Skip to content
Software development
ASD ISMISM-2091

ASD ISM 2091 Enforce resource limits for AI models

What it says

Resource limits are enforced for AI models.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

AI models must have enforced resource limits to prevent excessive use.

Resource limits for AI models mean deliberately capping how much computational power or data an AI can use. This is important to stop AI from overloading systems, which could lead to crashing the server, slowing down operations, or incurring unexpected costs.

Why it matters

Without enforced AI resource limits, systems can crash, leading to downtime and increased costs due to uncontrolled processing demands.

How to implement

  1. Managers should define clear resource allocation limits for AI models.

    Determine how much computing power, memory, and data each AI model will be allowed to use. This involves understanding your organisation's overall capacity and ensuring individual use doesn't exceed it.

  2. The IT team should monitor AI model performance and resource use.

    Set up tools that can alert them if an AI model starts using more resources than allocated. This involves regular checking of system dashboards and setting alerts on unusual spikes.

  3. Procurement officers should review AI software contracts.

    Ensure that vendor agreements specify resource consumption limits and penalties for exceeding them. This includes negotiation terms aligned with expected operational needs and budget constraints.

  4. System administrators should configure systems to enforce these limits.

    Use software settings or external tools to automatically restrict AI models if they try to exceed their resources. Ensure these configurations are tested for effectiveness without affecting normal AI operations.

  5. HR should train staff on the importance of adhering to AI resource limits.

    Educate team members on how exceeding these can impact the business, using real-world scenarios. This ensures everyone understands the collective responsibility for maintaining these boundaries.

Keep it running

Regularly review AI resource usage logs to catch any breaches early and adjust limits as your operations grow and change.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    documentation of resource limits: Request copies of the policies or guidelines outlining AI model resource allocations.

    Look at

    the specific numbers and conditions set for each model.

    Good evidence

    is clear documentation showing limits for power, memory, and data use.

  2. Check 2 of 5What an auditor asks for

    Ask for

    to see the monitoring system in action: Request a demonstration of how AI resource use is being watched.

    Look at

    systems in place that alert the team if limits are reached.

    Good evidence

    includes a working system that shows alerts or logs of past resource use issues.

  3. Check 3 of 5What an auditor asks for

    Ask for

    vendor contracts with AI providers: Request the contracts that were reviewed and signed when the AI tools were purchased. Check they clearly detail resource limits and associated penalties.

    Good evidence

    shows specific clauses addressing resource consumption.

  4. Check 4 of 5What an auditor asks for

    Ask for

    about recent training sessions: Request records of any recent staff training sessions regarding AI use.

    Look at

    attendance records and training materials used.

    Good evidence

    includes sign-in sheets and outlines of educational sessions on AI resource management.

  5. Check 5 of 5What an auditor asks for

    Ask for

    to review system configurations: Request access to the settings enforcing AI model resource limits. Inspect configurations or tools used to enforce these limits.

    Good evidence

    demonstrates restricted settings or the presence of third-party tools that cap resource use.

Mappings

Closest match in ISO/IEC 27001: A.8.6, Capacity management for resource use, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.