You Cannot Select an AI Control Until Governance Tells You What You Are Protecting
Control selection is downstream of classification, and classification is a governance output. Where that chain is missing, what looks like a control framework is really just a control list.