Which controls apply, where, and whether they are working.
The Control Matrix lists the controls that apply to your AI use and whether each is working, generated from the record. It is part of every Evidence Pack.
Controls are described in policy and rarely tested against what happens.
You cannot tell the board which controls are working, and the auditor will ask.
of employers have an AI policy at all
CIPD, 2026The benefits of Control Matrix.
The people who feel the problem first.
Show control status.
A starting point for testing.
Confidence the controls are real.
Three ways teams use Control Matrix.
See which controls are working and which are not.
Show control status in a single table.
Prioritise the controls that need work.
Works best alongside.
Register, data-flow map, control matrix and exception log, generated from the record.
See Evidence Packs Compliance MappingControls mapped to ISO/IEC 42001, UK GDPR, DUAA, SOC 2, Cyber Essentials.
See Compliance Mapping Exception LogEvery breach, block and override, with who owned it.
See Exception Log All of EvidenceA record of what AI saw, produced and who approved it, with reports against the regulations and your policies. Used with Guard.
See the Evidence modulePrices are indicative ranges, confirmed in writing before you commit. Estimates are replaced by your own figures once your health check runs.
See Control Matrix working on your business.
First findings within 48 hours of the health check · Audit fee credited against year one