Generative AI Deployment Configuration Checklist

Verifies tenant settings, data retention, access scopes and logging before an AI service goes live.

Available soon

Format: Excel
Size: 81 KB
Length: 10 sheets
Version: 1.0
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Complete one copy of the Checklist sheet for each feature, with the application developer and the head of it (LLM Application Security Review Procedure, stage RP-3). To make a copy, right-click the tab, choose Move or Copy, tick Create a copy, and name the copy. Each copy calculates on its own.
2	Read the Checks Explained sheet once. It groups the checks by area, names the requirement and the threats behind each, and says what kinds of evidence are enough.
3	Answer the three questions under "This feature". They say whether the feature reads stored company content, has tools or connectors, and is hosted or built by you. The Applies? column then marks each check Yes or No. Do not mark a check Not applicable because it is hard or slow to verify.
4	For each check that applies, look at the setting, the contract term or the test result yourself. Choose the Status: Verified, Not verified, Failed or Not applicable. The Definitions sheet says what each means. Verified needs evidence and a date.
5	Write the evidence you hold in the Evidence kept column, the date you saw it and who looked. A provider's page or statement counts as evidence if you say so and date it.
6	Write a note for any check that is Not verified, Failed or Not applicable. For a Failed check, rate it, enter it in the AI Security Findings & Exceptions Register and write its number in the Finding column. The Check column tells you what is still missing on each row.
7	Read the counts at the top. They show how many applicable checks are verified, failed and not verified, area by area, and name each one. They also list the checks that hold the release and say what that means for the release decision.
8	Give the result to the people who decide the release (LLM Application Security Review Procedure, stage RP-6). The checklist is one item of the evidence (E-4). It does not decide anything by itself.
9	Repeat the checks after any change of model, model version, system prompt, tool, retrieval source or filter setting (GS-18), and at the review interval of the feature's depth. A feature has two review dates: the one this review sets from its depth, and the one in its P24 inventory entry. The earlier of the two applies. Keep each completed copy.
10	Add checks of your own on the yellow rows at the foot of the table. They are counted on their own line and do not change the pack's counts or the release line.
11	To clear the EXAMPLE, delete the EXAMPLE Checklist sheet. The Checklist sheet is already blank. The checks stay: they are the pack's list.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

GS-18: A change of model, model version, system prompt, tool, retrieval source or filter setting is a change: it goes through the change control that applies to the system, the attack classes it could affect are tested again at the feature's review depth, and the change is recorded. A provider's change of model is a trigger for review within [[10]] working days of the notice (P24 ST-7; AG-10).

GS-29: The owner keeps for each feature the data flow, the threat selection, the standard check, the configuration checklist, the test results, the findings and exceptions, and the approval, while the feature runs and for [[3]] years after it ends, or longer where law or a contract asks.

RG-2: No configuration check that blocks release has failed or is unverified.

Why a checklist. An LLM application puts instructions and data in one channel. The model reads the organisation's instructions and an attacker's words as the same kind of thing, so the checks that work for ordinary input, such as matching a field against a pattern, cannot tell them apart. The national cyber centres and OWASP both say the defence lies in the system around the model, because the model will sometimes be fooled. Everything the organisation already does for access, logging, secure development, patching and supplier assurance still applies and is not repeated here. This pack adds what is specific: what the model may read, what its output may reach, what it may do, who approves what it does, and how the organisation tests all of this before release and watches it afterwards. The result is counts of features reviewed, checks verified and findings open. It is never one score.

The rules on which AI may be used, with which data, who approves a use and how a use is recorded are P24's (AG-01 to AG-22). This pack does not change them. It sets what a generative AI feature has to do to be secure once a use is approved, and what the organisation checks before the feature goes live and while it runs.

This document helps you secure the generative AI your organisation builds, configures or buys. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. A test that finds no problem does not show that a feature is secure. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts: confirm it with counsel.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. The EXAMPLE Checklist sheet shows its checklist for the draft and summarise with the office-suite assistant (LF-1). Its settings, evidence and dates are the pack's other documents' for it.

Adapting this template.

Small organisation: most of your features are a supplier's, so most checks you can see are in the tenant settings. Keep every check. Where the tenant cannot show a setting, ask the provider in writing, mark the check Not verified until the answer arrives, and keep the answer as evidence.

Regulated organisation: your regulator or your customers may ask for more settings, or for the evidence for longer. Add your own checks on the yellow rows, and keep the completed copies for the period your records policy sets (GS-29).

IT run by a service provider or outsourced: the provider can supply the evidence, and your own staff check it. The checks and the release decision stay yours. Ask for a snapshot of the settings as found before the provider changes any of them.

Larger group: copy the sheet for each feature and each environment that differs. Keep the count for each copy apart, and never add the counts of different features into one total.

This workbook is your own record. Keep it with the feature's review evidence.

Checklist

Configuration checks: [[feature name]]

One copy of this sheet for each feature. Yellow cells are yours. Applies?, Status now, every count, the release line and the Check column calculate. Counts only, never a score.

This feature

Feature	[[Name of the feature]]
AI inventory entry (P24)	[[AI-nnn]]
Does the feature read stored company content (documents, a search index, a knowledge store)?		Your answers decide which checks apply (Checks Explained sheet).
Does the feature have tools or connectors (it can read other systems or act)?
Do you host or build the feature and hold its keys and network settings?
Date the checklist was started	[[YYYY-MM-DD]]
Completed with (Head of IT)	[[Head of IT: name]]

Where the checks stand

Checks verified (of those that apply)			Fill your profile first
Checks failed
Checks not verified
Checks that hold the release and are not verified or failed (RG-2)
What this does to the release decision
Your own checks (counted on their own)			None added

By area

Area	Checks	Verified of those that apply
Tenant and identity	4	None apply
Data and retention	5	None apply
Access scopes	5	None apply
Logging	4	None apply
Network and keys	3	None apply
Content filters	3	None apply
Rate limits	3	None apply
Model and change	2	None apply
Stop	1	None apply
All 30 checks of the pack	30	None apply
Your own checks	0	None apply

Counts of checks, never a share. A check of your own is in the last row only, and in no area above.

The checks, DC-01 to DC-30

ID	Area	Check	Holds the release?	Applies?	Status now	Check	Applies when	Requirement	Reference
DC-01	Tenant and identity	Staff reach the feature only with their work account through single sign-on. Personal and guest accounts cannot.	Yes	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-23	P24 BC-1; P13 JML-12
DC-02	Tenant and identity	Administrator roles for the AI service are held by named people with phishing-resistant sign-in, and are reviewed.	Yes	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-23	P14 PA-05, PA-16
DC-03	Tenant and identity	Sharing of prompts, chats, files and custom assistants outside the organisation is off, or limited to a listed set.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-08
DC-04	Tenant and identity	The setting or contract term that bars the provider from training on the organisation's data is on and evidenced.	Yes	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-17	P24 BC-2, ST-1
DC-05	Data and retention	Retention of prompts, outputs and uploaded files is set to the period the owner recorded, and users can delete their history as the owner decided.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-08	GDPR Article 25(2)
DC-06	Data and retention	The data location is the one the contract names, and the provider's own page agrees.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-17	P24 ST-4; P06 clause CL-05
DC-07	Data and retention	The feature takes no data above the level it is approved for, and sensitivity labels are respected where the provider supports them.	Yes	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-08	P24 A07 (the data permission check)
DC-08	Data and retention	Every source the feature can read has an owner and a data level, and the feature reads only what the signed-in person may read.	Yes	Fill your profile	Fill your profile	Fill your profile	The feature reads stored company content	GS-09
DC-09	Data and retention	A document removed from a source disappears from the feature's index within the time the owner set.	No	Fill your profile	Fill your profile	Fill your profile	The feature reads stored company content	GS-12
DC-10	Access scopes	Connectors, plug-ins and extensions are on an approved list, and all others are off by default.	Yes	Fill your profile	Fill your profile	Fill your profile	The feature has tools or connectors	GS-22
DC-11	Access scopes	Each connector holds the least scope its job needs, read-only where the job only reads.	Yes	Fill your profile	Fill your profile	Fill your profile	The feature has tools or connectors	GS-23
DC-12	Access scopes	Each key or service account serves one feature in one environment, sits in a secrets store, and appears in no code, prompt or tool description.	Yes	Fill your profile	Fill your profile	Fill your profile	You host or build the feature and hold its keys	GS-10	P14 PA-10
DC-13	Access scopes	Web browsing, code execution and file creation inside the feature are off unless the approval lists them.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-22
DC-14	Access scopes	Tools run as the signed-in person or under a named service identity with the least access, and the identity is on the privileged and service account inventory.	Yes	Fill your profile	Fill your profile	Fill your profile	The feature has tools or connectors	GS-23	P14 PA-11
DC-15	Logging	Audit logs of prompts, outputs and administrator actions are on and reach the log store, or the provider's export is scheduled.	Yes	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-19
DC-16	Logging	Every tool call is logged with its arguments and result.	Yes	Fill your profile	Fill your profile	Fill your profile	The feature has tools or connectors	GS-19
DC-17	Logging	Access to the logs is limited to named roles, and secrets are removed before logs are stored.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-19
DC-18	Logging	Alerts for the signals AS-01 to AS-12 that the feature can raise are set and go to a named person.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-20
DC-19	Network and keys	The runtime and any sandbox reach only the addresses on an allow list, and no internal network by default.	Yes	Fill your profile	Fill your profile	Fill your profile	You host or build the feature and hold its keys	GS-22
DC-20	Network and keys	Inbound access to the feature's endpoint is limited to the application or a listed network.	No	Fill your profile	Fill your profile	Fill your profile	You host or build the feature and hold its keys	GS-23
DC-21	Network and keys	The rotation date of each key is recorded, and revoking a key was tested.	No	Fill your profile	Fill your profile	Fill your profile	You host or build the feature and hold its keys	GS-10
DC-22	Content filters	The provider's content and safety filters are on at the level the owner chose, and only named administrators can change them.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-04
DC-23	Content filters	Input filtering (hidden characters, size, type) and output checks (schema, encoding, addresses) are in application code.	Yes	Fill your profile	Fill your profile	Fill your profile	You host or build the feature and hold its keys	GS-06
DC-24	Content filters	The screen or message that shows output does not fetch addresses the output names, where the organisation controls this.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-07
DC-25	Rate limits	Limits per person and per feature on requests and tokens are set.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-21
DC-26	Rate limits	A hard spending cap stops use when it is reached.	No	Fill your profile	Fill your profile	Fill your profile	You host or build the feature and hold its keys	GS-21
DC-27	Rate limits	A cap on steps and tool calls in one task is set.	No	Fill your profile	Fill your profile	Fill your profile	The feature has tools or connectors	GS-21
DC-28	Model and change	The model and version in use are recorded, and the provider's route for notice of changes is known.	No	Fill your profile	Fill your profile	Fill your profile	Every feature	GS-18	P24 ST-7
DC-29	Model and change	The system prompt and tool descriptions are under version control with an owner.	No	Fill your profile	Fill your profile	Fill your profile	You host or build the feature and hold its keys	GS-18
DC-30	Stop	A feature that can act (send, change records, run commands or spend) has a switch-off that works in one step, revokes keys and tool access, and was tested. Where no tool can act, enter that as the evidence.	Yes	Fill your profile	Fill your profile	Fill your profile	The feature has tools or connectors	GS-26

Sign-off

Role	Name	Date	Signature or reference
Completed by (Application developer)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Accountable (Head of IT)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Reviewed (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Next check due	[[After any change of model, prompt, tool, source or filter (GS-18), and by the earlier of the date the feature's depth sets and the review date in its P24 entry]]	[[YYYY-MM-DD]]	[[Reference]]

EXAMPLE Checklist

EXAMPLE: Draft and summarise with the office-suite assistant (LF-1)

a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Yellow cells are the checker's. Applies?, Status now, the counts, the release line and the Check column calculate.

This feature

Feature	Draft and summarise with the office-suite assistant
AI inventory entry (P24)	AI-001
Does the feature read stored company content (documents, a search index, a knowledge store)?	Yes	Your answers decide which checks apply (Checks Explained sheet).
Does the feature have tools or connectors (it can read other systems or act)?	No
Do you host or build the feature and hold its keys and network settings?	No
Date the checklist was started	16 Sep 2026
Completed with (Head of IT)	Head of IT

Where the checks stand

Checks verified (of those that apply)			14 of 17 applicable checks verified; 0 failed, 3 not verified
Checks failed			None
Checks not verified			DC-06, DC-09, DC-18
Checks that hold the release and are not verified or failed (RG-2)			None
What this does to the release decision			Release with conditions: some checks are not yet verified (RG-2)
Your own checks (counted on their own)			None added

By area

Area	Checks	Apply to this feature	Verified	Not verified	Not applicable	Verified of those that apply
Tenant and identity	4	4	4	0	0	4 of 4
Data and retention	5	5	3	2	0	3 of 5
Access scopes	5	1	1	0	4	1 of 1
Logging	4	3	2	1	1	2 of 3
Network and keys	3	0	0	0	3	None apply
Content filters	3	2	2	0	1	2 of 2
Rate limits	3	1	1	0	2	1 of 1
Model and change	2	1	1	0	1	1 of 1
Stop	1	0	0	0	1	None apply
All 30 checks of the pack	30	17	14	3	13	14 of 17
Your own checks	0	0	0	0	0	None apply

Counts of checks, never a share. A check of your own is in the last row only, and in no area above.

The checks, DC-01 to DC-30

ID	Area	Check	Holds the release?	Applies?	Status	Status now	Date verified	Checked by	Evidence kept	Note: what is missing or what failed	Check	Applies when	Requirement	Reference
DC-01	Tenant and identity	Staff reach the feature only with their work account through single sign-on. Personal and guest accounts cannot.	Yes	Yes	Verified	Verified	16 Sep 2026	Head of IT	Sign-in policy export		Row complete	Every feature	GS-23	P24 BC-1; P13 JML-12
DC-02	Tenant and identity	Administrator roles for the AI service are held by named people with phishing-resistant sign-in, and are reviewed.	Yes	Yes	Verified	Verified	16 Sep 2026	Head of IT	Admin role list and sign-in method		Row complete	Every feature	GS-23	P14 PA-05, PA-16
DC-03	Tenant and identity	Sharing of prompts, chats, files and custom assistants outside the organisation is off, or limited to a listed set.	No	Yes	Verified	Verified	16 Sep 2026	Head of IT	Tenant sharing setting screenshot		Row complete	Every feature	GS-08
DC-04	Tenant and identity	The setting or contract term that bars the provider from training on the organisation's data is on and evidenced.	Yes	Yes	Verified	Verified	16 Sep 2026	Head of IT	Provider's statement of 5 Aug 2026 and tenant setting		Row complete	Every feature	GS-17	P24 BC-2, ST-1
DC-05	Data and retention	Retention of prompts, outputs and uploaded files is set to the period the owner recorded, and users can delete their history as the owner decided.	No	Yes	Verified	Verified	16 Sep 2026	Head of IT	Retention policy screenshot		Row complete	Every feature	GS-08	GDPR Article 25(2)
DC-06	Data and retention	The data location is the one the contract names, and the provider's own page agrees.	No	Yes	Not verified	Not verified				The provider's page names a region; the contract schedule is awaited.	Row complete	Every feature	GS-17	P24 ST-4; P06 clause CL-05
DC-07	Data and retention	The feature takes no data above the level it is approved for, and sensitivity labels are respected where the provider supports them.	Yes	Yes	Verified	Verified	16 Sep 2026	Head of IT	T-01 approval conditions		Row complete	Every feature	GS-08	P24 A07 (the data permission check)
DC-08	Data and retention	Every source the feature can read has an owner and a data level, and the feature reads only what the signed-in person may read.	Yes	Yes	Verified	Verified	17 Sep 2026	Head of IT	Test with two accounts: each saw only its own files		Row complete	The feature reads stored company content	GS-09
DC-09	Data and retention	A document removed from a source disappears from the feature's index within the time the owner set.	No	Yes	Not verified	Not verified				The time to remove a deleted document from the index is not stated by the provider.	Row complete	The feature reads stored company content	GS-12
DC-10	Access scopes	Connectors, plug-ins and extensions are on an approved list, and all others are off by default.	Yes	No		Not applicable					Not for this feature	The feature has tools or connectors	GS-22
DC-11	Access scopes	Each connector holds the least scope its job needs, read-only where the job only reads.	Yes	No		Not applicable					Not for this feature	The feature has tools or connectors	GS-23
DC-12	Access scopes	Each key or service account serves one feature in one environment, sits in a secrets store, and appears in no code, prompt or tool description.	Yes	No		Not applicable					Not for this feature	You host or build the feature and hold its keys	GS-10	P14 PA-10
DC-13	Access scopes	Web browsing, code execution and file creation inside the feature are off unless the approval lists them.	No	Yes	Verified	Verified	16 Sep 2026	Head of IT	Feature switches screenshot		Row complete	Every feature	GS-22
DC-14	Access scopes	Tools run as the signed-in person or under a named service identity with the least access, and the identity is on the privileged and service account inventory.	Yes	No		Not applicable					Not for this feature	The feature has tools or connectors	GS-23	P14 PA-11
DC-15	Logging	Audit logs of prompts, outputs and administrator actions are on and reach the log store, or the provider's export is scheduled.	Yes	Yes	Verified	Verified	16 Sep 2026	Head of IT	Audit log export schedule		Row complete	Every feature	GS-19
DC-16	Logging	Every tool call is logged with its arguments and result.	Yes	No		Not applicable					Not for this feature	The feature has tools or connectors	GS-19
DC-17	Logging	Access to the logs is limited to named roles, and secrets are removed before logs are stored.	No	Yes	Verified	Verified	16 Sep 2026	Head of IT	Log access list		Row complete	Every feature	GS-19
DC-18	Logging	Alerts for the signals AS-01 to AS-12 that the feature can raise are set and go to a named person.	No	Yes	Not verified	Not verified				Alert rules for AS-01 to AS-12 are being written.	Row complete	Every feature	GS-20
DC-19	Network and keys	The runtime and any sandbox reach only the addresses on an allow list, and no internal network by default.	Yes	No		Not applicable					Not for this feature	You host or build the feature and hold its keys	GS-22
DC-20	Network and keys	Inbound access to the feature's endpoint is limited to the application or a listed network.	No	No		Not applicable					Not for this feature	You host or build the feature and hold its keys	GS-23
DC-21	Network and keys	The rotation date of each key is recorded, and revoking a key was tested.	No	No		Not applicable					Not for this feature	You host or build the feature and hold its keys	GS-10
DC-22	Content filters	The provider's content and safety filters are on at the level the owner chose, and only named administrators can change them.	No	Yes	Verified	Verified	16 Sep 2026	Head of IT	Filter setting		Row complete	Every feature	GS-04
DC-23	Content filters	Input filtering (hidden characters, size, type) and output checks (schema, encoding, addresses) are in application code.	Yes	No		Not applicable					Not for this feature	You host or build the feature and hold its keys	GS-06
DC-24	Content filters	The screen or message that shows output does not fetch addresses the output names, where the organisation controls this.	No	Yes	Verified	Verified	17 Sep 2026	Head of IT	Test: no link preview fetched		Row complete	Every feature	GS-07
DC-25	Rate limits	Limits per person and per feature on requests and tokens are set.	No	Yes	Verified	Verified	16 Sep 2026	Head of IT	Licence limits		Row complete	Every feature	GS-21
DC-26	Rate limits	A hard spending cap stops use when it is reached.	No	No		Not applicable					Not for this feature	You host or build the feature and hold its keys	GS-21
DC-27	Rate limits	A cap on steps and tool calls in one task is set.	No	No		Not applicable					Not for this feature	The feature has tools or connectors	GS-21
DC-28	Model and change	The model and version in use are recorded, and the provider's route for notice of changes is known.	No	Yes	Verified	Verified	16 Sep 2026	Head of IT	Model version note and notice route		Row complete	Every feature	GS-18	P24 ST-7
DC-29	Model and change	The system prompt and tool descriptions are under version control with an owner.	No	No		Not applicable					Not for this feature	You host or build the feature and hold its keys	GS-18
DC-30	Stop	A feature that can act (send, change records, run commands or spend) has a switch-off that works in one step, revokes keys and tool access, and was tested. Where no tool can act, enter that as the evidence.	Yes	No		Not applicable					Not for this feature	The feature has tools or connectors	GS-26

Sign-off

Role	Name	Date	Signature or reference
Completed by (Application developer)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Accountable (Head of IT)	Head of IT	[[YYYY-MM-DD]]	[[Reference]]
Reviewed (Head of Information Security)	Head of Information Security	[[YYYY-MM-DD]]	[[Reference]]
Next check due	[[After any change of model, prompt, tool, source or filter (GS-18), and by the earlier of the date the feature's depth sets and the review date in its P24 entry]]	[[YYYY-MM-DD]]	[[Reference]]

What the check found. 14 of 17 applicable checks verified; 0 failed, 3 not verified. The 3 not verified are DC-06, DC-09, DC-18. None of them holds the release, so the checklist leaves the release decision with conditions (RG-2). The decision on 25 Sep 2026 was Release with conditions: the conditions are these checks and the open finding AF-001, which has an approved exception (AI Security Findings & Exceptions Register).

The same checks on the image generator (LF-2) give 13 of 15 applicable checks verified; 0 failed, 2 not verified. The two not verified are DC-05 and DC-06: both wait for the provider. Across the two live features, 27 of 32 applicable checks are verified. That is the measure GM-02.

The chatbot (LF-3) is held under P24, so its checklist is not started. Its profile (tools, no stored company content, hosted by the provider) makes 21 checks apply. Until they are run, the sheet would read 0 of 21 applicable checks verified; 0 failed, 21 not verified.

A verified check is a setting you have seen. It is not a test of the feature. The review procedure and the red team plan test the feature. This checklist makes sure the settings that test relies on are the settings the feature runs with.

Checks Explained

What each area is for, what stands behind it and what to keep

Each row is one area of the checks. The Generative AI Security Standard gives the text of each requirement, and the LLM Application Threat Catalogue describes each threat. The documents listed here help with the work. Using one does not by itself show that a requirement is met.

The 9 areas

Area	Checks and requirements	Applies when	Threats the checks help with	Hold the release
Tenant and identity	DC-01 to DC-04 Requirements: GS-23, GS-08, GS-17	Every feature	LT-03 Sensitive information disclosure LT-04 Excessive agency LT-05 AI supply chain compromise LT-06 Data and model poisoning LT-10 Vector and embedding weaknesses	DC-01, DC-02, DC-04
Data and retention	DC-05 to DC-09 Requirements: GS-08, GS-17, GS-09, GS-12	Every feature The feature reads stored company content	LT-03 Sensitive information disclosure LT-05 AI supply chain compromise LT-06 Data and model poisoning LT-10 Vector and embedding weaknesses	DC-07, DC-08
Access scopes	DC-10 to DC-14 Requirements: GS-22, GS-23, GS-10	The feature has tools or connectors You host or build the feature and hold its keys Every feature	LT-03 Sensitive information disclosure LT-04 Excessive agency LT-09 Hidden context exposure (system prompt leakage) LT-10 Vector and embedding weaknesses LT-11 Improper output handling LT-12 Poisoned memory and tool descriptions	DC-10, DC-11, DC-12, DC-14
Logging	DC-15 to DC-18 Requirements: GS-19, GS-20	Every feature The feature has tools or connectors	LT-01 Direct prompt injection LT-02 Indirect prompt injection LT-03 Sensitive information disclosure LT-04 Excessive agency LT-06 Data and model poisoning LT-07 Unbounded consumption LT-08 Misinformation LT-09 Hidden context exposure (system prompt leakage) LT-10 Vector and embedding weaknesses LT-11 Improper output handling LT-12 Poisoned memory and tool descriptions	DC-15, DC-16
Network and keys	DC-19 to DC-21 Requirements: GS-22, GS-23, GS-10	You host or build the feature and hold its keys	LT-03 Sensitive information disclosure LT-04 Excessive agency LT-09 Hidden context exposure (system prompt leakage) LT-10 Vector and embedding weaknesses LT-11 Improper output handling LT-12 Poisoned memory and tool descriptions	DC-19
Content filters	DC-22 to DC-24 Requirements: GS-04, GS-06, GS-07	Every feature You host or build the feature and hold its keys	LT-01 Direct prompt injection LT-02 Indirect prompt injection LT-03 Sensitive information disclosure LT-04 Excessive agency LT-11 Improper output handling	DC-23
Rate limits	DC-25 to DC-27 Requirements: GS-21	Every feature You host or build the feature and hold its keys The feature has tools or connectors	LT-04 Excessive agency LT-07 Unbounded consumption	None
Model and change	DC-28 to DC-29 Requirements: GS-18	Every feature You host or build the feature and hold its keys	LT-01 Direct prompt injection LT-02 Indirect prompt injection LT-05 AI supply chain compromise LT-08 Misinformation LT-09 Hidden context exposure (system prompt leakage)	None
Stop	DC-30 to DC-30 Requirements: GS-26	The feature has tools or connectors	LT-04 Excessive agency LT-07 Unbounded consumption LT-12 Poisoned memory and tool descriptions	DC-30

What counts as evidence

Kind		When it is enough
A screenshot or export of the setting		The best evidence. It shows the setting as it stands. Put the date and the account it was taken from on it.
The contract term or the provider's written statement		Use this where the tenant cannot show the setting. Say which you hold. A provider's web page can change without notice, so date what you saw.
A test you ran		For example, sign in with two accounts and check that each sees only its own files. Write down what you did and what happened.
A log or report extract		For example the schedule of the audit log export, or an alert rule with a test alert. Date it.

The release gate

RG-2: No configuration check that blocks release has failed or is unverified. A check that holds the release and is failed or not verified holds the release. Any other check that is failed or not verified leaves the release with conditions. The decision is the approvers', recorded under P24 and the LLM Application Security Review Procedure (stage RP-6).

Where another pack owns the content

Topic	What to know
Which AI may be used	Which tools are approved, with what data, who approves a use and how it is recorded are P24's. This checklist checks the settings that make an approval true. It never grants one.
Accounts and sign-in	Single sign-on is P13's (JML-12). The inventory of privileged and service accounts is P14's (PA-10, PA-11). DC-01, DC-02, DC-12 and DC-14 check that the AI service follows them.
Contract terms	The AI terms (ST-1 to ST-8) and the P06 clauses are the contract's. DC-04 and DC-06 check that the setting matches the term. The provider's own answers are in the questionnaire.
What a verified check shows	A verified check shows a setting. It does not show that the feature resists attack. The review procedure and the red team plan test that.
A setting found changed or a leak	Take a snapshot of the settings as found before you change anything (EP-08), then report it through the incident route. P09 decides whether it is an incident.

Report an event at once through the incident route (P09 IM-01). Nobody is blamed for a report made in good faith. P09 decides whether it is an incident and whether anything must be reported, and P18's clocks apply. P09 IM-07 sets the order of containing and preserving. Where harm can still spread, such as an agent that can still act (AS-03, AS-07, AS-08) or data still leaving, contain first by switching the feature's access off, and capture what you can in the same step. Otherwise preserve the evidence first, then switch the feature off. What to keep when a signal is confirmed: A snapshot of the configuration checklist (A05) settings as found, taken before anything is changed or, where harm is still spreading, in the same step as the switch-off.

Lists

CheckStatus	YesNo	CheckArea
Verified	Yes	Tenant and identity
Not verified	No	Data and retention
Failed		Access scopes
Not applicable		Logging

Network and keys

Content filters

Rate limits

Model and change

Stop

Definitions

Definitions

Term	Meaning in this workbook
Feature	One LLM capability the organisation uses, builds or has switched on, for one purpose, with one owner. A feature is the technical view of a P24 use.
LLM application	Software that sends text, files or other content to an LLM and uses what comes back. A chat assistant, a summariser built into an office suite, a customer chatbot and an agent are all LLM applications. The inventory (P24) lists them as uses; this pack calls the part that uses the model a feature.
Tool and connector	A function the model can ask the application to run: search, read a file, send an email, run a query, run code. Also called a plugin, extension, skill or connector. A connector gives access to another system.
Retrieval	Fetching stored content, such as company documents, and adding it to the prompt so the model can use it. Often called retrieval-augmented generation.
Knowledge store	Where retrieved content and memory are kept: a search index, a vector store, a semantic cache or an agent's memory. An embedding is the numerical form of a piece of content that a vector store uses to find similar content.
Guardrail	A filter, rule or check placed around the model, on its input or output. It lowers the chance of a bad outcome. It is not a security boundary, because a determined attacker can often get round it.
Model provider	The organisation that supplies the model or the service built on it. It can be the same as the tool supplier or different (the tool supplier may use another party's model).
System prompt	The instructions the application sends to the model before the user's words. Also called hidden context, together with tool descriptions and policy text retrieved for the model. It is hidden from the user's screen and can still be read by the model, and so by a determined user.
Check	One setting to verify, DC-01 to DC-30. Each has an area, a condition for applying, a requirement it serves and a mark for whether it holds the release.
Applies?	Worked out from your three answers about the feature. A check that does not apply reads Not applicable and leaves the count.
Holds the release	A check marked Yes that is failed or not verified holds the release (RG-2). Other checks that are failed or not verified leave the release with conditions.
Verified	You have seen the setting, the contract term or the test result yourself, you hold the evidence, and you have dated it. A check marked Verified without evidence and a date counts as Not verified.
Not verified	No result yet, or the result lacks its evidence or its date. Say in the note what is missing. A check that holds the release and is in this state holds it.
Failed	You looked, and the setting is not as the check asks. Say in the note what you found. A failed check is a finding: rate it and enter it in the register, then write its number in the Finding column. A failed check that holds the release holds it.
Not applicable	The sheet works this out from the feature's profile. You may also choose it for a check that the profile says applies, if you write the reason in the note. It then leaves the count. A check marked this way without a reason counts as Not verified.
Status now	What the sheet counts. It is Not applicable where the profile says so, Verified only with evidence and a date, Failed as chosen, and Not verified otherwise.
DC-nn	One of DC-01 to DC-30: a check on this checklist.
GS-nn	A requirement in the Generative AI Security Standard. The Requirement column names the one each check serves.
Head of IT	Connects approved tools to single sign-on, applies the tool's settings and keeps the technical list of what is installed.
Application developer	Builds or configures the feature to this standard, completes the configuration checks with the IT owner, fixes findings and takes part in the review. Does not test the feature at Depth 3, and at Depth 2 is not the tester unless the review says why.
EXAMPLE	An illustration: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026, with the values the pack's other documents hold for it.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 8.9 — Configuration management	The whole checklist: the configuration of the AI service is defined, recorded, checked and reviewed
NIST CSF 2.0	PR.PS-01 — “Configuration management practices are established and applied”	The whole checklist: configuration management practices applied to the AI service
ISO/IEC 42001:2023	Annex A 4.2 — Resource documentation	Evidence kept and Date verified columns: the resources and settings of the AI system are documented
ISO/IEC 42001:2023	Annex A 9.4 — Intended use of the AI system	DC-07 and DC-13: the feature takes only the data, and has only the functions, its approval lists
EU AI Act — Regulation (EU) 2024/1689	Article 15(5) — high-risk systems “shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities”; the technical solutions for AI-specific vulnerabilities “shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws”	Content Filters, Access Scopes and Network and Keys checks: the settings that resist attempts to alter outputs or reach data. The Act states this benchmark for high-risk systems and does not bind a deployer to it
EU AI Act — Regulation (EU) 2024/1689	Article 26(6) — deployers keep the logs automatically generated by the high-risk system, to the extent the logs are under their control, “for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data”	Logging checks DC-15 to DC-18: logs kept where they are under the deployer's control
EU AI Act — Regulation (EU) 2024/1689	Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026	The dates the Act applies, as amended; cited with the Act
EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI)	Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689	The amendment to the Act, cited with the Act
GDPR — Regulation (EU) 2016/679	Article 25(2) — the controller implements measures so that, “by default, only personal data which are necessary for each specific purpose of the processing are processed”; this covers the amount collected, the extent of processing, the period of storage and accessibility, and by default personal data are not made accessible “without the individual’s intervention to an indefinite number of natural persons”	DC-05 and DC-08: by default only the personal data the purpose needs is processed, kept and made accessible
GDPR — Regulation (EU) 2016/679	Article 32(1) — appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the likelihood and severity of risk to people's rights and freedoms	Tenant and identity, access scope and logging checks: technical and organisational measures that suit the risk
GDPR — Regulation (EU) 2016/679	Article 32(2) — in assessing the appropriate level of security, account is taken of the risks presented by processing	Access scope and logging checks: risks of unauthorised disclosure of or access to personal data
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	Tenant and identity and access scope checks: access control policies
OWASP Top 10 for LLM Applications 2026	LLM02:2026 Sensitive Information Disclosure — “exposes confidential, regulated, privileged, or proprietary data through a channel the data subject, controller, or system owner did not authorize”. The channel is not only the final answer: tool-call arguments, reasoning traces, retrieved chunks, logs, telemetry and embeddings are disclosure surfaces	Data and retention and logging checks: the places data can leak (logs, caches, retrieved content)
OWASP Top 10 for LLM Applications 2026	LLM06:2026 Unbounded Consumption — “allows excessive and uncontrolled inferences, enabling attackers to disrupt service availability, inflict unsustainable financial costs, or steal intellectual property through model cloning”; the entry says request-rate limits alone are not enough and asks for token-aware limits and hard spending caps	Rate limits checks DC-25 to DC-27: limits, spending caps and caps on steps
OWASP Top 10 for LLM Applications 2026	LLM08:2026 Hidden Context Exposure (named System Prompt Leakage in the 2025 edition) — “unauthorized extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model’s context”; practitioners “should design under the assumption that hidden context is discoverable”, keep credentials out of it and not rely on it as a security boundary	DC-12 and DC-29: keys kept out of prompts and tool descriptions, and the system prompt under version control
OWASP Top 10 for LLM Applications 2026	LLM09:2026 Vector and Embedding Weaknesses — risks in any application that converts content into numerical representations and “uses similarity search to decide what the model sees”, including retrieval-augmented generation, agent memory and semantic caches; its controls start with permission and access control on the index	DC-08 and DC-09: access control and removal at the index
Guidelines for secure AI system development (NCSC, CISA and partners)	Secure operation and maintenance, “Monitor your system’s inputs” — “you monitor and log inputs to your system (such as inference requests, queries or prompts) to enable compliance obligations, audit, investigation and remediation in the case of compromise or misuse”, in line with privacy and data protection requirements	DC-15 and DC-18: inputs and outputs logged, and alerts set
NIST AI RMF 1.0	MANAGE 2.4 — “Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.”	DC-30: a switch-off that works and was tested
NIST AI RMF 1.0	MANAGE 4.1 — “Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.”	DC-15, DC-18 and DC-28: monitoring after release and change management

Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR); OWASP Top 10 for LLM Applications, 2026 edition; MITRE ATLAS 2026.09; NIST AI 600-1; NIST AI RMF 1.0; NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); as published and read on 8 October 2026

Regulation (EU) 2024/1689 binds the operators of its Article 2(1). Article 15 sets requirements for high-risk AI systems, and the provider of such a system answers for them. An organisation that uses another party’s AI system under its own authority is a deployer (Article 3(4)), and its duties are those of Article 26 and the other articles that name deployers. This pack cites Article 15 as the Act’s own statement of what security a high-risk system needs, and cites no system as high-risk. Counsel confirms the role and the category of each system.

Regulation (EU) 2016/679 binds controllers and processors. Article 25 asks the controller for data protection by design and by default, and Article 32 for security of processing that is appropriate to the risk. Both apply to an LLM application that processes personal data. Whether an organisation is a controller or a processor for a given application depends on the facts, and counsel confirms it.

OWASP, MITRE ATLAS, NIST AI 600-1, NIST SP 800-218A, the NCSC blog, the NCSC and CISA guidelines and the joint agency guidance on agents are voluntary guidance. They are not law, and none of them says what the AI Act or the GDPR requires. This pack cites them as their publishers state them.

The OWASP lists are community lists of the risks the project judges most important. A threat that is not on a list is not therefore safe, and a threat on a list is not therefore present in every application.

This pack does not say which OWASP, MITRE ATLAS, NIST or ISO/IEC 42001 items meet a requirement of the EU AI Act or the GDPR. Each reference says what its source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act or the GDPR.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.