Which controls apply, where, and whether they are working.
The Control Matrix lists the controls that apply to your AI use and whether each is working, generated from the record. It is part of every Evidence Pack.
Controls are described in policy and rarely tested against what happens.
You cannot tell the board which controls are working, and the auditor will ask.
of employers have an AI policy at all
CIPD, 2026The benefits of Control Matrix.
The people who feel the problem first.
Show control status.
A starting point for testing.
Confidence the controls are real.
Three ways teams use Control Matrix.
See which controls are working and which are not.
Show control status in a single table.
Prioritise the controls that need work.
Works best alongside.
Register, data-flow map, control matrix and exception log, generated from the record.
See Evidence Packs Compliance MappingControls mapped to ISO/IEC 42001, UK GDPR, DUAA, SOC 2, Cyber Essentials.
See Compliance Mapping Exception LogEvery breach, block and override, with who owned it.
See Exception Log All of EvidenceA record of what AI saw, produced and who approved it, with reports against the regulations and your policies. Used with Guard.
See the Evidence modulePrices are indicative ranges, confirmed in writing before you commit. Estimates are replaced by your own figures once your health check runs.
How the supporting tools fit together
GenWA Frame brings together your policies, business knowledge and our methodology to guide the work.
The Log records what connected AI saw, produced and who approved it.
The Intelligence Layer is being built to turn those records into trends and answers linked to their source. We agree which tools are available and appropriate for your engagement.
Find out more about the GenWA FrameSee Control Matrix working on your business.
Start with a health check. Agree the scope, fees and next steps with us.