The Unified Control Framework: Establishing a Common Foundation for Enterprise AI Governance, Risk Management and Regulatory Compliance

TL;DR

The paper tackles fragmentation in enterprise AI governance by introducing the Unified Control Framework (UCF), a unifying approach that combines a synthesized risk taxonomy, a policy requirements library derived from regulations, and a parsimonious 42-control library with concrete implementation guidance. It establishes bidirectional mappings among risks, policy requirements, and controls to enable efficient, scalable governance that covers both risk mitigation and regulatory compliance, validated through a Colorado AI Act mapping. Methodologically, it develops the risk taxonomy from existing frameworks using a MECE structure and augments it with expert interviews and NLP-assisted synthesis, then iteratively synthesizes and codifies controls with detailed configurations and implementation guidance. The UCF aims to reduce governance duplication, enhance coverage, and provide a foundation for automation, ultimately supporting responsible AI governance without hampering innovation speed.

Abstract

The rapid adoption of AI systems presents enterprises with a dual challenge: accelerating innovation while ensuring responsible governance. Current AI governance approaches suffer from fragmentation, with risk management frameworks that focus on isolated domains, regulations that vary across jurisdictions despite conceptual alignment, and high-level standards lacking concrete implementation guidance. This fragmentation increases governance costs and creates a false dichotomy between innovation and responsibility. We propose the Unified Control Framework (UCF): a comprehensive governance approach that integrates risk management and regulatory compliance through a unified set of controls. The UCF consists of three key components: (1) a comprehensive risk taxonomy synthesizing organizational and societal risks, (2) structured policy requirements derived from regulations, and (3) a parsimonious set of 42 controls that simultaneously address multiple risk scenarios and compliance requirements. We validate the UCF by mapping it to the Colorado AI Act, demonstrating how our approach enables efficient, adaptable governance that scales across regulations while providing concrete implementation guidance. The UCF reduces duplication of effort, ensures comprehensive coverage, and provides a foundation for automation, enabling organizations to achieve responsible AI governance without sacrificing innovation speed.

Figures (4)

• Figure 1: The unified control framework establishes bidirectional mappings between policy requirements, risk scenarios, and controls. (Left) The policy requirements Library contains structured requirements derived from regulations and organizational policies, while the risk taxonomy organizes scenarios into hierarchical categories (e.g., Malicious Use, Privacy). (Right) The unified control library houses implementable controls with detailed specifications, each potentially satisfying multiple policy requirements and mitigating multiple risks. (Center) The governance context determines how these controls should be configured based on the specific combination of applicable regulations and identified risks.
• Figure 2: Simplified implementation guidance for establishing AI system access controls (CONTROL-001). This example showcases a simplified version of the implementation guidance associated with each control. In realistic execution the implementation guidance contains lengthier description of the required actions, potentially including code-snippets.
• Figure 3: Interactive visualization of our Unified Control Framework (UCF) revealing the interconnected nature of AI governance requirements. (a) Circles represent controls (sized by their connection count and with colored outlines reflecting related risks), pentagons indicate policy requirements, and colored squares denote different risk types (e.g., Privacy, Fairness & Bias, Human-AI Interaction). The force-directed layout dynamically positions elements based on their relationships, surfacing emergent clusters and highlighting how individual controls often serve multiple governance purposes. (b) Detailed view of one control which highlights its particular connections and provides a tooltip of the node. (c) The list of controls, risk scenarios and policy requirements are viewable in list view from panels on the side. The visualization can be directly interacted with at https://facct2025-submission.netlify.app/, which showcases a subset of the UCF's components and relationships.
• Figure 4: Example risk scenario showing the detailed structure of our risk taxonomy. Each risk scenario contains multiple components that help organizations understand and assess the risk.