Free evidence and action summary
Cloud AI Control-to-Evidence Mapper
Cloud settings are one part of an AI control record. Use this mapper to document the implementation evidence and the organisational decisions that sit around a deployment.
The tool does not inspect cloud accounts or verify your entries. An evidence summary is a starting point for a scoped review.
Last reviewed: . Source basis: ACT evidence prompts v1.1 and the primary references below. Review date means editorial review, not verified controls.
Start with one deployment
Choose the cloud used by the deployment, record the evidence and assign unresolved items. Start with unknown when the answer is not established. Review supplier and application behaviour separately from the underlying cloud provider. The actual service, feature, region, contract and configuration determine which evidence applies.
The ten topics cover ownership, identity, action limits, MCP isolation, untrusted content, personal data, supplier evidence, human review, containment and executive oversight. The six supplier checks support procurement follow-up. They do not establish contract enforceability or regulatory compliance.
Use non-sensitive references only. Do not enter credentials, personal data or raw evidence. Keep the underlying records in your organisation's approved systems. This page loads Google Fonts. See the website privacy information.
Entries are held in this open page until reset or reload. Use an explicit export to retain a copy. Changing the cloud selects a separate response set for the same system. Use New system assessment to clear all clouds before recording a different system.
Loading the evidence prompts…
Assessment scope
The system reference is locked after starting. A different system requires a new assessment.
Switching cloud changes the response set shown. It does not copy responses from another cloud.
Reset current cloud clears only its ten controls and six supplier responses. New system assessment clears all three clouds and the system reference.
Full evidence and action summary
Assessed system: Not started. Assessed cloud: AWS.
Every result requires a human decision. Critical labels are conservative ACT design choices, not universal legal requirements. A critical gap overrides completed records.
Export and print include all ten control topics and six supplier checks for the selected cloud, including rows hidden by a filter. Review your entries before sharing.
Turn follow-up into an owned record
ACT: AI Controls Toolkit contains eleven editable files across eight workflow areas. These records can help organise the evidence and decisions identified here. Purchasing a toolkit does not resolve a control gap.
Source basis and limits
This is an evidence crosswalk, not a clause-level ISO mapping or a legal determination. It provides no deployment approval, readiness percentage or proof of signed or enforceable terms. Provider-specific commands and configuration recipes are outside this mapper. Use the current documentation for the actual services and settings in scope.
- NIST AI RMF Playbook: framework-owner reference for contextual risk-management actions.
- AWS ECS task definition deregistration: service documentation for checking the boundaries of a proposed stop procedure.
- AWS Budgets: service documentation to review alongside application-level action limits.
- Microsoft data privacy documentation: feature and service context for data-handling review.
- ICO storage limitation guidance: UK privacy guidance for purpose-specific retention review.
Source links support a review process. They do not verify your deployment, evidence, contractual terms or legal position.