Skip to main content
Version: 1.63

Governance quickstart

This article guides you through the control frameworks that form the basis of the AI governance workflow.

tip

Before starting with this quickstart, read and understand the concepts explained in the Introduction. For private cloud customers, create a workspace before starting this quickstart. Creating and applying control frameworks requires organization admin permissions; assigning risk classifications and completing controls requires use case owner permissions.

The quickstart covers everything a governance user needs, from applying a ready-made framework to a Workspace to tailoring your own controls:

  • Beginner: apply a default control framework to a Workspace, create a use case, assign a risk classification and role, and fulfill controls with evidence.
  • Advanced: create your own controls and combine them into a custom control framework.

Beginner: apply and use a control framework​

1. Explore a standard control framework​

  1. Navigate to your Organization's Control frameworks page.
  2. Explore one of the default frameworks, for example the Deeploy AI Control Framework, by clicking its tile and selecting a specific control. For more information about control frameworks, see Control frameworks.
  3. Understand key concepts:
    • Risk level: Set at the use case level and assessed through a risk classification assessment, they follow the risk level as defined in the EU AI act
    • Lifecycle stage: Determines when a control applies along the use case lifecycle
    • Checks: Automated validation checks that detect when evidence is available for a control

2. Assign a control framework to a Workspace​

  1. Navigate to the Workspace you want to govern.
  2. Select the default (or custom) control framework you want to use and add it to the Workspace. A Workspace can have multiple control frameworks applied at the same time.

3. Create a use case and classify its risk​

  1. Navigate to the Workspace where you assigned the control framework and select Use case from the left menu. Click Add to assign a name and risk classification. You can assign the risk classification now or later using a risk classification assessment.
  2. If you didn't assign a risk classification during use case creation, perform the risk classification assessment.
  3. Optionally assign a role (Provider, Deployer, or both) based on your organization's responsibilities under the EU AI Act this determines which EU AI Act controls apply to the use case and is required for the EU AI act default framework.
  4. After you assign a risk classification, the applicable controls from the control framework assigned to the Workspace appear in the use case overview.
tip

Use cases move through five lifecycle stages: Exploration, Development, Validation, Production, and Retirement. Only use case owners can change stages, and stages generally progress one step at a time, see lifecycle stage progression for the full rules.

4. Fulfill controls with evidence​

  1. Click on a control to explore what evidence you need to fulfill that control. Add sample evidence in the form of links, images, and text. If the control contains automated checks, these appear automatically and display a checkmark when Deeploy detects evidence that the check is complete. You don't need to add manual evidence for these automated checks.
  2. Once you've added the required evidence, mark the control as completed. Only completed controls count towards the use case's framework completion.

Optionally, add a documentation template to your use case and use Deeploy's AI-generated answer suggestions to help complete it faster.

Advanced: build your own control framework and controls​

Default frameworks cover common regulations and standards, but you can also translate your own organizational policies into controls and combine them into a custom framework.

1. Create a custom control​

  1. Navigate to Controls in the top right corner of the Control frameworks page and click Create.
  2. Customize the ID, name, category, description, risk classification, lifecycle stage, and checks for your control.

2. Create a custom control framework​

  1. Navigate to the control frameworks overview and click Create.
  2. Enter a unique name and description for your framework.
  3. Select the controls you want to include — you can mix your own custom controls with existing ones from default frameworks.
  4. Click Save changes, then assign the framework to a Workspace as described in step 2.

See Control frameworks for how to update a control framework, or deactivate one for a specific use case.

Next steps​

You've now seen the main elements of control frameworks in Deeploy, from applying a default framework to building your own. The next step is to streamline these controls into practical, organization-wide governance workflows, and to keep an eye on compliance across all your AI systems:

  • Approval rules: require sign-off before deploying AI systems.
  • Periodic reviews: keep controls up to date on a recurring schedule.
  • Audit logs: audit events for compliance and security purposes.
  • Organization documents and vendors: manage supporting documentation and third-party AI vendors.
  • The organization-level Governance dashboard, AI registry, and Use case registry give you an overview of compliance status across all Workspaces.

See the Tech quickstart's Advanced part for implementing safeguards like guardrails and tracing, as they can satisfy automated checks on your controls.