Stage 4: Design controls and document | ClearPath AI Governance

What this stage is for

Pick controls that match the tier, document what each system is for and where it falls short, and do due diligence on vendors before signing. Documentation is also how you will later prove what you did.

Who is involved

Product owner, Engineering and data science, Procurement, Privacy, Security.

Key outputs: Control plan, model or system card, data documentation, vendor file.

Step-by-step tasks

Tick each task as you complete it. Your ticks stay in this browser tab unless you export your workspace.

Select the control set for each system based on its tier and characteristics.
Write a model or system card: intended use, known limits, evaluation results and who is responsible.
Document data sources, quality checks and the lawful basis for personal data.
Send a due diligence questionnaire to each AI vendor before purchase or renewal.
Add AI-specific terms to supplier contracts: data use and training rights, incident notice, audit rights, change notice and exit.

Region callouts

Shown for the regions in My regions (header). The region pages are never hidden.

For possible high-risk systems, start preparing technical documentation, logging and oversight design well ahead of the 2027 and 2028 dates. European Union page

If you sell to US federal agencies, OMB memoranda on agency AI use and procurement may affect what you must provide. United States page

Sector regulators apply the five UK principles. Document how each is met in your sector. United Kingdom page

Regulated financial entities should review RBI's FREE-AI expectations when designing controls. India page

Tools and templates

Tools

Controls library and tracker: Controls matched to each system's tier.
Vendor due diligence: Ask AI suppliers the right questions.
Model and system card builder: Document a model or system.
Data lineage mapper: Record where data came from.

Templates

AI clauses checklist for data processing agreements: MD, DOCX
AI contract clause checklist: MD, DOCX
Datasheet for a data set: MD, DOCX
Model or system card: MD, DOCX
Vendor questionnaire: XLSX, CSV, DOCX
All templates for every stage

Common mistakes

Accepting a vendor's compliance claim without evidence.
Documentation written once and never versioned.
Controls chosen by habit, not by risk tier.

You're done when…

Each system has a control plan with owners.
Each material system has a card and data record.
Each AI vendor has a due diligence file and contract terms.

Reviewed 3 Oct 2026.

← Stage 3: Assess risk and impact · Stage 5: Test and validate →