CGRCC RegistryCommon rules. Traceable control.
Common Governance Rules, Controls & Compliance.
Explore the rule, inspect its source, and build a policy contract.
413 matching identities · versions and original source wording retained
CATALOG / REFERENCEPerform required security assessments
Existing AIR catalogCovered GenAI service providers must perform required security assessments.
Report unlawful content to competent authorities
Existing AIR catalogCovered GenAI service providers must report unlawful content to competent authorities.
Protect against solely automated significant decisions
Existing AIR catalogData controllers must protect against solely automated significant decisions.
Improve accuracy of generated content
Existing AIR catalogCovered GenAI service providers must improve accuracy of generated content.
Examine possible biases in datasets
Existing AIR catalogHigh-risk AI providers must examine possible biases in datasets.
Integrate continual improvements into AI updates
Existing AIR catalogAI governance owners should integrate continual improvements into AI updates.
Include diverse perspectives in AI risk decisions
Existing AIR catalogAI governance owners should include diverse perspectives in AI risk decisions.
Erase personal data when required
Existing AIR catalogData controllers must erase personal data when required.
Achieve appropriate AI accuracy
Existing AIR catalogHigh-risk AI providers must achieve appropriate AI accuracy.
Enable oversight personnel to interrupt high-risk AI
Existing AIR catalogHigh-risk AI providers must enable oversight personnel to interrupt high-risk AI.
Establish transparent AI risk-management procedures
Existing AIR catalogAI governance owners should establish transparent AI risk-management procedures.
Plan periodic AI risk-management reviews
Existing AIR catalogAI governance owners should plan periodic AI risk-management reviews.
Update published algorithmic impact assessments
Existing AIR catalogResponsible senior federal officials must update published algorithmic impact assessments.
Evaluate data-labeling quality
Existing AIR catalogCovered GenAI service providers must evaluate data-labeling quality.
Establish a safety-first AI development culture
Existing AIR catalogAI governance owners should establish a safety-first AI development culture.
Ensure dataset representativeness
Existing AIR catalogHigh-risk AI providers must ensure dataset representativeness.
Covered AI information systems must receive agency authorization before deployment.
Existing AIR catalogCovered AI information system must receive authorization to operate.
Plan responses to high-priority AI risks
Existing AIR catalogAI governance owners should plan responses to high-priority AI risks.
Retain rights to test proprietary decision software
Existing AIR catalogResponsible senior federal officials must retain rights to test proprietary decision software.
Provide meaningful explanations of decisions
Existing AIR catalogResponsible senior federal officials must provide meaningful explanations of decisions.
Publish an algorithmic impact assessment
Existing AIR catalogResponsible senior federal officials must publish an algorithmic impact assessment.
Determine risk-management effort based on risk tolerance
Existing AIR catalogAI governance owners should determine risk-management effort based on risk tolerance.
Avoid prohibited special-category processing
Existing AIR catalogData controllers must avoid prohibited special-category processing.
Improve training-data quality
Existing AIR catalogCovered GenAI service providers must improve training-data quality.
Do not base academic or grading decisions solely on AI-detection output.
Existing AIR catalogInstructors should-not rely detector output.
Prevent minors from overreliance on GenAI
Existing AIR catalogCovered GenAI service providers must prevent minors from overreliance on GenAI.
Retain automatically generated logs under their control
Existing AIR catalogHigh-risk AI providers must retain automatically generated logs under their control.
Use town credentials for official approved-tool access.
Existing AIR catalogUsers must use town credentials.
Chief AI Officers must annually certify that each minimum-practice waiver remains valid.
Existing AIR catalogChief AI Officer must certify waiver continuing validity.
Organizations should inventory categories of people whose data they process.
Existing AIR catalogOrganization should inventory affected person categories.
Label generated images and videos
Existing AIR catalogCovered GenAI service providers must label generated images and videos.
Monitor AI operation in accordance with instructions
Existing AIR catalogHigh-risk AI deployers must monitor AI operation in accordance with instructions.
Covered agencies must update procurement procedures to include the required LLM terms.
Existing AIR catalogCovered agency must update LLM procurement procedures.
Establish complaint and reporting channels
Existing AIR catalogCovered GenAI service providers must establish complaint and reporting channels.
Establish a lawful basis for training on personal information
Existing AIR catalogCovered GenAI service providers must establish a lawful basis for training on personal information.
Organizations should generate log records for continuous monitoring.
Existing AIR catalogOrganization should generate monitoring log records.
Consult IT Services before using MSU credentials for AI products, including free tools.
Existing AIR catalogUsers must consult IT Services.
Define the business value of AI use
Existing AIR catalogAI governance owners should define the business value of AI use.
Organizations should prevent nonprivileged users from performing privileged functions.
Existing AIR catalogOrganization should prevent nonprivileged execution of privileged functions.
Assign executive accountability for AI risk decisions
Existing AIR catalogAI governance owners should assign executive accountability for AI risk decisions.
Workbook entries are extracted templates and proposals. Source mappings support review; they do not establish legal applicability, organizational adoption or working enforcement. Test definitions have not been executed.
Download database schema · Workbook reconciliation · Policy and scoring reconciliation · Methodology
CGRCC connects common intent to source-specific obligations, local policy contracts and evidence. Your existing AIR links and exports continue to work.