{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"technical","domain":"AI Governance","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-07","description":"Verify and validate each AI system against its requirements and responsible-AI objectives, documenting test plans, acceptance criteria, and results before release approval. Gate deployment on a documented deployment plan and sign-off confirming requirements are met. Route updates, retraining, and other changes through the same assessment and approval process, including impact reassessment where relevant, and retain verification records and deployment and change approvals.","details":{"control_category":"technical","control_type":"preventive","domain":"AI Governance","guidance":[{"propositionId":"NIST-TEVV-01","propositionTitle":"Define evaluation objectives, context, and measurements","source":"nist-ai-tevv-athlon","sourcePages":"NIST AI 200-2 ipd sections 2.1-2.2, pp. 3-6","sourceTitle":"NIST AI 200-2: TEVV-Athlon Framework for Evaluating AI Systems"},{"propositionId":"NIST-TEVV-02","propositionTitle":"Run evaluations and examine results and limitations","source":"nist-ai-tevv-athlon","sourcePages":"NIST AI 200-2 ipd sections 2.3-2.4, pp. 6-7","sourceTitle":"NIST AI 200-2: TEVV-Athlon Framework for Evaluating AI Systems"},{"propositionId":"NIST-TEVV-03","propositionTitle":"Evaluate AI systems in realistic operating settings","source":"nist-ai-tevv-athlon","sourcePages":"NIST AI 200-2 ipd section 4.3.2, pp. 14-15; Appendix C, pp. 25-26","sourceTitle":"NIST AI 200-2: TEVV-Athlon Framework for Evaluating AI Systems"}],"members":[{"control_id":"A.6.2.4","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"A.6.2.5","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"C002","coverage":"full","framework":"aiuc-1","relationship":"superset_of"}],"statement":"Verify and validate each AI system against its requirements and responsible-AI objectives, documenting test plans, acceptance criteria, and results before release approval. Gate deployment on a documented deployment plan and sign-off confirming requirements are met. Route updates, retraining, and other changes through the same assessment and approval process, including impact reassessment where relevant, and retain verification records and deployment and change approvals.","title":"Verify, validate, and control AI deployment and changes","unified_id":"UC-AI-07"},"id":"uc:UC-AI-07","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-07","sourceIds":["aiuc-1","iso-42001","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"UC-AI-07 — Verify, validate, and control AI deployment and changes","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0264512ba8737ae70615870338c1da8f7505e26236b538ad90b44393e73d4c29","properties":{},"sourceDetailPath":"/data/v1/records/wf-r13-431c488e.json","sourceId":"wf:R13","targetDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","targetId":"uc:UC-AI-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:08a77e52e4a5f08c44dd042e1873f0ba3340cd2f51b40b042d3e949552be1ce6","properties":{"rationale":"Pre-release verification/validation against acceptance criteria is the testing control the risk says is insufficient, catching errors before deployment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/risk-ai-inaccurate-unreliable-output-cf10c86e.json","targetId":"risk:ai-inaccurate-unreliable-output","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0f05a5a3a9384e8adae17e08721f3a9853b46069e5d606b687b17f240cfb7cb0","properties":{"control_id":"A.6.2.4","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-6-2-4-7da7f3ec.json","targetId":"ctrl:iso-42001:A.6.2.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:19650f905c3993b1cd7338bbfae4eca34bdc5c6541e2122bffa4222140989069","properties":{"rationale":"Verifying safety requirements before release blocks unsafe systems from shipping.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/risk-ai-safety-harm-to-people-d02cb500.json","targetId":"risk:ai-safety-harm-to-people","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1bb99a7220444665b11dad31e587befeb9ef3f26c3fb61bf4ac73c2b49cf1faa","properties":{"control_id":"C002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c002-6c739dcb.json","targetId":"ctrl:aiuc-1:C002","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2c12bf8d03b269e1c700c3e9904caa3d973b411be70e32343b0787d88075d72c","properties":{"rationale":"Validating against responsible-AI fairness objectives tests for discriminatory behavior before release.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/risk-ai-bias-discrimination-35faf209.json","targetId":"risk:ai-bias-discrimination","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5202eb4f8f32cf3e27ad76b5e446a7db45f6549e4f5a3ff0486d1f05f6d75186","properties":{"control_id":"A.6.2.5","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-6-2-5-fd797576.json","targetId":"ctrl:iso-42001:A.6.2.5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:661647491f39fef0fd11aa18383026be6fe88b51dffd2de668e2b417d5fc0050","properties":{"rationale":"Acceptance testing can exercise robustness/fallback under out-of-distribution inputs before release.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/risk-ai-model-resilience-fallback-gap-85070995.json","targetId":"risk:ai-model-resilience-fallback-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:80401b1fc455d6f7f97f169ba872650376d8c24b213822d2ae08b366462f0f7d","properties":{"control_id":"NIST-TEVV-01","coverage":"guidance","delta":null,"framework":"nist-ai-tevv-athlon","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"NIST AI 200-2 ipd sections 2.1-2.2, pp. 3-6","source_version":"NIST AI 200-2 ipd (Initial Public Draft), August 2026"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-nist-ai-tevv-athlon-nist-tevv-01-72145876.json","targetId":"ctrl:nist-ai-tevv-athlon:NIST-TEVV-01","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:86f7afc22637529e54c1c36fb50b89c63c209149cf07d381452dc221a540df82","properties":{"rationale":"System-level V&V against requirements exercises the integrated pipeline, catching interface mismatches and emergent failures component testing misses.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/risk-ai-emergent-integration-risk-8490271c.json","targetId":"risk:ai-emergent-integration-risk","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:87af6951dc70c16c823f08e7c20f3c1f870238f25fd0d9743e10b9faaebc275c","properties":{"control_id":"NIST-TEVV-03","coverage":"guidance","delta":null,"framework":"nist-ai-tevv-athlon","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"NIST AI 200-2 ipd section 4.3.2, pp. 14-15; Appendix C, pp. 25-26","source_version":"NIST AI 200-2 ipd (Initial Public Draft), August 2026"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-nist-ai-tevv-athlon-nist-tevv-03-37642a3d.json","targetId":"ctrl:nist-ai-tevv-athlon:NIST-TEVV-03","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:91f42bc9024286e881ceea36b6739fd5ea2dae157cd5b2d8d20d4630575eb967","properties":{"rationale":"Routing updates/retraining through reassessment and sign-off prevents the uncontrolled updates the risk names, but does not detect the distribution drift at the risk's core; continuous monitoring (UC-08) is the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/risk-ai-model-drift-monitoring-15329f38.json","targetId":"risk:ai-model-drift-monitoring","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:924fea74a8fdabb427518d398540069bea5ebb0c3b0ae30469dc3b77745a61cb","properties":{"control_id":"NIST-TEVV-02","coverage":"guidance","delta":null,"framework":"nist-ai-tevv-athlon","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"NIST AI 200-2 ipd sections 2.3-2.4, pp. 6-7","source_version":"NIST AI 200-2 ipd (Initial Public Draft), August 2026"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-nist-ai-tevv-athlon-nist-tevv-02-41057f6e.json","targetId":"ctrl:nist-ai-tevv-athlon:NIST-TEVV-02","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:abf0c8d3c60aea4c5c085ed0b1fed7e2f864668d00cf8e826fa0a1d4bda95d3e","properties":{},"sourceDetailPath":"/data/v1/records/wf-d59-b3ddf606.json","sourceId":"wf:D59","targetDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","targetId":"uc:UC-AI-07","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d187bd5b2bc2f570bf989c371c6bc7ede52d168aa9e8ca5d352d22e2186cc974","properties":{},"sourceDetailPath":"/data/v1/records/wf-g1-14bc355c.json","sourceId":"wf:G1","targetDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","targetId":"uc:UC-AI-07","type":"oversees"}],"schemaVersion":1}