Enforce Resource Limits for AI Models
AI models must have enforced resource limits to prevent excessive use.
Plain language
Resource limits for AI models mean deliberately capping how much computational power or data an AI can use. This is important to stop AI from overloading systems, which could lead to crashing the server, slowing down operations, or incurring unexpected costs.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2025
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentOfficial control statement
Resource limits are enforced for AI models.
Why it matters
Without enforced AI resource limits, systems can crash, leading to downtime and increased costs due to uncontrolled processing demands.
Operational notes
Regularly review AI resource usage logs to catch any breaches early and adjust limits as your operations grow and change.
Implementation tips
- Managers should define clear resource allocation limits for AI models. Determine how much computing power, memory, and data each AI model will be allowed to use. This involves understanding your organisation's overall capacity and ensuring individual use doesn't exceed it.
- The IT team should monitor AI model performance and resource use. Set up tools that can alert them if an AI model starts using more resources than allocated. This involves regular checking of system dashboards and setting alerts on unusual spikes.
- Procurement officers should review AI software contracts. Ensure that vendor agreements specify resource consumption limits and penalties for exceeding them. This includes negotiation terms aligned with expected operational needs and budget constraints.
- System administrators should configure systems to enforce these limits. Use software settings or external tools to automatically restrict AI models if they try to exceed their resources. Ensure these configurations are tested for effectiveness without affecting normal AI operations.
- HR should train staff on the importance of adhering to AI resource limits. Educate team members on how exceeding these can impact the business, using real-world scenarios. This ensures everyone understands the collective responsibility for maintaining these boundaries.
Audit / evidence tips
- Askdocumentation of resource limits: Request copies of the policies or guidelines outlining AI model resource allocationsLook atthe specific numbers and conditions set for each modelGoodis clear documentation showing limits for power, memory, and data use
- Askto see the monitoring system in action: Request a demonstration of how AI resource use is being watchedLook atsystems in place that alert the team if limits are reachedGoodincludes a working system that shows alerts or logs of past resource use issues
- Askvendor contracts with AI providers: Request the contracts that were reviewed and signed when the AI tools were purchased. Check they clearly detail resource limits and associated penaltiesGoodshows specific clauses addressing resource consumption
- Askabout recent training sessions: Request records of any recent staff training sessions regarding AI useLook atattendance records and training materials usedGoodincludes sign-in sheets and outlines of educational sessions on AI resource management
- Askto review system configurations: Request access to the settings enforcing AI model resource limits. Inspect configurations or tools used to enforce these limitsGooddemonstrates restricted settings or the presence of third-party tools that cap resource use
Cross-framework mappings
How ISM-2091 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.6 | ISM-2091 requires organisations to enforce resource limits specifically for artificial intelligence models to prevent excessive consumption | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.