AI assurance

Assurance answers a simple question from boards, customers and regulators: how do we know this AI system does what is claimed, safely and lawfully? The UK government's introduction to AI assurance describes a spectrum of techniques, from risk and impact assessments, bias audits and performance testing to conformity assessment, formal verification and certification against standards.

Assurance can be internal, performed by second-line functions such as risk or compliance, or independent, performed by internal audit or external parties. Its value depends on clear criteria (a law, ISO/IEC 42001, an internal policy or a contractual commitment), sufficient and appropriate evidence, and the independence of whoever gives the opinion. ISO/IEC 42006 sets requirements for bodies that audit and certify AI management systems.

Assurance is not a one-off test: models drift and contexts change, so evidence must be refreshed through monitoring and periodic review. Example: before scaling a credit scoring model, a bank commissions an independent review of fairness metrics, documentation and human oversight controls, and reports the conclusions to its risk committee. These skills are the focus of the AUDAI certification.