must be pulled, and that bypassing any of it carries a price. A security practice with no program behind it is a collection of good intentions with a decay rate.
What to actually do
Train the people who build AI to attack it — not only the people who use it. Give your engineers and data specialists role-specific training in how AI systems are actually attacked: instructions hidden in the content a system reads, the poisoning of the data it learns from or consults, the extraction of the model or its training data, and the abuse of whatever powers an autonomous system has been given. They are the only people positioned to design these attacks out before launch, and they cannot design out what they have never seen. (The general awareness training for everyone else lives in the Competence dimension; this is the builder tier, and it is deeper.)
Exercise deployed AI against real adversaries, on a schedule, and treat the findings as governance items. Commission recurring exercises in which skilled attackers attempt, with permission, to break your deployed AI — to manipulate it, extract from it, or abuse its powers. Run them on a fixed cadence, not as a one-off proof point, because the attacks evolve continuously and last year’s clean result certifies last year. Route every finding into the risk process and to the go-live gate: an exercise whose findings do not change decisions was theatre. The technical conduct of these exercises is specified in the Technical Security domain; here, mandate their existence, their schedule, and their consequence.
Build the AI incident team before the first AI incident. When an AI system fails or is attacked, the usual responders are not enough. Define, now, a team that adds: the people who know the data the system was built on and can read anomalous behaviour for what it is; the privacy function, because AI incidents so often involve personal data and the duties that follow; and a named person accountable for the ethical dimension — the impact on the people affected — which in AI incidents is frequently the largest dimension. A team defined during the incident is a team improvising.
Decide, in advance, how you would pull an AI out of a process without stopping the business. For every process that depends on AI, answer two questions before you need them: how do we remove the AI — quickly, cleanly, completely — and what does the process fall back to while it is gone? A manual path, a previous system, a degraded but functioning mode. A kill switch that stops the model and the business with it is not a control anyone will dare to use; design the disengagement so it can actually be pulled, and rehearse the fallback so you know it holds. (The technical switch itself is built under Technical Security; the continuity decision — what the business does next — is governed here.)
Attach consequences to bypassing the governance. Define, and communicate, what follows when someone deploys AI outside the register, disables a safety check, or skips a go-live gate: the same escalation and disciplinary path that applies to any other serious control violation. This is not appetite for punishment; it is the recognition that a rule with no consequence is a suggestion, and that AI adoption moves too fast to be governed by suggestions. Enforcement applied once, visibly and fairly, does more for compliance than any volume of policy.
Keep a standing watch on decay. Models degrade as the world they were trained on drifts away from them, and safety checks rot as usage and attacks evolve around them. Mandate that both are monitored continuously — quality, accuracy, robustness, and the health of the automated checks — and that the results reach this program’s owner on a fixed cycle. The telemetry itself is operated under Technical Security and the Monitoring domain; what is owned here is the guarantee that someone is watching, and the authority to act when the watch reports decay.
Controls
Baseline1 controls
Control 73
Define and communicate the consequences of bypassing AI governance.
BaselinePreventiveall rolesthe whole organisation
What it is
Unregistered deployment, disabled safety checks, and skipped gates each carry a stated, enforced consequence.
How to implement it · Minimum structure
Violations: deploying AI outside the register, disabling a safety check, skipping a go-live gate
Consequence: the same escalation and disciplinary path as other serious control violations, graded by intent and harm
Distinction: declaring a tool through the registration channel carries no blame; concealment does
Who decides, and how each case is recorded
Communicated in the AI policy, the baseline training and onboarding
How to start
Add a consequences section to the AI policy that refers to your existing disciplinary procedure, and announce it to all staff.
Evidence
The policy section, the record of its communication, and the record of each case handled.
Mode: light / standard / full
light
The owner-manager adds a short paragraph to the policy and explains it at a staff meeting.
standard
HR and the AI lead align the section with the disciplinary procedure and handle cases together.
full
HR, legal and the governance function apply it consistently, with cases reported in aggregate to the committee.
Enhanced5 controls
Control 74
Establish the AI security program with a named owner and a budget.
EnhancedPreventiveall rolesthe whole organisation
What it is
A standing program, not a project; its owner reports into the governance bodies.
How to implement it · Minimum structure
Named owner with authority to act, reporting to the governance bodies on a fixed cycle
Annual budget covering people, exercises, training and tooling
Yearly plan with milestones and the indicators reported upward
Standing status: not tied to a project; charter reviewed each year
How to start
Write a one-page charter naming the owner, scope and first-year budget, and have the committee approve it.
Evidence
The approved charter, the budget line and the owner's reports to the governance bodies.
Mode: light / standard / full
light
A named person holds the role part-time with a small budget, much of it for commissioned services.
standard
The security lead owns the program with a dedicated budget line and reports to the committee.
full
A dedicated AI security function with its own team and budget reports to the committee and the risk function.
Control 75
Deliver attack-focused training to everyone who builds or adapts AI.
EnhancedPreventiveall rolesthe whole organisation
What it is
Completed before build work, refreshed as the attack landscape moves.
How to implement it · Minimum structure
Audience: everyone who builds, adapts or integrates AI, including engineers and data specialists
Hidden instructions in content the system reads
Poisoning of the data the system learns from or consults
Extraction of the model or its training data; abuse of the powers given to an agent
Hands-on exercises against a test system
Completed before build work; refreshed at least annually and when new attack techniques appear
How to start
List everyone who builds or adapts AI and schedule a hands-on session on the four attack types before the next project starts.
Evidence
The list of builders with completion and refresh dates.
Mode: light / standard / full
light
A commissioned specialist runs a half-day workshop for the developers or the integrator.
standard
The security team delivers the course and the engineering lead tracks completion.
full
A curriculum with labs, run by the AI security function, is required before access to build environments.
Control 76
Stand up the cross-functional AI incident team in advance.
EnhancedCorrectiveall rolesthe whole organisation
What it is
Defined membership including data, privacy, and ethics accountability; contact paths tested.
How to implement it · Minimum structure
Core responders from the existing incident process, plus the owner of the affected system
A data or model specialist who can read anomalous behaviour for what it is
The privacy function or data-protection contact
A named person accountable for the ethical dimension: impact on the people affected
Legal and communications; each member with a deputy and defined decision rights
Contact paths tested at least twice a year; one tabletop exercise a year
How to start
Name the members and deputies, add them to the incident response plan and test the contact list.
Evidence
The team definition, the contact list and the test records.
Mode: light / standard / full
light
A short list of named people, including the external provider or integrator, with phone numbers tested.
standard
The security incident team adds the AI roles and runs a yearly tabletop exercise.
full
A standing AI incident cell within the response organisation, with on-call rotation and regular exercises.
Control 77
Maintain and rehearse a safe-disengagement policy with a business-continuity fallback, per dependent process.
EnhancedCorrectiveall rolesthe whole organisation
What it is
The fallback is exercised, not assumed.
How to implement it · Minimum structure
Process covered and how it depends on AI
Removal: who decides, steps, target time, what is switched off (model, integrations, agent permissions)
Fallback: manual path, previous system or degraded mode; who operates it and at what capacity
Work in progress and communication: what happens to pending items, who is told
Rehearsal at least annually per process, recording time taken and issues found
How to start
Pick the process most dependent on AI, write its one-page disengagement and fallback plan, and rehearse it.
Evidence
The plan for each dependent process and the rehearsal records.
Mode: light / standard / full
light
The owner-manager writes a one-page plan per process and runs a short drill once a year.
standard
Process owners write the plans with IT and rehearse them within business-continuity testing.
full
The plans are integrated into the business-continuity programme and rehearsed on a schedule with results reported.
Control 78
Oversee drift and safety-check decay on a fixed reporting cycle.
EnhancedDetectiveall rolesthe whole organisation
What it is
Decay findings carry an owner and a deadline, like any other risk.
How to implement it · Minimum rules
Watch quality, accuracy, robustness and the health of automated safety checks for each system
Define per system the thresholds that count as decay
Report to the program owner on a fixed cycle, e.g. monthly
Each decay finding gets an owner and a deadline in the risk register
Escalate overdue findings to the governance bodies
How to start
Agree with each system owner what counts as decay, and set up a monthly report to the program owner.
Evidence
The cycle reports and the decay findings with owners and deadlines.
Mode: light / standard / full
light
The system owner checks a sample of outputs monthly and the provider's quality notices, and reports in a short note.
standard
Owners report monitoring results monthly and the program owner tracks findings.
full
Monitoring data flows automatically into the program dashboard with alerts and risk-register integration.
Advanced1 controls
Control 79
Run the adversarial exercise programme on a governed schedule.
AdvancedDetectiveall rolesthe whole organisation
What it is
Recurring, scoped to deployed systems, with findings routed to risk and to the go-live gate.
How to implement it · Steps
Scope deployed systems and rank them by exposure and criticality
Fix a schedule, e.g. annually for critical systems and before major releases
Agree written rules of engagement: authorisation, scope, limits, timing
Testers attempt manipulation, extraction and abuse of powers
Route every finding to the risk process and the go-live gate, with owner, deadline and retest
How to start
Set a twelve-month exercise schedule, starting with your most exposed deployed system, and commission the first exercise.
Evidence
The schedule, exercise reports, findings and the decisions they changed.
Mode: light / standard / full
light
Commission an external specialist for a scoped exercise on the one exposed system each year.
standard
The security team runs exercises with external support for critical systems.
full
An internal adversarial team runs a continuous programme, supplemented by external testers.
Evidence
The program charter, owner, and budget; builder-training completion records; the incident-team definition and test records; the disengagement policies and fallback rehearsal evidence; enforcement records; the exercise schedule, findings, and the decisions they changed.