AI Safety / Governance Assessment

Assessed subject binding

The identity of the exact AI system, model version, configuration and component boundary that this assessment judges. The binding must be reproducible so that a later reader can tell whether a given deployed artefact is covered.

1. Which exact AI system, model version and deployment configuration does this assessment bind to? identity
2. Which components, upstream models and third-party services fall inside the assessed system boundary? composition
3. Which system of record issued the subject identifier and when was the binding captured? provenance
4. What changes to the subject invalidate this binding and require a fresh assessment? constraint

Intended purpose and system classification profile

The declared intended purpose, reasonably foreseeable misuse, deployment setting and a coded classification profile of the system along recognised classification dimensions.

1. What is the declared intended purpose of the system and which uses are explicitly excluded? definition
2. How is the system profiled along the recognised classification dimensions of people and planet, economic context, data and input, model and task and output? classification
3. In which jurisdictions, sectors and organisational or physical settings is the system deployed? spatial
4. Which user groups, affected persons and non-user third parties interact with or are subject to the system? relationship

Assessment identity, revision and mandate

Identifiers, revision designation, temporal anchors and the authority under which the assessment was opened.

1. Which identifier uniquely designates this assessment record and its revision? identity
2. What are the evidence cut-off time and the record creation time for this assessment? temporal
3. How are assessment revisions numbered and which revision is authoritative right now? lifecycle
4. Under whose mandate and on which basis was this assessment opened? authority

Assessment scope, exclusions and method

What kind of assessment this is, what question it answers, what it deliberately excludes, and the method, criteria and sampling used to reach findings.

1. What assessment type is this and what specific question is it answering? definition
2. Which parts of the system, lifecycle stage or use context are explicitly excluded from this assessment? constraint
3. Which method, criteria and sampling approach produced the findings? process
4. What depth of assurance does this method support and what could it not establish? quality

Operator role and applicable regime set

Which role the assessed organisation holds for this system in each market, which regimes apply on what territorial basis, and which exemptions are relied on.

1. Which operator role does the assessed organisation hold for this system in each market it serves? classification
2. Which legal, regulatory, contractual and internal regimes are asserted to apply and on what territorial basis? authority
3. Which other operators in the value chain hold obligations that this assessment relies on? relationship
4. Which exemptions, derogations or research exclusions are claimed and how is each justified? exception

Risk tier or category determination

The classification of the system into a risk tier or category under each applicable regime, with the reasoning and evidence that supports it, including any documented not-high-risk derogation.

1. Which risk tier or category does the system fall into under each applicable regime? classification
2. What reasoning and evidence support the tier determination, including any claim that a listed system is not high-risk? evidence
3. Who determined the tier and when must that determination be revisited? decision
4. How does the tier under one regime map onto tiers or thresholds under the others? interoperability

Requirement applicability statement

The enumerated normative requirements that apply given role and tier, those excluded with justification, and the party responsible for each.

1. Which individual normative requirements apply to this system given its role and tier? requirement
2. Which requirements are excluded and what justification is recorded for each exclusion? composition
3. Which party is responsible for satisfying each applicable requirement? ownership
4. How are overlapping requirements from different regimes deduplicated without losing traceability to each source? interoperability

AI risk taxonomy assignment

Assignment of AI-specific risk category codes and trustworthiness characteristics to the assessed subject, including entries explicitly considered and ruled out.

1. Which AI-specific risk categories and trustworthiness characteristics are implicated by this system? classification
2. Which taxonomy scheme and version supplies the code list used for each tag? definition
3. How does each risk tag map onto the referenced risk register items? relationship
4. Which taxonomy entries were considered and explicitly ruled out, and on what basis? quality

Affected stakeholder and impact analysis

Identification of individuals, groups, communities and environmental receptors that could be affected, with characterised severity, breadth and reversibility, and the record of stakeholder consultation.

1. Which individuals, groups, communities and environmental receptors could be affected, including people who never interact with the system? relationship
2. How are severity, likelihood, reversibility and breadth of impact characterised for each affected group? measurement
3. Which stakeholders were consulted and how was their input incorporated or rejected? process
4. What personal data or special-category processing does the system entail and which separate assessment covers it? privacy

Risk and opportunity register binding

The citation of externally owned risk and opportunity register items as evidence, with the assessment-scoped parameters that may legitimately be carried on the binding.

1. Which risk and opportunity register items does this assessment cite as evidence? relationship
2. Which revision of each cited register item is bound so the citation stays reproducible? identity
3. Which assessment-scoped parameters may be recorded on the binding without duplicating register state? constraint
4. When was each register item read and which register version was current at that moment? provenance

Adversarial threat surface

Credible adversarial attack classes against the system's training and inference stages, the trust boundaries and untrusted input channels, and the attacker assumptions adopted.

1. Which adversarial attack classes are credible against this system's learning and inference stages? security
2. Which trust boundaries, untrusted input channels and tool or agent surfaces exist in the deployment? composition
3. What attacker capability, knowledge and access assumptions were adopted for the analysis? classification
4. Which security tests or red-team exercises probed each identified attack class? validation

Data and provenance risk finding

Assessment findings on the origin, licensing, quality, representativeness and restrictions of training, validation and test data, referencing dataset documentation held elsewhere.

1. What is the origin, licensing status and collection basis of the training, validation and test data? provenance
2. Which data quality, representativeness and bias properties were examined against the intended purpose? quality
3. Which data-related restrictions bind the system's permitted use? constraint
4. Where is the authoritative dataset record held and who retains it? ownership

Safeguard selection and applicability

The safeguards and controls selected to address each applicable requirement and risk, how they are layered across lifecycle stages, who owns them, and which are declared but not yet implemented.

1. Which safeguards are selected to address each applicable requirement and identified risk? requirement
2. How are safeguards layered across design, training, deployment and operational stages? composition
3. Which organisational unit owns each declared safeguard? ownership
4. Which safeguards are declared but not yet implemented and by when are they due? state

Human oversight arrangement

The oversight measures built into the system and those the deployer must add, the overseer's authority to intervene, and the competence and conditions effective oversight requires.

1. What oversight measures are built into the system and which measures must the deployer add? process
2. Which decisions can a human overseer override, halt or escalate, and under what authority? authority
3. What competence, training, tooling and time budget does effective oversight require? requirement
4. How is automation bias detected and counteracted in the oversight arrangement? quality

Capability threshold and safeguard tier

Whether the model approaches or crosses declared capability thresholds, which safeguard tier is consequently required, which is in force, and what elicitation effort backs a not-crossed claim.

1. Which declared capability thresholds does the model approach or cross? measurement
2. Which safeguard tier is required by the determination and which tier is currently in force? state
3. What triggers a capability reassessment ahead of the scheduled interval? event
4. What elicitation effort backs a claim that a threshold is not crossed? evidence

Safeguard effectiveness judgement and residual risk position

The assessor's point-in-time judgement of whether each credited safeguard is effective, the residual risk that remains per category, and the deficiencies accepted as open.

1. On what basis is each credited safeguard judged effective, partially effective or ineffective? validation
2. What residual risk remains per risk category after the assessed safeguards? measurement
3. As of which point in time does the effectiveness judgement hold? temporal
4. Which deficiencies are left open, by whose acceptance, and under what compensating measure? exception

Evaluation evidence citation

The set of evaluation runs, benchmarks, audits and red-team exercises cited as evidence, each identified, integrity-checked, attributed and judged for sufficiency and currency.

1. Which evaluation runs, benchmarks, audits and red-team exercises are cited as evidence? evidence
2. How is each cited evidence item identified and integrity-checked? identity
3. Who executed each evaluation, against which subject version, and under which harness configuration? provenance
4. Is the cited evidence sufficient and current for the claim it is used to support? quality

Metrics and acceptance thresholds

The metrics that express accuracy, robustness, safety and fairness for this system, the acceptance thresholds set for them, the conditions under which those thresholds hold, and current measured values.

1. Which metrics and units express accuracy, robustness, safety and fairness for this system? measurement
2. What acceptance threshold applies to each metric and who set it? requirement
3. Under which operating conditions and populations do the declared thresholds hold? constraint
4. What is the current measured value against each threshold and is it passing? state

Measurement validity and limitations

Honest qualification of the evidence base: construct validity of each metric relative to the harm it stands for, risks acknowledged as unmeasurable, contamination and distribution-shift caveats, and staleness intervals.

1. What is the construct validity of each metric relative to the harm it is taken to represent? quality
2. Which identified risks are acknowledged as not measurable with the available methods? exception
3. Which contamination, elicitation-gap or distribution-shift caveats apply to the cited results? constraint
4. How quickly do the cited results go stale and what revalidation interval applies? temporal

Post-market signal and incident binding

References to the post-market monitoring arrangement and to incident and hazard records considered by this assessment, with the classes of signal that must feed back into it.

1. Which post-market monitoring arrangement and which incident or hazard records does this assessment reference? relationship
2. Which incident and hazard classes must be fed back into this assessment? event
3. What timelines apply from signal detection to assessment update? temporal
4. Which system owns incident case management and what does this assessment retain? ownership

Assessment conclusion and residual risk acceptance

The terminating judgement of the assessment, who holds authority to accept the stated residual risk, which deployment scopes the conclusion covers and how long it is valid.

1. What is the assessment conclusion: approve, approve with conditions, defer or reject? decision
2. Who holds authority to accept residual risk at the stated level? authority
3. Which deployment scopes, markets and use cases does the conclusion cover? constraint
4. For how long is the conclusion valid absent a triggering change? temporal

Conditions, restrictions and reassessment triggers

The conditions and restrictions attached to an approval, the events that trigger reassessment, what happens to approval status while reassessment is pending, and who monitors for triggers.

1. Which conditions, restrictions and prohibited uses attach to the approval? constraint
2. Which changes to the model, data, deployment context or law trigger reassessment? event
3. What happens to approval status when a trigger fires but reassessment is not yet complete? state
4. Who watches for trigger conditions and how are they notified? process

Accountable ownership and sign-off

The named accountable person or body owning the assessment outcome, the delegated authority permitting sign-off at this risk level, the form of the sign-off and what happens when the owner changes.

1. Which named person or body owns this assessment and its outcome? ownership
2. Which delegated authority permits sign-off at this risk level? authority
3. What form does the sign-off take and how is signer identity established? evidence
4. What happens to accountability when the named owner leaves the role? lifecycle

Independent review and attestation citation

Citations to internal audit, external review, notified body or certification records related to this assessment, with independence characterisation and explicit limits on what may be claimed from them.

1. Which internal audit, external review or certification records relate to this assessment? relationship
2. How independent was each reviewer from the development and deployment teams? quality
3. What is the exact scope of each cited external attestation? evidence
4. What may and may not be claimed on the basis of each cited review? validation

Record state and supersession provenance

The lifecycle state of the assessment record, which transitions are permitted, what changed relative to the superseded revision, and the separate event and recording times of each transition.

1. Which lifecycle state is this assessment record currently in? state
2. Which transitions are permitted and which changes require a new revision rather than an in-place edit? lifecycle
3. What changed relative to the superseded revision and why was the assessment reopened? provenance
4. When did each transition occur in event time and when was it recorded in the system? temporal

Retention and disposition of the assessment record

How long the assessment and its supporting citations must be kept, under which authority, what remains discoverable after disposition, and how personal data inside the record is minimised.

1. How long must this assessment and its supporting citations be retained and under which rule? retention
2. Which policy or authority sets the retention period and authorises disposition? authority
3. What must remain discoverable after disposition, such as a tombstone or index entry? access
4. How is personal data inside the assessment minimised or redacted before long-term retention? privacy

Disclosure tiering and redaction

Which audiences may see which parts of the assessment, what is withheld as trade secret or security-sensitive, how a redacted external version is derived, and which disclosures are mandatory regardless of preference.

1. Which audiences may see which parts of this assessment? access
2. Which content is withheld as trade secret, security-sensitive or dual-use hazardous? security
3. How is a redacted external version derived and kept consistent with the internal record? process
4. Which disclosures are legally mandatory regardless of confidentiality preference? requirement

Framework alignment crosswalk

Traceable mapping from this assessment's elements onto each aligned external framework, with mapping strength, conflicts between frameworks and the framework version used.

1. How do this assessment's elements map onto each aligned framework's structure? interoperability
2. Which mappings are exact, partial or absent, and what evidence supports each claim? validation
3. Where do the aligned frameworks conflict or use the same term with different meanings? exception
4. Which framework version was used for each mapping and when was it last verified? provenance