Ongoing evidence
AI Compliance Assurance
A one-time check expires. Find out whether the evidence behind yours would still be there next quarter.
AI compliance assurance is the question of whether a claim about how you run AI stays reproducible, not whether it is true today. A gap assessment is a snapshot of what exists when somebody looks. This asks what happens to that picture afterwards, so it never asks whether a policy, an inventory or an accountable owner exists. It asks what makes what you have stop being reproducible: whether anything carries a date somebody honored, whether a change reaches the record, and whether producing the evidence survives the person who normally produces it. It runs up to 24 questions across eight domains and returns a score out of 100 with one of three verdicts. Where nobody outside asks, two of them are dropped.
The domains are grouped by what they defend against, because those are the three ways a true statement becomes one nobody can reproduce. Time is the review that slipped and the finding that was closed and never looked at again. Change is the model version that moved and the vendor feature that switched itself on. People are the one person who knows how the pack gets built. None of the three is a control failure in the ordinary sense, which is why the instruments that measure controls do not see them.
Three gates can hold the verdict down whatever the score. If nothing is written down that somebody else could follow and nobody else has produced the pack, the ability to prove any of this belongs to a person and not to the organization, and the verdict is UNREPRODUCIBLE at any number. A top verdict is also held back where nothing in the freshness domain records a review that actually happened, or where any control reads zero. None of the three can improve a verdict. The top band starts at 80, which is the floor the record-keeping kit RedHub already ships in this lane uses. The whole method is published, weights and bands included, so you can recompute the number by hand.
Nothing here inspects anything. Nothing is fetched, scanned or read, and nothing you type is stored by us: your answers ride inside your own result link. Opening or sharing that link sends the address, and so the answers, to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you or your company. It is a self-assessment of what you could show today, not an audit, not a certification, not a conformity assessment and not legal advice.
Who asks you to prove any of this?
This decides which questions have a surface to exist on, and it changes the weights, not the difficulty. Where nobody outside asks, there is no external deadline you could have met and no outside reader you could have confused, so those two questions are dropped instead of scored against you -- and everything else is weighted heavier, because nothing external is keeping it alive. Pick who actually asks today, not who you expect to ask next year.
Results are subject to the Terms, which cover how a result may be described to somebody else. Nothing you answer is stored or sent to us.
Common questions
- What is AI compliance assurance?
- Assurance is the question of whether a claim about how you run AI stays reproducible over time, rather than whether it is true today. A gap assessment is a snapshot: it reports what exists at the moment somebody looks. Assurance asks what happens to that picture between now and the next time anybody wants it evidenced, which is a question about dates, changes and people rather than about controls. This assessment scores that directly, and it inspects nothing.
- How is this different from an AI compliance gap assessment?
- A gap assessment measures distance from a target and reports what you are missing. This one assumes nothing about what you are missing and asks what will still be true later. The two can disagree in both directions, which is the point: an organization can be strong on a framework today with nothing dated, nothing written down and one person who knows how any of it was produced, and it can be short of a framework while what it does have is emitted by the work, rehearsed and reproducible by somebody else. If the two assessments could not disagree, one of them would not need to exist.
- Do I need to have done anything before running this?
- No, and a low score is the expected result for most organizations rather than a sign you did something wrong. Almost every governance posture is assembled the first time somebody asks for it, so almost every posture starts here with nothing dated and nothing rehearsed. The useful output is not the number. It is which of the eight domains is costing you the most and which single control is worth moving first.
- Why does the top verdict say AS DESCRIBED?
- Because the result is computed from answers you supplied and nobody checked. A verdict on this site is the kind of thing that gets forwarded to a customer's reviewer or an auditor, who did not answer the questions and cannot tell from the card that it was self-scored. The suffix is what stops the card reading as a status somebody conferred on you. The paid Audit Evidence Pack Assay asks the same kind of question one decision class at a time and reports ANSWERABLE per question. It is a self-report too and verifies nothing you tell it either; what it adds is resolution. A per-question reading does not travel the way a headline about your whole organization does, which is the whole of why one carries the suffix and the other does not.
- Can a good score here mean I would pass an audit?
- No. This measures whether evidence would survive to be produced, not whether it would satisfy anybody once it was. An organization can be excellent at keeping current, well-attributed records of a practice that falls short of what its customers or a framework expect. Those are two different questions and this one answers only the first. It is not an audit, not a certification, not a conformity assessment and not legal advice.
- What happens to my answers?
- They are encoded into your result link and nothing is stored: no account, no database row, nothing tying a set of answers to a person or a company. Opening or sharing a result does send that address to our host the way any URL does, where it appears in ordinary server logs, and pasting it into a chat tool sends it to that tool's servers too. Nothing in it names you or your company. The link is the only copy: close the tab without keeping it and we cannot recover it.
The three shapes, briefly
Internal. No customer questionnaire, no auditor, no regulator and no insurer is asking you to evidence how you run AI. If the record decays, the only person who finds out is you, and only if you look.
Customer-driven. Security reviews, procurement questionnaires and vendor assessments arrive without warning, in somebody else's format, usually with a deadline measured in days and a deal attached to it.
Audited. An auditor, a certification body, a regulator or an insurer looks at what you do, on a known date, and asks about a period that has already ended. They read the record without you in the room.