CSA's AI Controls Matrix Just Grew to 247 Controls. Filling It Out Isn't a Design Review.

The Cloud Security Alliance shipped AI Controls Matrix (AICM) v1.1 this past July. It's the most structured, vendor-neutral checklist the industry has for assessing AI system security. It's also not a substitute for the one thing it can't do: actually reviewing your architecture before you ship it.

What Changed in v1.1

AICM grew from 243 to 247 control objectives across the same 18 domains. The AI-CAIQ questionnaire expanded to 320 questions. If you'd already completed an AI-CAIQ response against v1.0, CSA's guidance is explicit: refresh it, don't patch it.

Two corrections worth making, since secondary coverage has gotten them wrong: the Model Security domain is not new — MDS-01 through MDS-13 have existed since v1.0 launched in July 2025, unchanged in v1.1. And the real headline is a new mapping to AIUC-1, an emerging agentic AI security standard, added on top of AICM's existing mappings to the EU AI Act, NIST AI RMF, ISO/IEC 42001:2023, and Germany's BSI AIC4.

AICM also runs on a Shared Security Responsibility Model with five roles — Cloud Service Providers, Model Providers, Orchestrated Service Providers, Application Providers, and AI Customers — which forces an explicit answer to "who owns this control" instead of letting it get fudged.

Where It Breaks Down

A 320-question questionnaire is evidence you hand an auditor. It is not a live check of whether your specific architecture, with your specific agent permissions, actually holds up. I've seen systems that would sail through an AI-CAIQ response — "do you have an access control policy," yes — while an agent sat there with standing write access nobody had verified against that policy. A checklist can't catch that gap. A design review can.

This is the same failure mode we've flagged with ISO 27001 for years: the standard tells you what to document, not whether what you documented is safe. AICM is a sharper, more AI-specific version of that same category — still a document.

What It's Actually Good For

Used correctly, AICM is genuinely useful: standardized vendor comparison at scale, and regulatory bridging — one assessment effort making progress toward the EU AI Act, NIST AI RMF, and ISO/IEC 42001 at once, instead of three separate gap analyses. That matters for teams operationalizing AI threat modeling for ISO 42001 or working to meet NIST AI RMF requirements.

The Sequence That Works

AICM is the "what should be true" layer. The design review is "is it actually true, right now" — and it has to be continuous, because AI systems change weekly in ways a point-in-time questionnaire can't track. Methodology and consistency in how you run that review matters as much as the framework itself, and the evidence behind each control answer needs to live somewhere traceable — exactly what input documentation is for. Run the review first. Let AICM document what you found.

‍