Evidence for the AI you are already running
Most organisations are further into AI than they think. It arrived inside the CRM, the helpdesk, the office suite and the payroll system, bought for something else and switched on by a vendor release note. The first assurance question is not "should we adopt AI". It is "what are we already running, and who is accountable for it".
How we assess
Two public frameworks, no proprietary scoring
We do not sell a private methodology. We assess against frameworks you can read yourself, so the findings survive contact with your auditor, your board and your regulator.
NIST AI RMF 1.0
The scoring spine. Four functions, each covering a different failure mode.
- Govern
- A culture of risk management, policies, accountability, structures and workforce capability that apply across every AI activity.
- Map
- Establishing the context: what the system is for, who it affects, what data it needs, and what could go wrong.
- Measure
- Analysing, assessing and tracking AI risks and impacts using appropriate methods and metrics.
- Manage
- Allocating resources to identified risks, and responding to, recovering from and communicating about incidents.
The UK's five principles
The second lens. The same evidence, read the way a UK regulator reads it.
- Safety, security and robustness
- AI systems should function in a robust, secure and safe way throughout their lifecycle, with risks identified and managed.
- Appropriate transparency and explainability
- Those affected should be able to understand how a system reaches its decisions, proportionate to the risk.
- Fairness
- Systems should not undermine legal rights, discriminate unfairly, or produce unfair commercial outcomes.
- Accountability and governance
- Effective oversight, with clear lines of accountability across the supply chain.
- Contestability and redress
- Affected parties should be able to contest a decision and reach a meaningful route to redress.
What we recommend
Six techniques, all of them named by DSIT
Every recommendation resolves to one of the six assurance techniques in Introduction to AI assurance. If we suggest something, you can look up what it means without taking our word for it.
Risk assessment
"Used to consider and identify a range of potential risks that might arise from the development and/or deployment of an AI product/system."
Start with: Run one workshop per system in use. Capture what could go wrong, how you would find out, and who would act.
Impact assessment
"Used to anticipate the wider effects of a system/product on the environment, equality, human rights, data protection, or other outcomes."
Start with: Where personal data is involved, start with a DPIA. It is already a legal requirement for high-risk processing and gives you the structure.
Bias audit
"Assesses the inputs and outputs of algorithmic systems to determine if there is unfair bias in the input data, the outcome of a decision or classification."
Start with: Take one system that affects people and compare outcomes across the groups it touches. You need the outcome data before you can audit it.
Compliance audit
"Involves reviewing adherence to internal policies, external regulations and, where relevant, legal requirements."
Start with: List the regulations that already bind you, then check each AI use against them. Most organisations find the duty already existed.
Conformity assessment
"The process of conformity assessment demonstrates whether a product or system meets relevant requirements, prior to being placed on the market."
Start with: If you are placing a product on the market, especially a medical or safety-related one, establish which regime applies before you build.
Formal verification
"Formal verification establishes whether a system satisfies specific requirements, often using formal mathematical methods and proofs."
Start with: Reserve this for safety-critical control functions. For most business systems, rigorous testing is the proportionate answer.
Where to start
The assessment is free, takes about five minutes, and gives you a score on screen without an email address. It is the fastest way to find out whether you have a governance problem, a measurement problem, or neither.