Area 7.4

Monitor Compliance Continuously

Are we still compliant this month, or only as of last year’s review?

Enhanced: 1 1 controls

Who it applies to

Enter for every AI system whose letter is E or A (this area has no Baseline controls). Go as deep as your system letter, and implement in your mode.

Why it exists

Track your compliance with the rules that govern your AI as a live state, not an annual snapshot — because both the rules and your systems change faster than a yearly review can follow. A model updated by its provider, a new use quietly added, a new regulation entering force: any of these can move you out of compliance between reviews, and an annual certification will certify the state you were in, not the state you are in. Watch the gap continuously, and feed it to the governance reporting.

What to actually do

Track applicable obligations against current reality, continuously. Maintain a live view of what rules apply to each system and whether it currently meets them, updated as systems and rules change, feeding the continuous regulatory indicator in the Governance reporting dimension.

Controls

Enhanced 1 controls

Control 208

Monitor compliance against applicable obligations continuously.

EnhancedDetectiveall rolesper system

What it is

A live state feeding governance reporting, not an annual snapshot.

How to implement it · Minimum content

Per system: the obligations that apply, from law, contracts and internal policy
Status per obligation: met, partly met or not met, with an evidence link and date checked
Change triggers: model or provider update, new use, new rule in force; each reopens the affected rows
Owner and remediation date for every gap
Summary sent to governance reporting at a fixed cadence, e.g. monthly

How to start

Build the list of obligations for this system with its current status, and set the triggers that force an update.

Evidence

The live compliance view, its update history and the summaries sent to governance reporting.

Mode: light / standard / full

light: A spreadsheet per system kept by a named person, updated on each change and reviewed quarterly.
standard: A compliance register kept by the compliance lead, with change triggers linked to the change process.
full: A compliance management function with automated triggers from the inventory and change process, feeding the governance indicator.

Evidence

The live compliance view; its update history against system and rule changes; the feed into governance reporting.