Turning Regulatory Duties Into Testable Controls
Regulations state obligations in high-level language: “ensure fairness”, “minimise bias”, “maintain human oversight”. Compliance teams must translate these into concrete controls that line 1 can execute and line 3 can verify.
A control is a testable artefact or action. “Fairness is important” is not a control because you cannot test it. “We measure demographic parity across protected groups before deployment and do not deploy unless parity is within 5 percentage points” is a control because you can test whether that measurement occurred and whether the threshold was met.
The EU AI Act Article 5, in force since February 2025, prohibits systems that employ subliminal manipulation to distort behaviour, systems used to determine social credit scores that negatively affect people, and real-time remote biometric identification in public without an exception for law enforcement. These prohibitions are clear: any system using these practices must not exist. Your control is a process that flags any proposed system matching these descriptions and routes it to legal for prohibition decision.
Article 4, in force since February 2025 with national enforcement from August 2026, requires AI literacy among personnel operating AI systems. The control is not abstract literacy but documented training completion. You define minimum training standards, record which employees completed training, and report on completion rates to your board. If someone operates an AI system without documented training, you have identified a control failure.
Higher-risk systems require more detailed controls. A high-risk hiring system needs controls for bias testing (which you can test by sampling hiring records and running statistical tests for disparate impact), controls for human review (which you can test by sampling hiring decisions to verify that a human reviewed and approved the recommendation), and controls for consent (which you can test by sampling job adverts to verify candidates were told AI was used).
Controls should have an owner, a trigger and an artefact. For example: “The HR Manager owns a control that is triggered when a new cohort of job applicants arrives and produces an artefact: a bias test report showing demographic parity for each protected group. Compliance reviews the report and approves posting of offers only if parity is within tolerance.” That control is testable. Compliance can ask for the bias test report and verify it was completed and reviewed.
A control is not equivalent to a policy. A policy states what you will do. A control verifies that you actually do it. Many organisations write excellent AI policies but do not verify adherence. They discover during an audit that the policy requiring human review of automated decisions has no human review in practice. Writing the policy was a control failure because no one checked whether line 1 was following it.
Document your controls in a control register or framework. Link each control to the regulatory obligation it addresses. NIST AI RMF, which is in the public domain, offers a structured approach. It frames governance around governing, mapping, measuring and managing AI risk. You can use NIST’s terminology to map your controls to these four functions and ensure you have coverage across all of them.
When a regulator requests your evidence pack, they will ask which controls address each regulatory obligation. If you cannot draw a clear line from obligation to control to evidence, you will not pass scrutiny. Compliance teams that succeed build this map early and work backward from it to design controls.
Some controls require technology (automated testing, logging systems, monitoring dashboards). Others require human processes (manual review, committee sign-off, interview). The best control frameworks mix both because technology-only controls can be bypassed and human-only controls do not scale. A system that logs all access and also requires sign-off when sensitive records are accessed combines both approaches.
Test your controls regularly. Do not assume because you documented a process that people follow it. Compliance should sample evidence quarterly to verify controls are in place and working. If you discover a control failure, that is not a sign to blame line 1; it is a sign to redesign the control so people can follow it without heroic effort.
NIST AI RMF provides a structured vocabulary for controls. NIST’s Govern function emphasises policy and stakeholder engagement. Map, which is NIST’s second function, requires understanding your AI systems and risks. Measure is about evaluating performance against criteria. Manage is your response to findings. If your control register uses NIST terminology, it becomes easier to explain your approach to regulators who are already familiar with NIST AI RMF, and it helps you assess whether you have balanced coverage across all four functions.