Monitor AI Model Performance and Investigate Anomalies
Keep track of AI model performance and check any unusual behaviors.
Plain language
This control is about continuously checking how well your AI systems are working and quickly digging into anything unusual. It matters because if you miss odd behaviour, you could end up with poor decisions, unhappy customers, or even legal issues if things go wrong.
Framework
ASD Information Security Manual (ISM)
Control effect
Detective
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2025
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentOfficial control statement
AI model performance metrics are monitored and anomalies are investigated.
Why it matters
If AI performance issues are ignored, businesses risk making poor decisions, damaging customer trust, and facing legal trouble.
Operational notes
Regularly update your AI model monitoring processes to keep pace with changes in technology and business needs.
Implementation tips
- The IT team should regularly review AI model performance data. They should set up automated alerts to notify them of any unexpected changes in the model's outputs.
- Managers need to designate a specific staff member to investigate anomalies. They should ensure this person has a clear process for identifying and examining unusual model behaviour.
- System owners should define 'normal' performance metrics for their AI models. They should work with analysts to specify what variances from these norms require further investigation.
- The IT department should implement logging of AI model outputs. They should do this by using software that records each decision or prediction made by the AI for audit and troubleshooting.
- Business leaders should review anomaly reports with their IT team at regular intervals. This ensures that any identified issues are being timely addressed and lessons are learned for future prevention.
Audit / evidence tips
- Askthe protocol that outlines steps for monitoring AI performanceLook atwhether it includes periodic reviews and anomaly checks. Good evidence: a detailed document with clear roles and frequency, signed by management
- Goodorganised logs showing regular entries and flagged anomalies
- Askanomaly investigation reports. Ensure they include a summary of findings and actions taken. Good evidence: a comprehensive report that outlines the incident, investigation steps, and corrective actions
- Request the list of performance metrics used for AI models. Confirm these metrics are tailored to the specific AI's objectives. Good sign: metrics that align with business goals and known risks, regularly updated.
- Askabout training materials for staff on handling AI anomaliesLook atdetailed roles and response timesGooddocumented training sessions and attendance records demonstrating proactive education
Cross-framework mappings
How ISM-2089 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 8.15 | ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies | |
| Annex A 8.16 | ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies in model behaviour or outputs | |
handshakeSupports(1)expand_less | ||
| Annex A 5.28 | ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies | |
E8
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| E8-MF-ML2.9 | ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies | |
| E8-AH-ML2.15 | ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.