ids.json

{
  "$schema_version": "1.0",
  "description": "Canonical ID registry. Every concept, layer, role, operating model, jurisdiction, moral dimension, requirement, and control has one stable id, a human name, and a URL. IDs are namespaced: srf.layer.*, srf.opmodel.*, srf.role.*, srf.concept.*, srf.data.*, srf.jurisdiction.*, srf.moral.*, srf.vertical.*, srf.control.<vertical>.*, ext.framework.*, ext.requirement.*.",
  "srf_version": "1.0",
  "updated": "2026-09-02",
  "namespaces": {
    "srf.framework": "The framework itself",
    "srf.layer": "One of the five architecture layers L1-L5",
    "srf.opmodel": "One of the four operating models",
    "srf.role": "One of the SRF personas or a declared sector specialization",
    "srf.concept": "A glossary vocabulary concept",
    "srf.data": "A machine-readable data catalog resource under /data/",
    "srf.jurisdiction": "A jurisdiction that issues a regulation or standard",
    "srf.moral": "A moral-orientation dimension (actor, action, outcome)",
    "srf.vertical": "An industry vertical that owns a control schema",
    "srf.control": "A vertical control, srf.control.<vertical>.<control-id>",
    "ext.framework": "An external standard or regulation",
    "ext.requirement": "A concrete requirement inside an external instrument"
  },
  "count": 466,
  "ids": [
    {
      "id": "ext.framework.ai-safe2",
      "name": "AI SAFE² Framework",
      "type": "framework",
      "subtype": null,
      "url": "https://github.com/CyberStrategyInstitute/ai-safe2-framework"
    },
    {
      "id": "ext.framework.australia-ai-ethics-principles",
      "name": "Australia's AI Ethics Principles",
      "type": "framework",
      "subtype": null,
      "url": "https://www.industry.gov.au/publications/australias-ai-ethics-principles"
    },
    {
      "id": "ext.framework.australia-guidance-ai-adoption",
      "name": "Guidance for AI Adoption",
      "type": "framework",
      "subtype": null,
      "url": "https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance"
    },
    {
      "id": "ext.framework.brazil-pl-2338",
      "name": "Brazil AI Bill (PL 2338/2023)",
      "type": "framework",
      "subtype": null,
      "url": "https://www.camara.leg.br/"
    },
    {
      "id": "ext.framework.ca-ab-2013-genai-transparency",
      "name": "California AB 2013: Generative Artificial Intelligence Training Data Transparency",
      "type": "framework",
      "subtype": null,
      "url": "https://leginfo.legislature.ca.gov/"
    },
    {
      "id": "ext.framework.canada-directive-adm",
      "name": "Directive on Automated Decision-Making",
      "type": "framework",
      "subtype": null,
      "url": "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592"
    },
    {
      "id": "ext.framework.china-deep-synthesis-provisions",
      "name": "Provisions on the Administration of Deep Synthesis Internet Information Services",
      "type": "framework",
      "subtype": null,
      "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm"
    },
    {
      "id": "ext.framework.china-genai-interim-measures",
      "name": "Interim Measures for the Management of Generative Artificial Intelligence Services",
      "type": "framework",
      "subtype": null,
      "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm"
    },
    {
      "id": "ext.framework.cis-controls",
      "name": "CIS Critical Security Controls",
      "type": "framework",
      "subtype": null,
      "url": "https://www.cisecurity.org/controls"
    },
    {
      "id": "ext.framework.cmmc-2-0",
      "name": "Cybersecurity Maturity Model Certification 2.0",
      "type": "framework",
      "subtype": null,
      "url": "https://dodcio.defense.gov/CMMC/"
    },
    {
      "id": "ext.framework.co-reg-10-1-1",
      "name": "Colorado Division of Insurance Regulation 10-1-1",
      "type": "framework",
      "subtype": null,
      "url": "https://doi.colorado.gov/"
    },
    {
      "id": "ext.framework.csa-aicm",
      "name": "CSA AI Controls Matrix",
      "type": "framework",
      "subtype": null,
      "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix"
    },
    {
      "id": "ext.framework.dod-cc-srg",
      "name": "DoD Cloud Computing Security Requirements Guide",
      "type": "framework",
      "subtype": null,
      "url": "https://public.cyber.mil/dccs/"
    },
    {
      "id": "ext.framework.dod-rai-strategy",
      "name": "DoD Responsible AI Strategy and Implementation Pathway",
      "type": "framework",
      "subtype": null,
      "url": "https://www.ai.mil/"
    },
    {
      "id": "ext.framework.dodi-5000-89",
      "name": "DoDI 5000.89: Test and Evaluation",
      "type": "framework",
      "subtype": null,
      "url": "https://www.esd.whs.mil/Directives/issuances/dodi/"
    },
    {
      "id": "ext.framework.dodi-5000-90",
      "name": "DoDI 5000.90: Cybersecurity for Acquisition Decision Authorities and Program Managers",
      "type": "framework",
      "subtype": null,
      "url": "https://www.esd.whs.mil/Directives/issuances/dodi/"
    },
    {
      "id": "ext.framework.eu-ai-act",
      "name": "EU Artificial Intelligence Act",
      "type": "framework",
      "subtype": null,
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.framework.eu-dora",
      "name": "Digital Operational Resilience Act (Regulation (EU) 2022/2554)",
      "type": "framework",
      "subtype": null,
      "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
    },
    {
      "id": "ext.framework.eu-machinery-regulation",
      "name": "EU Machinery Regulation (EU) 2023/1230",
      "type": "framework",
      "subtype": null,
      "url": "https://eur-lex.europa.eu/eli/reg/2023/1230/oj"
    },
    {
      "id": "ext.framework.eu-mica",
      "name": "Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114)",
      "type": "framework",
      "subtype": null,
      "url": "https://eur-lex.europa.eu/eli/reg/2023/1114/oj"
    },
    {
      "id": "ext.framework.fda-ai-ml",
      "name": "FDA AI/ML-Based Software as a Medical Device",
      "type": "framework",
      "subtype": null,
      "url": "https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-and-machine-learning-aiml-enabled-medical-devices"
    },
    {
      "id": "ext.framework.fda-pccp",
      "name": "FDA Predetermined Change Control Plans for AI-enabled device software",
      "type": "framework",
      "subtype": null,
      "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence"
    },
    {
      "id": "ext.framework.fda-tplc",
      "name": "FDA Total Product Life Cycle approach for AI-enabled devices",
      "type": "framework",
      "subtype": null,
      "url": "https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-and-machine-learning-aiml-enabled-medical-devices"
    },
    {
      "id": "ext.framework.fedramp-20x-ksi",
      "name": "FedRAMP 20x Key Security Indicators",
      "type": "framework",
      "subtype": null,
      "url": "https://www.fedramp.gov/"
    },
    {
      "id": "ext.framework.finos-aigf",
      "name": "FINOS AI Governance Framework",
      "type": "framework",
      "subtype": null,
      "url": "https://air-governance-framework.finos.org/"
    },
    {
      "id": "ext.framework.finra-reg-notice-24-09",
      "name": "FINRA Regulatory Notice 24-09: Artificial Intelligence in the Securities Industry",
      "type": "framework",
      "subtype": null,
      "url": "https://www.finra.org/rules-guidance/notices/24-09"
    },
    {
      "id": "ext.framework.gao-ai-accountability-framework",
      "name": "GAO-21-519SP — AI Accountability Framework for Federal Agencies and Other Entities",
      "type": "framework",
      "subtype": null,
      "url": "https://www.gao.gov/products/gao-21-519sp"
    },
    {
      "id": "ext.framework.gdpr",
      "name": "General Data Protection Regulation",
      "type": "framework",
      "subtype": null,
      "url": "https://gdpr-info.eu/"
    },
    {
      "id": "ext.framework.hipaa-security-rule",
      "name": "HIPAA Security Rule",
      "type": "framework",
      "subtype": null,
      "url": "https://www.hhs.gov/hipaa/for-professionals/security/"
    },
    {
      "id": "ext.framework.iec-61508",
      "name": "IEC 61508: Functional safety of electrical, electronic and programmable electronic safety-related systems",
      "type": "framework",
      "subtype": null,
      "url": "https://www.iec.ch/"
    },
    {
      "id": "ext.framework.iec-62304",
      "name": "IEC 62304: Medical device software lifecycle processes",
      "type": "framework",
      "subtype": null,
      "url": "https://www.iec.ch/"
    },
    {
      "id": "ext.framework.iec-62443",
      "name": "IEC 62443: Security for industrial automation and control systems",
      "type": "framework",
      "subtype": null,
      "url": "https://www.iec.ch/"
    },
    {
      "id": "ext.framework.india-meity-ai-advisory",
      "name": "MeitY Advisories on AI / Generative AI",
      "type": "framework",
      "subtype": null,
      "url": "https://www.meity.gov.in/"
    },
    {
      "id": "ext.framework.iso-14971",
      "name": "ISO 14971: Application of risk management to medical devices",
      "type": "framework",
      "subtype": null,
      "url": "https://www.iso.org/standard/72704.html"
    },
    {
      "id": "ext.framework.iso-22989",
      "name": "ISO/IEC 22989 — AI Concepts and Terminology",
      "type": "framework",
      "subtype": null,
      "url": "https://www.iso.org/standard/74296.html"
    },
    {
      "id": "ext.framework.iso-42001",
      "name": "ISO/IEC 42001 — AI Management Systems",
      "type": "framework",
      "subtype": null,
      "url": "https://www.iso.org/standard/81230.html"
    },
    {
      "id": "ext.framework.japan-ai-social-principles",
      "name": "Social Principles of Human-Centric AI",
      "type": "framework",
      "subtype": null,
      "url": "https://www.cas.go.jp/jp/seisaku/jinkouchinou/"
    },
    {
      "id": "ext.framework.korea-ai-basic-act",
      "name": "Artificial Intelligence Basic Act (Republic of Korea)",
      "type": "framework",
      "subtype": null,
      "url": "https://www.msit.go.kr/"
    },
    {
      "id": "ext.framework.mas-ai-risk-management-guidelines",
      "name": "MAS Guidelines on Artificial Intelligence Risk Management for Financial Institutions",
      "type": "framework",
      "subtype": null,
      "url": "https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions"
    },
    {
      "id": "ext.framework.mitre-atlas",
      "name": "MITRE ATLAS",
      "type": "framework",
      "subtype": null,
      "url": "https://atlas.mitre.org/"
    },
    {
      "id": "ext.framework.naic-ai-eval-tool",
      "name": "NAIC AI Systems Evaluation Tool",
      "type": "framework",
      "subtype": null,
      "url": "https://content.naic.org/"
    },
    {
      "id": "ext.framework.naic-ai-model-bulletin",
      "name": "NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers",
      "type": "framework",
      "subtype": null,
      "url": "https://content.naic.org/"
    },
    {
      "id": "ext.framework.nist-ai-600-1",
      "name": "NIST AI 600-1 — AI RMF: Generative AI Profile",
      "type": "framework",
      "subtype": null,
      "url": "https://doi.org/10.6028/NIST.AI.600-1"
    },
    {
      "id": "ext.framework.nist-ai-rmf",
      "name": "NIST AI Risk Management Framework",
      "type": "framework",
      "subtype": null,
      "url": "https://www.nist.gov/itl/ai-risk-management-framework"
    },
    {
      "id": "ext.framework.nist-csf-2",
      "name": "NIST Cybersecurity Framework 2.0",
      "type": "framework",
      "subtype": null,
      "url": "https://www.nist.gov/cyberframework"
    },
    {
      "id": "ext.framework.nist-cyber-ai-profile",
      "name": "NIST IR 8596, Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile)",
      "type": "framework",
      "subtype": null,
      "url": "https://csrc.nist.gov/pubs/ir/8596/iprd"
    },
    {
      "id": "ext.framework.nist-sp-800-171",
      "name": "NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems",
      "type": "framework",
      "subtype": null,
      "url": "https://csrc.nist.gov/pubs/sp/800/171/r3/final"
    },
    {
      "id": "ext.framework.nistir-8605a",
      "name": "NISTIR 8605A — Control Overlays for Securing AI Systems: Using and Fine-Tuning Predictive AI",
      "type": "framework",
      "subtype": null,
      "url": "https://csrc.nist.gov/projects/cosais"
    },
    {
      "id": "ext.framework.nydfs-ai-cyber-letter-2024",
      "name": "NYDFS Industry Letter: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks",
      "type": "framework",
      "subtype": null,
      "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks"
    },
    {
      "id": "ext.framework.nydfs-cl-7-2024",
      "name": "NYDFS Circular Letter No. 7 (2024): Use of AI Systems in Insurance Underwriting and Pricing",
      "type": "framework",
      "subtype": null,
      "url": "https://www.dfs.ny.gov/"
    },
    {
      "id": "ext.framework.nydfs-part-500",
      "name": "23 NYCRR Part 500: Cybersecurity Requirements for Financial Services Companies",
      "type": "framework",
      "subtype": null,
      "url": "https://www.dfs.ny.gov/industry_guidance/cybersecurity"
    },
    {
      "id": "ext.framework.occ-comptrollers-handbook-mrm",
      "name": "OCC Comptroller's Handbook: Model Risk Management",
      "type": "framework",
      "subtype": null,
      "url": "https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html"
    },
    {
      "id": "ext.framework.oecd-ai-principles",
      "name": "OECD Recommendation of the Council on Artificial Intelligence",
      "type": "framework",
      "subtype": null,
      "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449"
    },
    {
      "id": "ext.framework.omb-m-25-21",
      "name": "OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust",
      "type": "framework",
      "subtype": null,
      "url": "https://www.whitehouse.gov/omb/information-for-agencies/memoranda/"
    },
    {
      "id": "ext.framework.omb-m-25-22",
      "name": "OMB M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government",
      "type": "framework",
      "subtype": null,
      "url": "https://www.whitehouse.gov/omb/information-for-agencies/memoranda/"
    },
    {
      "id": "ext.framework.onc-hti-1",
      "name": "ONC HTI-1 Final Rule: Decision Support Interventions",
      "type": "framework",
      "subtype": null,
      "url": "https://www.healthit.gov/topic/laws-regulation-and-policy/health-data-technology-and-interoperability-certification-program"
    },
    {
      "id": "ext.framework.owasp-llm-top10",
      "name": "OWASP LLM Top 10",
      "type": "framework",
      "subtype": null,
      "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
    },
    {
      "id": "ext.framework.sec-pda-conflicts",
      "name": "Conflicts of Interest Relating to the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers",
      "type": "framework",
      "subtype": null,
      "url": "https://www.sec.gov/rules-regulations/proposed-rules"
    },
    {
      "id": "ext.framework.singapore-model-ai-governance",
      "name": "Model Artificial Intelligence Governance Framework (Second Edition)",
      "type": "framework",
      "subtype": null,
      "url": "https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework"
    },
    {
      "id": "ext.framework.sr-26-2",
      "name": "SR 26-2 — Revised Guidance on Model Risk Management",
      "type": "framework",
      "subtype": null,
      "url": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf"
    },
    {
      "id": "ext.framework.uk-ai-regulation-white-paper",
      "name": "A pro-innovation approach to AI regulation (UK white paper)",
      "type": "framework",
      "subtype": null,
      "url": "https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach"
    },
    {
      "id": "ext.requirement.australia-ai-ethics-principles.accountability",
      "name": "Accountability: Accountability principle",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-framework/australias-ai-ethics-principles"
    },
    {
      "id": "ext.requirement.australia-ai-ethics-principles.contestability",
      "name": "Contestability: Contestability principle",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-framework/australias-ai-ethics-principles"
    },
    {
      "id": "ext.requirement.canada-directive-adm.aia",
      "name": "Algorithmic Impact Assessment: Algorithmic Impact Assessment requirement",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592"
    },
    {
      "id": "ext.requirement.canada-directive-adm.transparency",
      "name": "Notice and explanations: Transparency and explanation to affected persons",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592"
    },
    {
      "id": "ext.requirement.china-genai-interim-measures.content-labeling",
      "name": "Content labeling: Synthetic content labeling and safety",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.cac.gov.cn/"
    },
    {
      "id": "ext.requirement.china-genai-interim-measures.training-data",
      "name": "Training data and model duties: Lawful training data and security assessment",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.cac.gov.cn/"
    },
    {
      "id": "ext.requirement.cmmc-2-0.access-control",
      "name": "Access Control domain: Access control for CUI environments",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://dodcio.defense.gov/CMMC/"
    },
    {
      "id": "ext.requirement.cmmc-2-0.accountability",
      "name": "Audit and Accountability domain: Audit logging and accountability",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://dodcio.defense.gov/CMMC/"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-10",
      "name": "Article 10: Data and data governance",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-14",
      "name": "Article 14: Human oversight",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-15",
      "name": "Article 15: Accuracy, robustness and cybersecurity",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-26",
      "name": "Article 26: Obligations of deployers of high-risk AI systems",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-5",
      "name": "Article 5: Prohibited AI practices",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-53",
      "name": "Article 53: Obligations of providers of general-purpose AI models",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-6",
      "name": "Article 6: Classification rules for high-risk AI systems",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-72",
      "name": "Article 72: Post-market monitoring by providers",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.eu-ai-act.art-9",
      "name": "Article 9: Risk management system",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    {
      "id": "ext.requirement.gdpr.art-22",
      "name": "Article 22: Automated individual decision-making, including profiling",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "id": "ext.requirement.gdpr.art-35",
      "name": "Article 35: Data protection impact assessment",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "id": "ext.requirement.gdpr.art-5",
      "name": "Article 5: Principles relating to processing of personal data",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "id": "ext.requirement.hipaa-security-rule.164-308",
      "name": "45 CFR 164.308: Administrative safeguards",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C"
    },
    {
      "id": "ext.requirement.hipaa-security-rule.164-312",
      "name": "45 CFR 164.312: Technical safeguards",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C"
    },
    {
      "id": "ext.requirement.korea-ai-basic-act.governance",
      "name": "National AI governance: National AI governance structure",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.msit.go.kr/"
    },
    {
      "id": "ext.requirement.korea-ai-basic-act.transparency",
      "name": "Transparency and safety duties: Transparency and safety obligations",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.msit.go.kr/"
    },
    {
      "id": "ext.requirement.nist-ai-rmf.govern-1-1",
      "name": "GOVERN 1.1: Legal and regulatory requirements incorporated into AI risk policies",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework"
    },
    {
      "id": "ext.requirement.nist-ai-rmf.govern-2-1",
      "name": "GOVERN 2.1: Roles and responsibilities for AI risk management",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework"
    },
    {
      "id": "ext.requirement.nist-ai-rmf.manage-2-4",
      "name": "MANAGE 2.4: Risk treatment responses documented and monitored",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework"
    },
    {
      "id": "ext.requirement.nist-ai-rmf.map-1-5",
      "name": "MAP 1.5: AI system impacts on individuals, groups, and society",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework"
    },
    {
      "id": "ext.requirement.nist-ai-rmf.measure-2-6",
      "name": "MEASURE 2.6: AI system privacy risk measurement",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework"
    },
    {
      "id": "ext.requirement.oecd-ai-principles.1-4",
      "name": "Principle 1.4: Robustness, security and safety",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://oecd.ai/en/dashboards/ai-principles/P7"
    },
    {
      "id": "ext.requirement.oecd-ai-principles.1-5",
      "name": "Principle 1.5: Accountability",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://oecd.ai/en/dashboards/ai-principles/P9"
    },
    {
      "id": "ext.requirement.sec-pda-conflicts.investor-interest",
      "name": "Investor-interest conflicts: Firm vs investor conflicts in PDA/AI tools",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.sec.gov/rules-regulations/proposed-rules"
    },
    {
      "id": "ext.requirement.sr-26-2.section-iii",
      "name": "Section III: Effective challenge",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf"
    },
    {
      "id": "ext.requirement.sr-26-2.section-iv",
      "name": "Section IV: Model development, implementation, and use",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf"
    },
    {
      "id": "ext.requirement.sr-26-2.section-v",
      "name": "Section V: Model validation and ongoing monitoring",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf"
    },
    {
      "id": "ext.requirement.sr-26-2.section-vi",
      "name": "Section VI: Governance, policies, and controls",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf"
    },
    {
      "id": "ext.requirement.sr-26-2.section-vii",
      "name": "Section VII: Vendor and other third-party models",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf"
    },
    {
      "id": "ext.requirement.uk-ai-regulation-white-paper.principles",
      "name": "Five principles: Cross-cutting principles for UK AI regulation",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach"
    },
    {
      "id": "ext.requirement.uk-ai-regulation-white-paper.regulator-led",
      "name": "Regulator-led delivery: Sector regulators deliver AI duties",
      "type": "concept",
      "subtype": "requirement",
      "url": "https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach"
    },
    {
      "id": "srf.concept.accountability",
      "name": "Accountability",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#accountability"
    },
    {
      "id": "srf.concept.accountability-continuity",
      "name": "Accountability Continuity",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#accountability-continuity"
    },
    {
      "id": "srf.concept.accountable-party",
      "name": "Accountable Party",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#accountable-party"
    },
    {
      "id": "srf.concept.agent-replication",
      "name": "Agent Replication",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#agent-replication"
    },
    {
      "id": "srf.concept.agentic-system",
      "name": "Agentic System",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#agentic-system"
    },
    {
      "id": "srf.concept.autonomy-level",
      "name": "Autonomy Level",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#autonomy-level"
    },
    {
      "id": "srf.concept.control",
      "name": "Control",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#control"
    },
    {
      "id": "srf.concept.control-schema",
      "name": "Control Schema",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#control-schema"
    },
    {
      "id": "srf.concept.enforcement-plane",
      "name": "Enforcement Plane",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#enforcement-plane"
    },
    {
      "id": "srf.concept.evidence-threshold",
      "name": "Evidence Threshold",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#evidence-threshold"
    },
    {
      "id": "srf.concept.fail-closed-override",
      "name": "Fail-Closed Override",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#fail-closed-override"
    },
    {
      "id": "srf.concept.human-override-tier",
      "name": "Human Override Tier",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#human-override-tier"
    },
    {
      "id": "srf.concept.layer",
      "name": "Layer",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#layer"
    },
    {
      "id": "srf.concept.ocsf",
      "name": "OCSF",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#ocsf"
    },
    {
      "id": "srf.concept.operating-model",
      "name": "Operating Model",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#operating-model"
    },
    {
      "id": "srf.concept.persistence-scope",
      "name": "Persistence Scope",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#persistence-scope"
    },
    {
      "id": "srf.concept.persona",
      "name": "Persona",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#persona"
    },
    {
      "id": "srf.concept.project-tapestry",
      "name": "Project Tapestry (federated consortium extension)",
      "type": "concept",
      "subtype": "extension-scope",
      "url": "https://aisharedresponsibility.com/tapestry/controls/"
    },
    {
      "id": "srf.concept.protocol-independent-evidence",
      "name": "Protocol-Independent Evidence",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#protocol-independent-evidence"
    },
    {
      "id": "srf.concept.raci",
      "name": "RACI",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#raci"
    },
    {
      "id": "srf.concept.responsibility-cascade",
      "name": "Responsibility Cascade",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#responsibility-cascade"
    },
    {
      "id": "srf.concept.shared-responsibility",
      "name": "Shared Responsibility",
      "type": "concept",
      "subtype": "vocabulary",
      "url": "https://aisharedresponsibility.com/glossary/#shared-responsibility"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-001",
      "name": "SRF-L1-ACQ-001: AI Use Case Registry and CDAO Reporting",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-001"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-002",
      "name": "SRF-L1-ACQ-002: Responsible AI Officer Designation",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-002"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-003",
      "name": "SRF-L1-ACQ-003: AI Governance Board with CDAO Oversight Link",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-003"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-004",
      "name": "SRF-L1-ACQ-004: DoD RAI Compliance Plan (Five-Principle Assessment)",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-004"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-005",
      "name": "SRF-L1-ACQ-005: AI Acquisition Requirements per DoDI 5000.90",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-005"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-006",
      "name": "SRF-L1-ACQ-006: AI Supply Chain Risk Assessment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-006"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-007",
      "name": "SRF-L1-ACQ-007: Operator and Commander AI Training Program",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-007"
    },
    {
      "id": "srf.control.defense.SRF-L1-ACQ-009",
      "name": "SRF-L1-ACQ-009: NSS Boundary Classification Determination",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-ACQ-009"
    },
    {
      "id": "srf.control.defense.SRF-L1-OPS-008",
      "name": "SRF-L1-OPS-008: AI Incident Reporting to CDAO",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-OPS-008"
    },
    {
      "id": "srf.control.defense.SRF-L1-OVR-011",
      "name": "SRF-L1-OVR-011: Human Oversight Escalation Chain Documented and Rehearsed",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-OVR-011"
    },
    {
      "id": "srf.control.defense.SRF-L1-TEVV-010",
      "name": "SRF-L1-TEVV-010: TEVV Plan Existence and Approval Before Operational Deployment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L1-TEVV-010"
    },
    {
      "id": "srf.control.defense.SRF-L2-ACQ-001",
      "name": "SRF-L2-ACQ-001: CUI Classification and Marking on AI Inputs and Outputs",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-ACQ-001"
    },
    {
      "id": "srf.control.defense.SRF-L2-ACQ-003",
      "name": "SRF-L2-ACQ-003: Training Data Authority-to-Use Documentation",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-ACQ-003"
    },
    {
      "id": "srf.control.defense.SRF-L2-ACQ-008",
      "name": "SRF-L2-ACQ-008: Contractor Data Isolation from DoD Data Planes",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-ACQ-008"
    },
    {
      "id": "srf.control.defense.SRF-L2-OPS-002",
      "name": "SRF-L2-OPS-002: IL-Level Data Boundary Enforcement and Tenant Isolation",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-OPS-002"
    },
    {
      "id": "srf.control.defense.SRF-L2-OPS-004",
      "name": "SRF-L2-OPS-004: Data Egress Controls per Classification Level",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-OPS-004"
    },
    {
      "id": "srf.control.defense.SRF-L2-OPS-005",
      "name": "SRF-L2-OPS-005: Adversarial Input Detection (Prompt Injection and Data Poisoning)",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-OPS-005"
    },
    {
      "id": "srf.control.defense.SRF-L2-OPS-006",
      "name": "SRF-L2-OPS-006: Bias and Disparate Impact Monitoring on Consequential Decisions",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-OPS-006"
    },
    {
      "id": "srf.control.defense.SRF-L2-OPS-007",
      "name": "SRF-L2-OPS-007: AI Decision Log Retention per NARA Requirements",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-OPS-007"
    },
    {
      "id": "srf.control.defense.SRF-L2-OVR-010",
      "name": "SRF-L2-OVR-010: AI Decision Log Human Review Cadence for High-Stakes Operations",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-OVR-010"
    },
    {
      "id": "srf.control.defense.SRF-L2-TEVV-009",
      "name": "SRF-L2-TEVV-009: Training and RAG Data Integrity Verification Before Deployment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L2-TEVV-009"
    },
    {
      "id": "srf.control.defense.SRF-L3-ACQ-008",
      "name": "SRF-L3-ACQ-008: Shared Service Inheritance Chain Documentation",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-ACQ-008"
    },
    {
      "id": "srf.control.defense.SRF-L3-OPS-006",
      "name": "SRF-L3-OPS-006: Agentic Task Boundary Enforcement",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-OPS-006"
    },
    {
      "id": "srf.control.defense.SRF-L3-OPS-007",
      "name": "SRF-L3-OPS-007: Prompt Injection Detection at Application Layer",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-OPS-007"
    },
    {
      "id": "srf.control.defense.SRF-L3-OPS-009",
      "name": "SRF-L3-OPS-009: Plain-Language Output Explanation for Operators",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-OPS-009"
    },
    {
      "id": "srf.control.defense.SRF-L3-OVR-003",
      "name": "SRF-L3-OVR-003: Human Oversight Gate for Use-of-Force-Adjacent Decisions",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-OVR-003"
    },
    {
      "id": "srf.control.defense.SRF-L3-OVR-004",
      "name": "SRF-L3-OVR-004: Operator Interface Override Capability",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-OVR-004"
    },
    {
      "id": "srf.control.defense.SRF-L3-OVR-005",
      "name": "SRF-L3-OVR-005: Remedy and Appeal Mechanism for Adverse Administrative Decisions",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-OVR-005"
    },
    {
      "id": "srf.control.defense.SRF-L3-TEVV-001",
      "name": "SRF-L3-TEVV-001: TEVV Plan Execution per DoDI 5000.89",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-TEVV-001"
    },
    {
      "id": "srf.control.defense.SRF-L3-TEVV-002",
      "name": "SRF-L3-TEVV-002: AI Impact Assessment Before Operational Deployment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-TEVV-002"
    },
    {
      "id": "srf.control.defense.SRF-L3-TEVV-010",
      "name": "SRF-L3-TEVV-010: Red Team and Adversarial Robustness Test Before Deployment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-TEVV-010"
    },
    {
      "id": "srf.control.defense.SRF-L3-TEVV-011",
      "name": "SRF-L3-TEVV-011: Bias and Equitable Treatment Assessment Before Deployment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L3-TEVV-011"
    },
    {
      "id": "srf.control.defense.SRF-L4-ACQ-001",
      "name": "SRF-L4-ACQ-001: DISA Provisional Authorization at Required IL Before Deployment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-ACQ-001"
    },
    {
      "id": "srf.control.defense.SRF-L4-ACQ-002",
      "name": "SRF-L4-ACQ-002: STIG Baseline Configuration Enforcement",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-ACQ-002"
    },
    {
      "id": "srf.control.defense.SRF-L4-ACQ-003",
      "name": "SRF-L4-ACQ-003: IL-Appropriate Cloud Region Enforcement",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-ACQ-003"
    },
    {
      "id": "srf.control.defense.SRF-L4-ACQ-007",
      "name": "SRF-L4-ACQ-007: CMMC Level 2 Assessment for Contractor-Owned CUI Platforms",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-ACQ-007"
    },
    {
      "id": "srf.control.defense.SRF-L4-ACQ-008",
      "name": "SRF-L4-ACQ-008: CMMC Level 3 Assessment for Higher-Value Contractor Platforms",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-ACQ-008"
    },
    {
      "id": "srf.control.defense.SRF-L4-OPS-004",
      "name": "SRF-L4-OPS-004: CUI and Classified Data Encryption to NSA-Approved Standards",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-OPS-004"
    },
    {
      "id": "srf.control.defense.SRF-L4-OPS-005",
      "name": "SRF-L4-OPS-005: Audit Log Completeness per DISA Requirements",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-OPS-005"
    },
    {
      "id": "srf.control.defense.SRF-L4-OPS-006",
      "name": "SRF-L4-OPS-006: API Gateway Authentication and Authorization",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-OPS-006"
    },
    {
      "id": "srf.control.defense.SRF-L4-OPS-009",
      "name": "SRF-L4-OPS-009: Continuous Vulnerability Scanning via DISA ACAS",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-OPS-009"
    },
    {
      "id": "srf.control.defense.SRF-L4-OPS-010",
      "name": "SRF-L4-OPS-010: Mission-Critical AI Availability SLA",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-OPS-010"
    },
    {
      "id": "srf.control.defense.SRF-L4-OVR-012",
      "name": "SRF-L4-OVR-012: Platform-Level Emergency Stop Capability Tested",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-OVR-012"
    },
    {
      "id": "srf.control.defense.SRF-L4-TEVV-011",
      "name": "SRF-L4-TEVV-011: Platform Security Configuration Validated Against CC SRG Baseline Before ATO",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L4-TEVV-011"
    },
    {
      "id": "srf.control.defense.SRF-L5-ACQ-001",
      "name": "SRF-L5-ACQ-001: Model Transparency Card per DoDI 5000.90",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-ACQ-001"
    },
    {
      "id": "srf.control.defense.SRF-L5-ACQ-003",
      "name": "SRF-L5-ACQ-003: Model Artifact Signing and Bill of AI Materials",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-ACQ-003"
    },
    {
      "id": "srf.control.defense.SRF-L5-ACQ-005",
      "name": "SRF-L5-ACQ-005: Model Portability to Avoid Vendor Lock-In",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-ACQ-005"
    },
    {
      "id": "srf.control.defense.SRF-L5-ACQ-007",
      "name": "SRF-L5-ACQ-007: Personnel Security Clearance for IL6 Model Infrastructure Access",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-ACQ-007"
    },
    {
      "id": "srf.control.defense.SRF-L5-ACQ-008",
      "name": "SRF-L5-ACQ-008: Supply Chain Risk Assessment for AI Components and Foundation Model Providers",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-ACQ-008"
    },
    {
      "id": "srf.control.defense.SRF-L5-OPS-002",
      "name": "SRF-L5-OPS-002: Vendor Model Drift Disclosure SLA",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-OPS-002"
    },
    {
      "id": "srf.control.defense.SRF-L5-OPS-004",
      "name": "SRF-L5-OPS-004: Vulnerability Disclosure SLA and Patch Cadence",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-OPS-004"
    },
    {
      "id": "srf.control.defense.SRF-L5-OPS-006",
      "name": "SRF-L5-OPS-006: Re-Validation Trigger on Model Version Change",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-OPS-006"
    },
    {
      "id": "srf.control.defense.SRF-L5-TEVV-009",
      "name": "SRF-L5-TEVV-009: Model Behavioral Baseline Documented Before Initial Deployment",
      "type": "control",
      "subtype": "defense",
      "url": "https://aisharedresponsibility.com/defense/controls/#SRF-L5-TEVV-009"
    },
    {
      "id": "srf.control.finance.SRF-L1-DEV-001",
      "name": "SRF-L1-DEV-001: AI Risk Appetite Statement with Named Accountable Executive",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-DEV-001"
    },
    {
      "id": "srf.control.finance.SRF-L1-DEV-002",
      "name": "SRF-L1-DEV-002: AI Model Inventory and Tier Classification Policy",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-DEV-002"
    },
    {
      "id": "srf.control.finance.SRF-L1-DEV-003",
      "name": "SRF-L1-DEV-003: Acceptable Use Policy with Named Business-Unit Accountable Individual",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-DEV-003"
    },
    {
      "id": "srf.control.finance.SRF-L1-DEV-004",
      "name": "SRF-L1-DEV-004: Agent Business Process Authorization Policy",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-DEV-004"
    },
    {
      "id": "srf.control.finance.SRF-L1-DEV-005",
      "name": "SRF-L1-DEV-005: Third-Party AI Vendor Register with Named Accountable Officer",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-DEV-005"
    },
    {
      "id": "srf.control.finance.SRF-L1-ECH-001",
      "name": "SRF-L1-ECH-001: Board-Level Effective Challenge of AI Risk Profile",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-ECH-001"
    },
    {
      "id": "srf.control.finance.SRF-L1-MON-001",
      "name": "SRF-L1-MON-001: Model Tier Classification Coverage Rate",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-MON-001"
    },
    {
      "id": "srf.control.finance.SRF-L1-MON-002",
      "name": "SRF-L1-MON-002: AI Governance Committee Review Cadence",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-MON-002"
    },
    {
      "id": "srf.control.finance.SRF-L1-MON-003",
      "name": "SRF-L1-MON-003: Governance Role Identity Lifecycle Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-MON-003"
    },
    {
      "id": "srf.control.finance.SRF-L1-VAL-001",
      "name": "SRF-L1-VAL-001: Independent Review of AI Risk Appetite by Second Line",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L1-VAL-001"
    },
    {
      "id": "srf.control.finance.SRF-L2-DEV-001",
      "name": "SRF-L2-DEV-001: Training and RAG Data Provenance Documentation",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-DEV-001"
    },
    {
      "id": "srf.control.finance.SRF-L2-DEV-002",
      "name": "SRF-L2-DEV-002: Data Classification for AI-Accessible Data Stores",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-DEV-002"
    },
    {
      "id": "srf.control.finance.SRF-L2-DEV-003",
      "name": "SRF-L2-DEV-003: Training Data Quality Baseline and PSI Reference Distribution",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-DEV-003"
    },
    {
      "id": "srf.control.finance.SRF-L2-ECH-001",
      "name": "SRF-L2-ECH-001: Effective Challenge of Data Quality Standards and Drift Thresholds",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-ECH-001"
    },
    {
      "id": "srf.control.finance.SRF-L2-MON-001",
      "name": "SRF-L2-MON-001: Training and RAG Data Drift Monitoring (PSI)",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-MON-001"
    },
    {
      "id": "srf.control.finance.SRF-L2-MON-002",
      "name": "SRF-L2-MON-002: Data Classification Coverage Rate for AI-Accessible Stores",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-MON-002"
    },
    {
      "id": "srf.control.finance.SRF-L2-MON-003",
      "name": "SRF-L2-MON-003: Agent Runtime Memory Store Integrity Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-MON-003"
    },
    {
      "id": "srf.control.finance.SRF-L2-VAL-001",
      "name": "SRF-L2-VAL-001: Independent Validation of Training Data Quality and Representativeness",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L2-VAL-001"
    },
    {
      "id": "srf.control.finance.SRF-L3-DEV-001",
      "name": "SRF-L3-DEV-001: Input Validation and Prompt Injection Defense Design",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-DEV-001"
    },
    {
      "id": "srf.control.finance.SRF-L3-DEV-002",
      "name": "SRF-L3-DEV-002: Output Filtering and Content Safety Design",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-DEV-002"
    },
    {
      "id": "srf.control.finance.SRF-L3-DEV-003",
      "name": "SRF-L3-DEV-003: Tool-Execution Authorization Design for Agentic Systems",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-DEV-003"
    },
    {
      "id": "srf.control.finance.SRF-L3-ECH-001",
      "name": "SRF-L3-ECH-001: Effective Challenge of Application Security Control Thresholds",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-ECH-001"
    },
    {
      "id": "srf.control.finance.SRF-L3-MON-001",
      "name": "SRF-L3-MON-001: Prompt Injection Detection Rate Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-MON-001"
    },
    {
      "id": "srf.control.finance.SRF-L3-MON-002",
      "name": "SRF-L3-MON-002: Output Filter Block-Rate Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-MON-002"
    },
    {
      "id": "srf.control.finance.SRF-L3-MON-003",
      "name": "SRF-L3-MON-003: Tool-Execution Authorization Failure Rate Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-MON-003"
    },
    {
      "id": "srf.control.finance.SRF-L3-VAL-001",
      "name": "SRF-L3-VAL-001: Independent Validation of Application-Level Security Controls",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L3-VAL-001"
    },
    {
      "id": "srf.control.finance.SRF-L4-DEV-001",
      "name": "SRF-L4-DEV-001: Platform-Level Guardrail Design and Configuration Baseline",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-DEV-001"
    },
    {
      "id": "srf.control.finance.SRF-L4-DEV-002",
      "name": "SRF-L4-DEV-002: LLM Gateway Authentication and Authorization Design",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-DEV-002"
    },
    {
      "id": "srf.control.finance.SRF-L4-DEV-003",
      "name": "SRF-L4-DEV-003: Confidential Compute Configuration for Tier-1 Models",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-DEV-003"
    },
    {
      "id": "srf.control.finance.SRF-L4-ECH-001",
      "name": "SRF-L4-ECH-001: Effective Challenge of Platform Security Controls and Thresholds",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-ECH-001"
    },
    {
      "id": "srf.control.finance.SRF-L4-MON-001",
      "name": "SRF-L4-MON-001: Guardrail Bypass Rate Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-MON-001"
    },
    {
      "id": "srf.control.finance.SRF-L4-MON-002",
      "name": "SRF-L4-MON-002: Gateway Authentication Failure Rate Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-MON-002"
    },
    {
      "id": "srf.control.finance.SRF-L4-MON-003",
      "name": "SRF-L4-MON-003: Confidential Compute Attestation Validity Monitoring",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-MON-003"
    },
    {
      "id": "srf.control.finance.SRF-L4-VAL-001",
      "name": "SRF-L4-VAL-001: Independent Validation of Platform Security Controls",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L4-VAL-001"
    },
    {
      "id": "srf.control.finance.SRF-L5-DEV-001",
      "name": "SRF-L5-DEV-001: Model Card Completeness and Security Disclosure",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L5-DEV-001"
    },
    {
      "id": "srf.control.finance.SRF-L5-DEV-002",
      "name": "SRF-L5-DEV-002: Model Artifact Signing and Supply-Chain Provenance",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L5-DEV-002"
    },
    {
      "id": "srf.control.finance.SRF-L5-DEV-003",
      "name": "SRF-L5-DEV-003: Pre-Release Security Evaluation Baseline",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L5-DEV-003"
    },
    {
      "id": "srf.control.finance.SRF-L5-ECH-001",
      "name": "SRF-L5-ECH-001: Effective Challenge of Model Governance Standards",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L5-ECH-001"
    },
    {
      "id": "srf.control.finance.SRF-L5-MON-001",
      "name": "SRF-L5-MON-001: Model Signature Verification at Load",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L5-MON-001"
    },
    {
      "id": "srf.control.finance.SRF-L5-MON-002",
      "name": "SRF-L5-MON-002: Vulnerability Disclosure SLA Adherence",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L5-MON-002"
    },
    {
      "id": "srf.control.finance.SRF-L5-VAL-001",
      "name": "SRF-L5-VAL-001: Independent Evaluation of Model Security Properties",
      "type": "control",
      "subtype": "finance",
      "url": "https://aisharedresponsibility.com/finance/controls/#SRF-L5-VAL-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-DEV-001",
      "name": "SRF-L1-DEV-001: Clinical AI Risk Classification Policy",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-DEV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-DEV-002",
      "name": "SRF-L1-DEV-002: Clinical AI System Inventory and Registry",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-DEV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-DEV-003",
      "name": "SRF-L1-DEV-003: Clinical AI Ethics Committee and Oversight Charter",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-DEV-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-DEV-004",
      "name": "SRF-L1-DEV-004: Third-Party AI Vendor Register with Named Accountable Officer",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-DEV-004"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-HOR-001",
      "name": "SRF-L1-HOR-001: Clinical AI Governance Review Cadence",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-HOR-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-HOR-002",
      "name": "SRF-L1-HOR-002: Acceptable Use Policy for Clinical AI",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-HOR-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-HOR-003",
      "name": "SRF-L1-HOR-003: Clinician Override Documentation Policy",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-HOR-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-PMS-001",
      "name": "SRF-L1-PMS-001: FDA Regulatory Filing Currency",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-PMS-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-PMS-002",
      "name": "SRF-L1-PMS-002: Medical Device Adverse Event Reporting Readiness",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-PMS-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L1-PMS-003",
      "name": "SRF-L1-PMS-003: PCCP Algorithm Change Governance",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L1-PMS-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-DEV-001",
      "name": "SRF-L2-DEV-001: Training Data Provenance and Consent Documentation",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-DEV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-DEV-002",
      "name": "SRF-L2-DEV-002: Demographic Representation Assessment",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-DEV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-DEV-003",
      "name": "SRF-L2-DEV-003: PHI Isolation in Non-Production Environments",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-DEV-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-PMS-001",
      "name": "SRF-L2-PMS-001: Input Distribution Drift Monitoring",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-PMS-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-PMS-002",
      "name": "SRF-L2-PMS-002: Real-World Data Quality Scoring",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-PMS-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-PMS-003",
      "name": "SRF-L2-PMS-003: Agent Context Store Integrity",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-PMS-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-VV-001",
      "name": "SRF-L2-VV-001: External Validation Dataset Independence",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-VV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L2-VV-002",
      "name": "SRF-L2-VV-002: Subgroup Performance Equivalence",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L2-VV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-DEV-001",
      "name": "SRF-L3-DEV-001: Human-in-the-Loop Gate for High-Stakes Outputs",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-DEV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-DEV-002",
      "name": "SRF-L3-DEV-002: AI Explanation Coverage for Clinical Decisions",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-DEV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-DEV-003",
      "name": "SRF-L3-DEV-003: Adversarial Robustness Testing Before Clinical Deployment",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-DEV-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-PMS-001",
      "name": "SRF-L3-PMS-001: Clinician Override Rate Monitoring",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-PMS-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-PMS-002",
      "name": "SRF-L3-PMS-002: Safety-Critical Output Filter Bypass Rate",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-PMS-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-PMS-003",
      "name": "SRF-L3-PMS-003: Agentic Task Boundary Enforcement",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-PMS-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-VV-001",
      "name": "SRF-L3-VV-001: Clinical Workflow Usability Validation",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-VV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L3-VV-002",
      "name": "SRF-L3-VV-002: Prompt Injection and Input Manipulation Defense",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L3-VV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-DEV-001",
      "name": "SRF-L4-DEV-001: SMART on FHIR Authentication and Scoped Authorization",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-DEV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-DEV-002",
      "name": "SRF-L4-DEV-002: FHIR AuditEvent Logging Completeness",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-DEV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-DEV-003",
      "name": "SRF-L4-DEV-003: PHI Encryption at Rest and in Transit",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-DEV-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-PMS-001",
      "name": "SRF-L4-PMS-001: Unauthorized Access Attempt Monitoring",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-PMS-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-PMS-002",
      "name": "SRF-L4-PMS-002: Clinical AI Platform Availability SLA",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-PMS-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-PMS-003",
      "name": "SRF-L4-PMS-003: Runtime Model Artifact Integrity Verification",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-PMS-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-VV-001",
      "name": "SRF-L4-VV-001: Platform Security Assessment Before Clinical Deployment",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-VV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L4-VV-002",
      "name": "SRF-L4-VV-002: Clinical Guardrail Configuration Baseline Verification",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L4-VV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L5-DEV-001",
      "name": "SRF-L5-DEV-001: Model Card and SaMD Definition Statement",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L5-DEV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L5-DEV-002",
      "name": "SRF-L5-DEV-002: Software of Unknown Provenance (SOUP) Documentation",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L5-DEV-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L5-DEV-003",
      "name": "SRF-L5-DEV-003: Pre-Deployment Safety Evaluation (ISO 14971)",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L5-DEV-003"
    },
    {
      "id": "srf.control.healthcare.SRF-L5-PMS-001",
      "name": "SRF-L5-PMS-001: Post-Market Performance Monitoring Plan",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L5-PMS-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L5-PMS-002",
      "name": "SRF-L5-PMS-002: Vulnerability Disclosure and Patch Response SLA",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L5-PMS-002"
    },
    {
      "id": "srf.control.healthcare.SRF-L5-VV-001",
      "name": "SRF-L5-VV-001: Independent Clinical Validation",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L5-VV-001"
    },
    {
      "id": "srf.control.healthcare.SRF-L5-VV-002",
      "name": "SRF-L5-VV-002: Model Artifact Signing and Supply-Chain Provenance",
      "type": "control",
      "subtype": "healthcare",
      "url": "https://aisharedresponsibility.com/healthcare/controls/#SRF-L5-VV-002"
    },
    {
      "id": "srf.control.insurance.SRF-L1-DEV-001",
      "name": "SRF-L1-DEV-001: AIS Program Document Currency and Board Approval",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-DEV-001"
    },
    {
      "id": "srf.control.insurance.SRF-L1-DEV-002",
      "name": "SRF-L1-DEV-002: AI System Inventory Coverage",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-DEV-002"
    },
    {
      "id": "srf.control.insurance.SRF-L1-DEV-003",
      "name": "SRF-L1-DEV-003: Third-Party AI Vendor Register with Named Accountable Officer",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-DEV-003"
    },
    {
      "id": "srf.control.insurance.SRF-L1-DEV-004",
      "name": "SRF-L1-DEV-004: Adverse-Decision Appeal Process Documentation",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-DEV-004"
    },
    {
      "id": "srf.control.insurance.SRF-L1-DEV-005",
      "name": "SRF-L1-DEV-005: Governance Framework Availability Readiness for CO Regulation 10-1-1",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-DEV-005"
    },
    {
      "id": "srf.control.insurance.SRF-L1-MON-001",
      "name": "SRF-L1-MON-001: AI Risk Appetite Statement Review Cadence",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-MON-001"
    },
    {
      "id": "srf.control.insurance.SRF-L1-MON-002",
      "name": "SRF-L1-MON-002: Senior Management Accountability Designation for AI Governance",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-MON-002"
    },
    {
      "id": "srf.control.insurance.SRF-L1-TPO-001",
      "name": "SRF-L1-TPO-001: Third-Party AIS Program Alignment Review",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-TPO-001"
    },
    {
      "id": "srf.control.insurance.SRF-L1-TPO-002",
      "name": "SRF-L1-TPO-002: Market Conduct Exam Readiness Documentation Package",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L1-TPO-002"
    },
    {
      "id": "srf.control.insurance.SRF-L2-DEV-001",
      "name": "SRF-L2-DEV-001: ECDIS Source Documentation and Permissible-Purpose Verification",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-DEV-001"
    },
    {
      "id": "srf.control.insurance.SRF-L2-DEV-002",
      "name": "SRF-L2-DEV-002: Protected-Class Proxy Variable Screening",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-DEV-002"
    },
    {
      "id": "srf.control.insurance.SRF-L2-DEV-003",
      "name": "SRF-L2-DEV-003: Training Data Representativeness by Line of Business",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-DEV-003"
    },
    {
      "id": "srf.control.insurance.SRF-L2-MON-001",
      "name": "SRF-L2-MON-001: Input Drift Monitoring via Population Stability Index",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-MON-001"
    },
    {
      "id": "srf.control.insurance.SRF-L2-MON-002",
      "name": "SRF-L2-MON-002: Consumer Data Minimization in Agent Context Stores",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-MON-002"
    },
    {
      "id": "srf.control.insurance.SRF-L2-MON-003",
      "name": "SRF-L2-MON-003: Algorithmic Model Input Completeness Monitoring",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-MON-003"
    },
    {
      "id": "srf.control.insurance.SRF-L2-TPO-001",
      "name": "SRF-L2-TPO-001: Vendor Data Lineage Documentation",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-TPO-001"
    },
    {
      "id": "srf.control.insurance.SRF-L2-VAL-001",
      "name": "SRF-L2-VAL-001: External Data Source Permissible Use Audit",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L2-VAL-001"
    },
    {
      "id": "srf.control.insurance.SRF-L3-DEV-001",
      "name": "SRF-L3-DEV-001: Prompt Injection Defense for Consumer-Facing AI",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-DEV-001"
    },
    {
      "id": "srf.control.insurance.SRF-L3-DEV-002",
      "name": "SRF-L3-DEV-002: Agentic Task Boundary Enforcement for Claims Automation",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-DEV-002"
    },
    {
      "id": "srf.control.insurance.SRF-L3-MON-001",
      "name": "SRF-L3-MON-001: Unfair-Discrimination Outcome Testing Cadence",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-MON-001"
    },
    {
      "id": "srf.control.insurance.SRF-L3-MON-002",
      "name": "SRF-L3-MON-002: Consumer Complaint Monitoring for AI-Driven Decisions",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-MON-002"
    },
    {
      "id": "srf.control.insurance.SRF-L3-TPO-001",
      "name": "SRF-L3-TPO-001: Vendor Application Interface Security Testing",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-TPO-001"
    },
    {
      "id": "srf.control.insurance.SRF-L3-VAL-001",
      "name": "SRF-L3-VAL-001: Adverse-Action Explanation Coverage with Reason Codes",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-VAL-001"
    },
    {
      "id": "srf.control.insurance.SRF-L3-VAL-002",
      "name": "SRF-L3-VAL-002: Human Review Gate for Adverse Underwriting and Claims Decisions",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-VAL-002"
    },
    {
      "id": "srf.control.insurance.SRF-L3-VAL-003",
      "name": "SRF-L3-VAL-003: Explainability Validation for Rate and Underwriting Models",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L3-VAL-003"
    },
    {
      "id": "srf.control.insurance.SRF-L4-DEV-001",
      "name": "SRF-L4-DEV-001: Model Gateway Authentication Configuration",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-DEV-001"
    },
    {
      "id": "srf.control.insurance.SRF-L4-DEV-002",
      "name": "SRF-L4-DEV-002: Guardrail Configuration Baseline Documentation",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-DEV-002"
    },
    {
      "id": "srf.control.insurance.SRF-L4-DEV-003",
      "name": "SRF-L4-DEV-003: PII Encryption at Rest and in Transit",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-DEV-003"
    },
    {
      "id": "srf.control.insurance.SRF-L4-MON-001",
      "name": "SRF-L4-MON-001: Vendor-Model Isolation and Egress Control",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-MON-001"
    },
    {
      "id": "srf.control.insurance.SRF-L4-MON-002",
      "name": "SRF-L4-MON-002: Audit Log Completeness for AI-Assisted Decisions",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-MON-002"
    },
    {
      "id": "srf.control.insurance.SRF-L4-MON-003",
      "name": "SRF-L4-MON-003: Runtime Anomaly Detection for AI Workloads",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-MON-003"
    },
    {
      "id": "srf.control.insurance.SRF-L4-TPO-001",
      "name": "SRF-L4-TPO-001: Third-Party Platform Access Review",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-TPO-001"
    },
    {
      "id": "srf.control.insurance.SRF-L4-VAL-001",
      "name": "SRF-L4-VAL-001: Platform Security Assessment",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L4-VAL-001"
    },
    {
      "id": "srf.control.insurance.SRF-L5-DEV-001",
      "name": "SRF-L5-DEV-001: Model Card with Intended Line-of-Business Statement",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L5-DEV-001"
    },
    {
      "id": "srf.control.insurance.SRF-L5-DEV-002",
      "name": "SRF-L5-DEV-002: Model Artifact Signing and Supply-Chain Provenance",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L5-DEV-002"
    },
    {
      "id": "srf.control.insurance.SRF-L5-MON-001",
      "name": "SRF-L5-MON-001: Post-Deployment Performance and Drift Disclosure SLA from Vendors",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L5-MON-001"
    },
    {
      "id": "srf.control.insurance.SRF-L5-MON-002",
      "name": "SRF-L5-MON-002: CVE Vulnerability Disclosure SLA from Model Provider",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L5-MON-002"
    },
    {
      "id": "srf.control.insurance.SRF-L5-TPO-001",
      "name": "SRF-L5-TPO-001: Vendor Model Due-Diligence Evidence Package (NAIC Third-Party Oversight)",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L5-TPO-001"
    },
    {
      "id": "srf.control.insurance.SRF-L5-VAL-001",
      "name": "SRF-L5-VAL-001: Pre-Deployment Fairness Evaluation by Line of Business",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L5-VAL-001"
    },
    {
      "id": "srf.control.insurance.SRF-L5-VAL-002",
      "name": "SRF-L5-VAL-002: Independent Model Validation",
      "type": "control",
      "subtype": "insurance",
      "url": "https://aisharedresponsibility.com/insurance/controls/#SRF-L5-VAL-002"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-CHG-009",
      "name": "SRF-L1-CHG-009: AI Discontinuation and Decommission Procedure",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-CHG-009"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-CHG-010",
      "name": "SRF-L1-CHG-010: OT Change Management Policy for AI Systems",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-CHG-010"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-DES-001",
      "name": "SRF-L1-DES-001: EU AI Act Risk Classification and Registry",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-DES-001"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-DES-002",
      "name": "SRF-L1-DES-002: AI Governance Committee with OT and Safety Representation",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-DES-002"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-DES-003",
      "name": "SRF-L1-DES-003: AI Use Case Inventory with Operating Model and Risk Tier",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-DES-003"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-DES-006",
      "name": "SRF-L1-DES-006: Third-Party AI System Procurement Policy",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-DES-006"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-DES-008",
      "name": "SRF-L1-DES-008: Fundamental Rights Impact Assessment (FRIA)",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-DES-008"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-OPS-005",
      "name": "SRF-L1-OPS-005: Incident Reporting Plan to Market Surveillance Authority",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-OPS-005"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-OPS-007",
      "name": "SRF-L1-OPS-007: Post-Market Monitoring Plan per EU AI Act Article 72",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-OPS-007"
    },
    {
      "id": "srf.control.manufacturing.SRF-L1-VAL-004",
      "name": "SRF-L1-VAL-004: Conformity Assessment Program Management",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L1-VAL-004"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-DES-001",
      "name": "SRF-L2-DES-001: Sensor and Historian Data Provenance Documentation",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-DES-001"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-DES-002",
      "name": "SRF-L2-DES-002: Training Data Authority-to-Use for Production Data",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-DES-002"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-OPS-003",
      "name": "SRF-L2-OPS-003: OT/IT Data Boundary Enforcement",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-OPS-003"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-OPS-004",
      "name": "SRF-L2-OPS-004: Input Data Drift Monitoring",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-OPS-004"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-OPS-006",
      "name": "SRF-L2-OPS-006: Adversarial Input Detection for OT-Edge AI",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-OPS-006"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-OPS-007",
      "name": "SRF-L2-OPS-007: AI Decision Log Retention per EU AI Act Article 12",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-OPS-007"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-OPS-008",
      "name": "SRF-L2-OPS-008: Production Data Egress Audit for Cloud AI Services",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-OPS-008"
    },
    {
      "id": "srf.control.manufacturing.SRF-L2-VAL-005",
      "name": "SRF-L2-VAL-005: Training Data Bias Assessment for Consequential AI",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L2-VAL-005"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-OPS-003",
      "name": "SRF-L3-OPS-003: Human Oversight Gate for Safety-Critical AI Outputs",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-OPS-003"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-OPS-008",
      "name": "SRF-L3-OPS-008: Agentic Task Boundary Enforcement for Autonomous Systems",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-OPS-008"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-OPS-009",
      "name": "SRF-L3-OPS-009: Prompt Injection and Adversarial Input Detection for AI Assistants",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-OPS-009"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-OPS-010",
      "name": "SRF-L3-OPS-010: Explanation Availability for AI-Assisted Quality and Safety Decisions",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-OPS-010"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-VAL-001",
      "name": "SRF-L3-VAL-001: EU AI Act Technical Documentation Completeness",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-VAL-001"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-VAL-002",
      "name": "SRF-L3-VAL-002: Pre-Deployment Testing for Safety-Critical AI",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-VAL-002"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-VAL-004",
      "name": "SRF-L3-VAL-004: Safety Interlock Integration Verification",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-VAL-004"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-VAL-005",
      "name": "SRF-L3-VAL-005: EU AI Act Conformity Assessment Completed Before Market Placement",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-VAL-005"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-VAL-006",
      "name": "SRF-L3-VAL-006: FAT/SAT Test Coverage for AI-Enabled Machinery",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-VAL-006"
    },
    {
      "id": "srf.control.manufacturing.SRF-L3-VAL-007",
      "name": "SRF-L3-VAL-007: Operator Override Interface Verification",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L3-VAL-007"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-CHG-004",
      "name": "SRF-L4-CHG-004: Patch and Update Change Management for OT AI",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-CHG-004"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-DES-001",
      "name": "SRF-L4-DES-001: OT Network Zone Segmentation per IEC 62443",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-DES-001"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-DES-002",
      "name": "SRF-L4-DES-002: OT-Edge AI Hardware Security Baseline",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-DES-002"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-DES-008",
      "name": "SRF-L4-DES-008: AI Software Bill of Materials (SBOM/AIBOM) for OT AI Components",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-DES-008"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-OPS-003",
      "name": "SRF-L4-OPS-003: Air-Gap or Approved-Conduit Enforcement for Safety-Critical OT AI",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-OPS-003"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-OPS-005",
      "name": "SRF-L4-OPS-005: OT SIEM and Anomaly Detection Coverage",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-OPS-005"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-OPS-006",
      "name": "SRF-L4-OPS-006: Remote Access Security for OT AI Maintenance",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-OPS-006"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-OPS-007",
      "name": "SRF-L4-OPS-007: Encrypted Communication for AI Data in Transit",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-OPS-007"
    },
    {
      "id": "srf.control.manufacturing.SRF-L4-OPS-009",
      "name": "SRF-L4-OPS-009: Availability SLA for AI in Critical Production Processes",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L4-OPS-009"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-CHG-003",
      "name": "SRF-L5-CHG-003: Model Version Change Management Trigger",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-CHG-003"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-DES-005",
      "name": "SRF-L5-DES-005: BoAIM and Model Artifact Signing",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-DES-005"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-DES-007",
      "name": "SRF-L5-DES-007: Model Portability and Lock-In Avoidance Documentation",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-DES-007"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-DES-008",
      "name": "SRF-L5-DES-008: Model Supplier Due Diligence and Supply Chain Risk Assessment",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-DES-008"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-OPS-002",
      "name": "SRF-L5-OPS-002: Model Drift and Performance Degradation Monitoring",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-OPS-002"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-OPS-004",
      "name": "SRF-L5-OPS-004: Vulnerability Disclosure SLA for AI Model Supplier",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-OPS-004"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-VAL-001",
      "name": "SRF-L5-VAL-001: EU AI Act Technical File Completeness - Model Supplier Obligations",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-VAL-001"
    },
    {
      "id": "srf.control.manufacturing.SRF-L5-VAL-006",
      "name": "SRF-L5-VAL-006: Functional Safety Validation for AI in Safety-Instrumented Systems",
      "type": "control",
      "subtype": "manufacturing",
      "url": "https://aisharedresponsibility.com/manufacturing/controls/#SRF-L5-VAL-006"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-ACQ-001",
      "name": "SRF-L1-ACQ-001: AI Use-Case Inventory Completeness and Public Posting",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-ACQ-001"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-ACQ-002",
      "name": "SRF-L1-ACQ-002: High-Impact AI Designation with Named Designating Official",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-ACQ-002"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-ACQ-003",
      "name": "SRF-L1-ACQ-003: CAIO Appointment and AI Governance Board Charter Currency",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-ACQ-003"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-ACQ-004",
      "name": "SRF-L1-ACQ-004: M-25-21 Compliance Plan Currency",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-ACQ-004"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-ACQ-007",
      "name": "SRF-L1-ACQ-007: AI Acquisition Contract Compliance with M-25-22",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-ACQ-007"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-ACQ-008",
      "name": "SRF-L1-ACQ-008: AI Staff Training and Assessment Coverage",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-ACQ-008"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-ACQ-010",
      "name": "SRF-L1-ACQ-010: Third-Party AI Vendor Register and Supply Chain Risk Assessment",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-ACQ-010"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-MON-005",
      "name": "SRF-L1-MON-005: Discontinuation and Waiver Process Readiness",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-MON-005"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-MON-009",
      "name": "SRF-L1-MON-009: AI Governance Board Review Cadence for High-Impact Use Cases",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-MON-009"
    },
    {
      "id": "srf.control.public-sector.SRF-L1-OVR-006",
      "name": "SRF-L1-OVR-006: Public Feedback Channel for High-Impact AI",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L1-OVR-006"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-ACQ-001",
      "name": "SRF-L2-ACQ-001: Authority-to-Use Verification for Training and RAG Data",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-ACQ-001"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-ACQ-002",
      "name": "SRF-L2-ACQ-002: Agency Data Egress Block to Commercial Model Training",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-ACQ-002"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-ACQ-003",
      "name": "SRF-L2-ACQ-003: PII and CUI Classification Coverage for AI-Accessible Data Stores",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-ACQ-003"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-ACQ-005",
      "name": "SRF-L2-ACQ-005: AI Interaction Log Retention Compliance (NARA)",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-ACQ-005"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-ACQ-008",
      "name": "SRF-L2-ACQ-008: FedRAMP Authorization Status Verification for AI Data Services",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-ACQ-008"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-MON-004",
      "name": "SRF-L2-MON-004: Input Distribution Shift Monitoring (PSI)",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-MON-004"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-MON-006",
      "name": "SRF-L2-MON-006: AI Output Accuracy Monitoring Against Human Baseline",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-MON-006"
    },
    {
      "id": "srf.control.public-sector.SRF-L2-MON-007",
      "name": "SRF-L2-MON-007: Bias and Disparate Impact Monitoring for Citizen-Facing Use Cases",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L2-MON-007"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-MON-006",
      "name": "SRF-L3-MON-006: Agentic Task Boundary Enforcement for Casework Automation",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-MON-006"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-OVR-004",
      "name": "SRF-L3-OVR-004: Human Oversight Gate for Adverse Citizen-Facing Decisions",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-OVR-004"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-OVR-005",
      "name": "SRF-L3-OVR-005: Remedy and Appeal Mechanism Coverage",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-OVR-005"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-OVR-008",
      "name": "SRF-L3-OVR-008: AI Output Explanation for Adverse Citizen Decisions",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-OVR-008"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-VAL-001",
      "name": "SRF-L3-VAL-001: Pre-Deployment Testing Coverage for High-Impact Use Cases",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-VAL-001"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-VAL-002",
      "name": "SRF-L3-VAL-002: AI Impact Assessment Completion for High-Impact Use Cases",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-VAL-002"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-VAL-003",
      "name": "SRF-L3-VAL-003: Prompt Injection Detection for Citizen-Facing AI Systems",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-VAL-003"
    },
    {
      "id": "srf.control.public-sector.SRF-L3-VAL-007",
      "name": "SRF-L3-VAL-007: Shared-Service AI Inheritance Chain Documentation",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L3-VAL-007"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-ACQ-001",
      "name": "SRF-L4-ACQ-001: AI Service FedRAMP Authorization at Required Impact Level",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-ACQ-001"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-ACQ-002",
      "name": "SRF-L4-ACQ-002: Guardrail Configuration Baseline and Change Control",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-ACQ-002"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-ACQ-003",
      "name": "SRF-L4-ACQ-003: Gateway Authentication and Authorization for AI API Access",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-ACQ-003"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-MON-004",
      "name": "SRF-L4-MON-004: CUI Encryption and Access Monitoring for AI Workloads",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-MON-004"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-MON-005",
      "name": "SRF-L4-MON-005: Audit Log Completeness Aligned to FedRAMP 20x KSI Evidence",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-MON-005"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-MON-006",
      "name": "SRF-L4-MON-006: Model Serving Availability SLA for Mission-Critical Use Cases",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-MON-006"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-MON-008",
      "name": "SRF-L4-MON-008: Continuous Vulnerability Scanning for AI Platform Components",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-MON-008"
    },
    {
      "id": "srf.control.public-sector.SRF-L4-VAL-007",
      "name": "SRF-L4-VAL-007: Security Control Inheritance Verification at ATO Boundary",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L4-VAL-007"
    },
    {
      "id": "srf.control.public-sector.SRF-L5-ACQ-001",
      "name": "SRF-L5-ACQ-001: Model Documentation Completeness per M-25-22 Transparency Terms",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L5-ACQ-001"
    },
    {
      "id": "srf.control.public-sector.SRF-L5-ACQ-003",
      "name": "SRF-L5-ACQ-003: Model Artifact Signing and Provenance Verification",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L5-ACQ-003"
    },
    {
      "id": "srf.control.public-sector.SRF-L5-ACQ-005",
      "name": "SRF-L5-ACQ-005: Model Portability Evidence for Vendor Lock-In Avoidance",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L5-ACQ-005"
    },
    {
      "id": "srf.control.public-sector.SRF-L5-MON-002",
      "name": "SRF-L5-MON-002: Vendor Performance and Drift Disclosure SLA",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L5-MON-002"
    },
    {
      "id": "srf.control.public-sector.SRF-L5-MON-004",
      "name": "SRF-L5-MON-004: Vendor Vulnerability Disclosure SLA",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L5-MON-004"
    },
    {
      "id": "srf.control.public-sector.SRF-L5-MON-006",
      "name": "SRF-L5-MON-006: AI Model Version Change Notification and Re-Validation Trigger",
      "type": "control",
      "subtype": "public-sector",
      "url": "https://aisharedresponsibility.com/public-sector/controls/#SRF-L5-MON-006"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-CON-001",
      "name": "TAP-SRF-L1-CON-001: No Contribution-Back Condition on Shared Base Access",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-CON-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-CRT-001",
      "name": "TAP-SRF-L1-CRT-001: Certification Scope Separation",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-CRT-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-EVL-001",
      "name": "TAP-SRF-L1-EVL-001: Anti-Capture Review Before Certification or Standards Change",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-EVL-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-EXT-001",
      "name": "TAP-SRF-L1-EXT-001: Exit and Migration Documentation Currency",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-EXT-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-INT-001",
      "name": "TAP-SRF-L1-INT-001: Public Governance Rule and Contribution Requirement Publication",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-INT-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-MON-001",
      "name": "TAP-SRF-L1-MON-001: Independent Auditor Approval Registry",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-MON-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-MON-002",
      "name": "TAP-SRF-L1-MON-002: Decision-Rights Concentration Limit",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-MON-002"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L1-MON-003",
      "name": "TAP-SRF-L1-MON-003: Node Acceptable-Use and Local Legal Compliance",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L1-MON-003"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L2-CON-001",
      "name": "TAP-SRF-L2-CON-001: Weight-Only Contribution Data Rights Declaration",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L2-CON-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L2-CON-002",
      "name": "TAP-SRF-L2-CON-002: Dataset Descriptor Disclosure",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L2-CON-002"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L2-CON-003",
      "name": "TAP-SRF-L2-CON-003: Sovereign Data Boundary Enforcement",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L2-CON-003"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L2-CON-004",
      "name": "TAP-SRF-L2-CON-004: Minimum Non-Public Evidence Set for Withheld Source Identities",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L2-CON-004"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L2-MON-001",
      "name": "TAP-SRF-L2-MON-001: Dataset Categorization and Governance Enforcement",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L2-MON-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L2-MON-002",
      "name": "TAP-SRF-L2-MON-002: Node Enforcement Audit Available to Oversight",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L2-MON-002"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L2-MON-003",
      "name": "TAP-SRF-L2-MON-003: Consent and Data Revocation Effect on Integrated Releases",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L2-MON-003"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L3-MON-001",
      "name": "TAP-SRF-L3-MON-001: Sovereign Derivative Lineage and License Record",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L3-MON-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L3-MON-002",
      "name": "TAP-SRF-L3-MON-002: Local Alignment Configuration Governance",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L3-MON-002"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L4-CON-001",
      "name": "TAP-SRF-L4-CON-001: Local Training Compute Under Node Control",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L4-CON-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L4-INT-001",
      "name": "TAP-SRF-L4-INT-001: Core Aggregation Boundary Verification",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L4-INT-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L4-INT-002",
      "name": "TAP-SRF-L4-INT-002: Shared Commons Dependency Register",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L4-INT-002"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L5-CON-001",
      "name": "TAP-SRF-L5-CON-001: Memorization Risk Control Before Contribution",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L5-CON-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L5-CRT-001",
      "name": "TAP-SRF-L5-CRT-001: Adopted Base License Compatibility Assessment",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L5-CRT-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L5-EVL-001",
      "name": "TAP-SRF-L5-EVL-001: Contribution Evaluation Without Raw-Data Access",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L5-EVL-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L5-EVL-002",
      "name": "TAP-SRF-L5-EVL-002: Contribution Rejection and Quarantine Authority",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L5-EVL-002"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L5-INT-001",
      "name": "TAP-SRF-L5-INT-001: Shared Base Release Documentation Sufficiency",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L5-INT-001"
    },
    {
      "id": "srf.control.tapestry.TAP-SRF-L5-MON-001",
      "name": "TAP-SRF-L5-MON-001: Safety Alignment Preservation Through Continued Pretraining",
      "type": "control",
      "subtype": "tapestry",
      "url": "https://aisharedresponsibility.com/tapestry/controls/#TAP-SRF-L5-MON-001"
    },
    {
      "id": "srf.data.ai-agentic-principles",
      "name": "AI and agentic security principles catalog",
      "type": "concept",
      "subtype": "dataset",
      "url": "https://aisharedresponsibility.com/data/ai-agentic-principles.json"
    },
    {
      "id": "srf.data.attack-inventory",
      "name": "Published AI attack class inventory",
      "type": "concept",
      "subtype": "dataset",
      "url": "https://aisharedresponsibility.com/data/attack-inventory.json"
    },
    {
      "id": "srf.data.jurisdictions",
      "name": "Jurisdiction vocabulary for regulations",
      "type": "concept",
      "subtype": "dataset",
      "url": "https://aisharedresponsibility.com/data/jurisdictions.json"
    },
    {
      "id": "srf.data.moral-regulatory-hierarchy",
      "name": "Moral orientation tags for regulatory requirements",
      "type": "concept",
      "subtype": "dataset",
      "url": "https://aisharedresponsibility.com/data/moral-regulatory-hierarchy.json"
    },
    {
      "id": "srf.data.security-principles",
      "name": "Classic security principles catalog",
      "type": "concept",
      "subtype": "dataset",
      "url": "https://aisharedresponsibility.com/data/security-principles.json"
    },
    {
      "id": "srf.data.threat-sources",
      "name": "Threat source registry",
      "type": "concept",
      "subtype": "dataset",
      "url": "https://aisharedresponsibility.com/data/threat-sources.json"
    },
    {
      "id": "srf.data.threats",
      "name": "Threat-to-accountability crosswalk",
      "type": "concept",
      "subtype": "dataset",
      "url": "https://aisharedresponsibility.com/data/threats.json"
    },
    {
      "id": "srf.framework.cosai-srf",
      "name": "CoSAI AI Shared Responsibility Framework",
      "type": "framework",
      "subtype": null,
      "url": "https://aisharedresponsibility.com/framework/"
    },
    {
      "id": "srf.jurisdiction.australia",
      "name": "Australia",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.brazil",
      "name": "Brazil",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.canada",
      "name": "Canada",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.china",
      "name": "People's Republic of China",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.eu",
      "name": "European Union",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.india",
      "name": "India",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.international",
      "name": "International (standards bodies)",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.japan",
      "name": "Japan",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.oecd",
      "name": "OECD",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.singapore",
      "name": "Singapore",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.south-korea",
      "name": "Republic of Korea",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.uk",
      "name": "United Kingdom",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.us-california",
      "name": "California",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.us-colorado",
      "name": "Colorado",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.us-federal",
      "name": "United States (federal)",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.us-multistate",
      "name": "United States (multistate model law)",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.jurisdiction.us-new-york",
      "name": "New York",
      "type": "concept",
      "subtype": "jurisdiction",
      "url": "https://aisharedresponsibility.com/regulations/"
    },
    {
      "id": "srf.layer.L1",
      "name": "L1 AI Business & Usage",
      "type": "concept",
      "subtype": "layer",
      "url": "https://aisharedresponsibility.com/framework/#L1"
    },
    {
      "id": "srf.layer.L2",
      "name": "L2 AI Information",
      "type": "concept",
      "subtype": "layer",
      "url": "https://aisharedresponsibility.com/framework/#L2"
    },
    {
      "id": "srf.layer.L3",
      "name": "L3 AI Application",
      "type": "concept",
      "subtype": "layer",
      "url": "https://aisharedresponsibility.com/framework/#L3"
    },
    {
      "id": "srf.layer.L4",
      "name": "L4 AI Platform",
      "type": "concept",
      "subtype": "layer",
      "url": "https://aisharedresponsibility.com/framework/#L4"
    },
    {
      "id": "srf.layer.L5",
      "name": "L5 AI Model Provider",
      "type": "concept",
      "subtype": "layer",
      "url": "https://aisharedresponsibility.com/framework/#L5"
    },
    {
      "id": "srf.moral.action",
      "name": "Action",
      "type": "concept",
      "subtype": "moral-dimension",
      "url": "https://aisharedresponsibility.com/developers/schema/#moral-orientation"
    },
    {
      "id": "srf.moral.actor",
      "name": "Actor",
      "type": "concept",
      "subtype": "moral-dimension",
      "url": "https://aisharedresponsibility.com/developers/schema/#moral-orientation"
    },
    {
      "id": "srf.moral.outcome",
      "name": "Outcome",
      "type": "concept",
      "subtype": "moral-dimension",
      "url": "https://aisharedresponsibility.com/developers/schema/#moral-orientation"
    },
    {
      "id": "srf.opmodel.agent-paas",
      "name": "Agentic Platform as a Service",
      "type": "concept",
      "subtype": "operating-model",
      "url": "https://aisharedresponsibility.com/operating-models/#Agent-PaaS"
    },
    {
      "id": "srf.opmodel.ai-paas",
      "name": "AI Platform as a Service",
      "type": "concept",
      "subtype": "operating-model",
      "url": "https://aisharedresponsibility.com/operating-models/#AI-PaaS"
    },
    {
      "id": "srf.opmodel.ai-saas",
      "name": "AI-Enabled SaaS",
      "type": "concept",
      "subtype": "operating-model",
      "url": "https://aisharedresponsibility.com/operating-models/#AI-SaaS"
    },
    {
      "id": "srf.opmodel.federated-consortium",
      "name": "Federated Consortium",
      "type": "concept",
      "subtype": "operating-model",
      "url": "https://aisharedresponsibility.com/operating-models/#Federated-Consortium"
    },
    {
      "id": "srf.opmodel.iaas",
      "name": "Infrastructure as a Service",
      "type": "concept",
      "subtype": "operating-model",
      "url": "https://aisharedresponsibility.com/operating-models/#IaaS"
    },
    {
      "id": "srf.role.agentic-platform-provider",
      "name": "Agentic Platform & Framework Providers",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#agentic-platform-provider"
    },
    {
      "id": "srf.role.ai-model-serving",
      "name": "AI Model Serving",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#ai-model-serving"
    },
    {
      "id": "srf.role.ai-platform-provider",
      "name": "AI Platform Provider",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#ai-platform-provider"
    },
    {
      "id": "srf.role.ai-system-governance",
      "name": "AI System Governance",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#ai-system-governance"
    },
    {
      "id": "srf.role.ai-system-users",
      "name": "AI System Users",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#ai-system-users"
    },
    {
      "id": "srf.role.application-developer",
      "name": "Application Developer",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#application-developer"
    },
    {
      "id": "srf.role.clinical-ai-governance",
      "name": "Clinical AI Governance",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/healthcare/controls/"
    },
    {
      "id": "srf.role.clinical-application-developer",
      "name": "Clinical Application Developer",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/healthcare/controls/"
    },
    {
      "id": "srf.role.clinical-data-steward",
      "name": "Clinical Data Steward",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/healthcare/controls/"
    },
    {
      "id": "srf.role.consortium-core-coordinator",
      "name": "Consortium Core Coordinator",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#consortium-core-coordinator"
    },
    {
      "id": "srf.role.data-provider",
      "name": "Data Provider",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#data-provider"
    },
    {
      "id": "srf.role.health-platform-provider",
      "name": "Health Platform Provider",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/healthcare/controls/"
    },
    {
      "id": "srf.role.model-provider",
      "name": "Model Provider",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#model-provider"
    },
    {
      "id": "srf.role.sovereign-participant-node",
      "name": "Sovereign Participant Node",
      "type": "role",
      "subtype": "persona",
      "url": "https://aisharedresponsibility.com/personas/#sovereign-participant-node"
    },
    {
      "id": "srf.vertical.defense",
      "name": "Defense",
      "type": "concept",
      "subtype": "vertical",
      "url": "https://aisharedresponsibility.com/defense/"
    },
    {
      "id": "srf.vertical.finance",
      "name": "Finance",
      "type": "concept",
      "subtype": "vertical",
      "url": "https://aisharedresponsibility.com/finance/"
    },
    {
      "id": "srf.vertical.healthcare",
      "name": "Healthcare",
      "type": "concept",
      "subtype": "vertical",
      "url": "https://aisharedresponsibility.com/healthcare/"
    },
    {
      "id": "srf.vertical.insurance",
      "name": "Insurance",
      "type": "concept",
      "subtype": "vertical",
      "url": "https://aisharedresponsibility.com/insurance/"
    },
    {
      "id": "srf.vertical.manufacturing",
      "name": "Manufacturing",
      "type": "concept",
      "subtype": "vertical",
      "url": "https://aisharedresponsibility.com/manufacturing/"
    },
    {
      "id": "srf.vertical.public-sector",
      "name": "Public Sector",
      "type": "concept",
      "subtype": "vertical",
      "url": "https://aisharedresponsibility.com/public-sector/"
    }
  ],
  "glossary_xref": [
    {
      "anchor": "layer",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#layer",
      "canonical_id": "srf.concept.layer"
    },
    {
      "anchor": "L1",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#L1",
      "canonical_id": "srf.layer.L1"
    },
    {
      "anchor": "L2",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#L2",
      "canonical_id": "srf.layer.L2"
    },
    {
      "anchor": "L3",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#L3",
      "canonical_id": "srf.layer.L3"
    },
    {
      "anchor": "L4",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#L4",
      "canonical_id": "srf.layer.L4"
    },
    {
      "anchor": "L5",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#L5",
      "canonical_id": "srf.layer.L5"
    },
    {
      "anchor": "persona",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persona",
      "canonical_id": "srf.concept.persona"
    },
    {
      "anchor": "operating-model",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#operating-model",
      "canonical_id": "srf.concept.operating-model"
    },
    {
      "anchor": "accountability",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#accountability",
      "canonical_id": "srf.concept.accountability"
    },
    {
      "anchor": "accountable-party",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#accountable-party",
      "canonical_id": "srf.concept.accountable-party"
    },
    {
      "anchor": "responsibility-cascade",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#responsibility-cascade",
      "canonical_id": "srf.concept.responsibility-cascade"
    },
    {
      "anchor": "shared-responsibility",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#shared-responsibility",
      "canonical_id": "srf.concept.shared-responsibility"
    },
    {
      "anchor": "raci",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#raci",
      "canonical_id": "srf.concept.raci"
    },
    {
      "anchor": "AI-SaaS",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#AI-SaaS",
      "canonical_id": "srf.opmodel.ai-saas"
    },
    {
      "anchor": "AI-PaaS",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#AI-PaaS",
      "canonical_id": "srf.opmodel.ai-paas"
    },
    {
      "anchor": "Agent-PaaS",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#Agent-PaaS",
      "canonical_id": "srf.opmodel.agent-paas"
    },
    {
      "anchor": "IaaS",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#IaaS",
      "canonical_id": "srf.opmodel.iaas"
    },
    {
      "anchor": "autonomy-level",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#autonomy-level",
      "canonical_id": "srf.concept.autonomy-level"
    },
    {
      "anchor": "human-override-tier",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#human-override-tier",
      "canonical_id": "srf.concept.human-override-tier"
    },
    {
      "anchor": "agentic-system",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#agentic-system",
      "canonical_id": "srf.concept.agentic-system"
    },
    {
      "anchor": "accountability-continuity",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#accountability-continuity",
      "canonical_id": "srf.concept.accountability-continuity"
    },
    {
      "anchor": "agent-replication",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#agent-replication",
      "canonical_id": "srf.concept.agent-replication"
    },
    {
      "anchor": "fail-closed-override",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#fail-closed-override",
      "canonical_id": "srf.concept.fail-closed-override"
    },
    {
      "anchor": "persistence-scope",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persistence-scope",
      "canonical_id": "srf.concept.persistence-scope"
    },
    {
      "anchor": "enforcement-plane",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#enforcement-plane",
      "canonical_id": "srf.concept.enforcement-plane"
    },
    {
      "anchor": "protocol-independent-evidence",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#protocol-independent-evidence",
      "canonical_id": "srf.concept.protocol-independent-evidence"
    },
    {
      "anchor": "control",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#control",
      "canonical_id": "srf.concept.control"
    },
    {
      "anchor": "evidence-threshold",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#evidence-threshold",
      "canonical_id": "srf.concept.evidence-threshold"
    },
    {
      "anchor": "ocsf",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#ocsf",
      "canonical_id": "srf.concept.ocsf"
    },
    {
      "anchor": "control-schema",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#control-schema",
      "canonical_id": "srf.concept.control-schema"
    },
    {
      "anchor": "persona-ai-system-governance",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persona-ai-system-governance",
      "canonical_id": "srf.role.ai-system-governance"
    },
    {
      "anchor": "persona-data-provider",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persona-data-provider",
      "canonical_id": "srf.role.data-provider"
    },
    {
      "anchor": "persona-application-developer",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persona-application-developer",
      "canonical_id": "srf.role.application-developer"
    },
    {
      "anchor": "persona-agentic-platform-provider",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persona-agentic-platform-provider",
      "canonical_id": "srf.role.agentic-platform-provider"
    },
    {
      "anchor": "persona-ai-platform-provider",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persona-ai-platform-provider",
      "canonical_id": "srf.role.ai-platform-provider"
    },
    {
      "anchor": "persona-model-provider",
      "anchor_url": "https://aisharedresponsibility.com/glossary/#persona-model-provider",
      "canonical_id": "srf.role.model-provider"
    }
  ]
}