CSA AICM v1.1: 247 control objectives across 18 domains

247 control objectives across 18 domains, spanning governance, data, model and runtime

By Jorge García Aibar Reviewed 2026-09-19

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-CSA-AICM. Drawn from chapter 08.

Text alternative

Clause: CSA AICM, AICM v1.1.
Duty holder: Not stated.
Applies from: No date, Voluntary.
Artefact: Control catalogue mapped….
Layers: Layer 01, Layer 03, Layer 05.
Evidence record: Evidence record v1.
Record schema: Evidence record.
The same topic in 29 other frameworks; the crosswalk section below links each clause.

Id: AIGE-OBL-CSA-AICM
Instrument: CSA AI Controls Matrix (AICM) v1.1 controls
Clause: AICM v1.1
Applies from: No date Voluntary · v1.1 published 2026-06-22

The artefact that evidences it

Control catalogue mapped to policy-as-code and evals; crosswalk to ISO 42001 / NIST AI RMF.

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-CSA-AICM
Family	Item	Relation
Patterns	AIBOM	Direct
Patterns	Agent Identity & Scoped Credentials	Direct
Patterns	Agent Registry	Direct
Patterns	Continuous Assurance Telemetry	Direct
Patterns	Framework Crosswalk	Direct
Patterns	Kill Switch / Circuit Breaker	Direct
Patterns	Policy Card	Direct
Patterns	Shadow-AI Discovery	Direct
Open controls	AIGE-CTL-ASSURE-012 AI Bill of Materials per Build	Direct
Open controls	AIGE-CTL-ASSURE-005 Live Control Status from the Assurance Store	Direct
Same crosswalk topic	AI Verify 4.3.1, 4.7.1, 4.2.1, 9.1.1, 9.5.2, 11.2.1, 8.1.1, 8.2.1, 1.1.6, 1.7.2, 1.1.1, 9.12.1, 5.5.1, 3.4.1, 9.8.1, 5.10.1, 10.3.1, 10.3.2, 9.4.1, 4.8.1, 4.1.1, 6.1.1, 5.2.1, 5.9.1, 9.5.4, 1.5.1, 1.6.1, 5.11.1, 9.7.1, 5.3.1, 4.5.2, 9.3.1, 7.1.1, 7.2.1, 7.8.1, 8.3.1, 8.3.2, 1.4.1, 2.2.1, 1.1.4, 9.5.3, 5.1.1, 8.4.1, 8.5.1, 4.9.1, 4.9.2, 1.1.3, 5.14.1, 6.5.1, 4.6.1	Core clause
Same crosswalk topic	China AI Labelling Label Art. 4, Label Art. 5	Core clause
Same crosswalk topic	China Algo. Rec. AlgoRec Art. 27, AlgoRec Art. 7, AlgoRec Art. 16, AlgoRec Art. 24, AlgoRec Art. 17, AlgoRec Art. 8, AlgoRec Art. 9, AlgoRec Art. 21	Core clause
Same crosswalk topic	China Deep Synthesis DeepSyn Art. 7, DeepSyn Art. 14, DeepSyn Art. 16, DeepSyn Art. 17, DeepSyn Art. 19, DeepSyn Art. 10, DeepSyn Art. 15, DeepSyn Art. 20	Core clause
Same crosswalk topic	China GenAI Measures GenAI Art. 17, GenAI Art. 9, GenAI Art. 7, GenAI Art. 8, GenAI Art. 11, GenAI Art. 12, GenAI Art. 19, GenAI Art. 10, GenAI Art. 14, GenAI Art. 15, GenAI Art. 4, GenAI Art. 4(2), GenAI Art. 7(3), GenAI Art. 7(2), GenAI Art. 4(3)	Core clause
Same crosswalk topic	CoE Convention CoE Art. 16, CoE Art. 9, CoE Art. 14(2), CoE Art. 15(2), CoE Art. 8, CoE Art. 16(2)(g), CoE Art. 16(4), CoE Art. 10, CoE Art. 11, CoE Art. 13	Core clause
Same crosswalk topic	EU AI Act Art. 9, Art. 3, Art. 17, Art. 4, Art. 87, Art. 27, Art. 10, Art. 10(2)(f)–(g), Art. 4a, Art. 53, Art. 53(1)(c), Art. 5(1)(e), Art. 11, Art. 13, Art. 50, Art. 86, Art. 18, Art. 43, Art. 53(1)(d), Art. 50(2), 50(4), Art. 49, Art. 71, Art. 6, Art. 3(1), Art. 52, Art. 12, Art. 26(6), Art. 26, Art. 19, Art. 14, Art. 14(4)(b), Art. 5, Art. 15, Art. 5(1)(a)–(b), Art. 55, Art. 60, Art. 15(3), Art. 42(3), Art. 72, Art. 73, Art. 26(5), Art. 3(49), Art. 20, Art. 25, Art. 25(4), Art. 22, Art. 23, Art. 24, Art. 54, Art. 59, Art. 13(3)(b)(iv)–(v), Art. 26(2), Art. 95(2)(c), Art. 47, Art. 48, Art. 40, Art. 51, Art. 56, Art. 50(2), Art. 50(4), Art. 3(60), Art. 57, Art. 58, Art. 61, Art. 43(4), Art. 79	Core clause
Same crosswalk topic	G7 Code G7 Action 5, G7 Action 3, G7 Action 1, G7 Action 2, G7 Action 4, G7 Action 11, G7 Action 7	Core clause
Same crosswalk topic	GAO AI Accountability 1.6, 1.2, 1.1, 1.3, 1.5, 2.1, 2.2, 2.4, 2.5, 1.9, 3.5, 1.7, 3.1, 4.3, 3.9, 3.7, 3.2, 4.1, 4.2, 2.6, 2.7, 3.8, 2.8, 1.4, 1.8, 4.4, 4.5	Core clause
Same crosswalk topic	GB/T 45654 GB/T 45654 Corpus security, GB/T 45654 Content labelling, GB/T 45654 Security assessment	Core clause
Same crosswalk topic	GDPR Art. 5(2), Art. 35, Art. 36, Art. 5(1)(c), Art. 25, Art. 9, Arts. 13–14, Art. 30, Art. 22, Art. 32, Arts. 33–34, Art. 28, Arts. 44–46, Art. 5(1)(a), Art. 5, Art. 6, Art. 15(1)(h), Art. 13(2)(f), Art. 22(3), Art. 39(1)(b), Art. 42	Core clause
Same crosswalk topic	GPAI Code Safety C1, Safety C3, Safety C8, Copyright 1.1–1.5, Transparency 1.1, Transparency 1.2, Safety C5, Safety 3.2, Safety C6, Safety C9, Safety 3.5, Safety C7, Copyright 1.1, Copyright 1.2, Copyright 1.3, Copyright 1.4, Copyright 1.5	Core clause
Same crosswalk topic	ISO 23894 23894 6.4, 23894 6.5, 23894 6.6	Core clause
Same crosswalk topic	ISO 42001 6.1.2, 6.1.3, 8.2, 8.3, A.6, 6.1.4, 5.1, 5.2, 5.3, A.2, A.3, 9.3, 7.2, 9.2, 10.1, 8.4, A.5, A.7, A.7.3, A.4, 7.5, A.8, A.6.2.8, A.9, 9.1, 10.2, A.10, A.9.4, A.5.4, A.8.2, 7.3, A.6.2.4, A.6.2.5, A.6.2.6	Core clause
Same crosswalk topic	ISO 42005 42005 5.8, 42005 6.8, 42005 5.12	Core clause
Same crosswalk topic	ISO 42006 ISO/IEC 42006	Core clause
Same crosswalk topic	Korea AI Act Art. 34(1)(1), Art. 36, Art. 35, Art. 31, Art. 34(1)(2), Art. 33, Art. 34(1)(5), Art. 34(1)(4), Art. 32(1), Art. 32	Core clause
Same crosswalk topic	NIST AI RMF MAP 1, MAP 5, MANAGE 1, GOVERN 1.3, MAP 1.5, MANAGE 1.3, MANAGE 1.4, MEASURE 3, MEASURE 2, GOVERN 1, GOVERN 2, GOVERN 4, GOVERN 5, MAP 3, MAP 2, MEASURE 2.10, MEASURE 2.11, MEASURE 2.8, MAP 1.6, MEASURE 2.9, GOVERN 1.6, GOVERN 1.7, MANAGE 4, MANAGE 2.4, MAP 3.5, GOVERN 3.2, MANAGE 2, MEASURE 2.7, MEASURE 2.1, MEASURE 1, MANAGE 4.3, GOVERN 4.3, GOVERN 6, MAP 4, MANAGE 3, MANAGE 3.1, GOVERN 6.2, GOVERN 1.1, GOVERN 3.1, GOVERN 2.2, MAP 3.4, MEASURE 1.3, GOVERN 6.1, MAP 4.1, MEASURE 2.3, MANAGE 4.1	Core clause
Same crosswalk topic	OECD AI Principles OECD 1.5(c), OECD 1.5, OECD 1.3, OECD 1.5(b), OECD 1.2(b), OECD 1.4, OECD 1.2	Core clause
Same crosswalk topic	OWASP Agentic ASI09, ASI05, ASI04, ASI03, ASI02, ASI07, ASI10	Core clause
Same crosswalk topic	OWASP LLM LLM05:2026, LLM01:2026, LLM10:2026, LLM06:2026, LLM04:2026, LLM02:2026, LLM03:2026, LLM07:2026	Core clause
Same crosswalk topic	Singapore Agentic Agentic 2.1, Agentic 2.2.1, Agentic 2.3.3, Agentic 2.2.2, Agentic 2.3.1, Agentic 2.3.2, Agentic 2.1.1, Agentic 2.4, Agentic 2.1.2	Core clause
Same crosswalk topic	Singapore GenAI GenAI 1, GenAI 2, GenAI 3, GenAI 5, GenAI 6, GenAI 4, GenAI 9, GenAI 8, GenAI 7	Core clause
Same crosswalk topic	TC260 Framework 3.0 TC260 2, TC260 Summary table, TC260 5.3.19, TC260 4, TC260 5.3.12, TC260 Appendix 1, TC260 2.2, TC260 2.1.3, TC260 5.1, TC260 App. 2 II.2, TC260 4.4.1, TC260 App. 2 II.6, TC260 5.3.6, TC260 App. 2 II.3, TC260 App. 2 II.5, TC260 3.2.1, TC260 3, TC260 5.3.14, TC260 5.3.7, TC260 5.3.18, TC260 App. 2 II.4, TC260 4.4.4, TC260 5.3	Core clause
Same crosswalk topic	UK ATRS ATRS 2.5.2, ATRS 2.1, ATRS 2.5.1, ATRS 2.4.3, ATRS Tier 1, ATRS 2.2, ATRS 2.3.2, ATRS 2.1.4, ATRS 2.4.2, ATRS 2.3.5, ATRS 2.3.4	Core clause
Same crosswalk topic	UK DUAA UK GDPR Art. 22C, UK GDPR Art. 22B	Core clause
Same crosswalk topic	prEN 18228 prEN 18228	Core clause
Same crosswalk topic	prEN 18229-1 prEN 18229-1	Core clause
Same crosswalk topic	EN 18286 EN 18286	Related clause

Patterns that build it

Policy Card (layer 1)
Agent Registry (layer 2)
AIBOM (layer 2)
Continuous Assurance Telemetry (layer 5)
Kill Switch / Circuit Breaker (layer 4)
Framework Crosswalk (layer 1 and 5)
Agent Identity & Scoped Credentials (layer 4)
Shadow-AI Discovery (layer 2)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-ASSURE-005 Live Control Status from the Assurance Store (Assurance and evidence profile)
AIGE-CTL-ASSURE-012 AI Bill of Materials per Build (Assurance and evidence profile)

Source

Chapter 08, section CSA AICM and STAR for AI, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-csa-aicm.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). CSA AICM v1.1: 247 control objectives across 18 domains (AIGE-OBL-CSA-AICM). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{CSA AICM v1.1: 247 control objectives across 18 domains (AIGE-OBL-CSA-AICM)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm},
  note         = {Version 0.5.0}
}