Is assurance the same as continuous monitoring?

No, though they overlap. Continuous monitoring usually means a system watching a technical control and alerting on a deviation. Assurance is the broader question of whether a claim stays reproducible, most of which has nothing to do with a monitored control: whether an artifact carries a date, whether a closed finding is re-checked, whether anybody but one person can produce the pack. A monitoring tool answers none of those.

How often does a posture need re-checking?

There is no general answer, and any number given without knowing what you run would be arbitrary. The useful way to derive it is from what changes underneath you: an organization whose vendors ship AI features monthly has a shorter honest interval than one running a system that has not changed in a year. What matters more than the interval is whether the one you set was held, and whether missing it was noticed.

Can a small organization do this at all?

Yes, and usually more cheaply than a large one, because most of what makes a record durable is a habit rather than a system. Dates on artifacts, a written procedure somebody else has followed, and evidence exported from the system that produced it are all free. The expensive parts are retention and tamper-evidence, and those are properties of the tools you already pay for.

What is AI compliance assurance?

AI compliance assurance is the practice of keeping a claim about how you run AI reproducible over time, rather than establishing that it is true once. Where an assessment reports what exists on the day somebody looks, assurance is concerned with what happens to that picture afterwards: whether artifacts carry dates anybody honors, whether a change to a system reaches the record, and whether the ability to produce the evidence survives the person who normally produces it. It is a question about durability, not about adequacy.

Why a passing assessment expires

Every compliance artifact is a description of a system at a moment. The description does not move on its own and the system does, so the distance between them opens quietly from the day the document is signed. Nothing announces it. There is no event, no alert and no failure, which is precisely why it is discovered by the person who asks rather than by the person who should have known.

The three things that open that distance are time, change and people. Time is the review that was scheduled and slipped, and the finding that was closed and never re-checked. Change is the model version that moved, the vendor feature that switched itself on, and the tool that quietly started being used for something else. People are the single person who knows how the pack gets built, and the accounts the evidence turns out to live in.

None of the three is a control failure in the ordinary sense. Each one is a true statement becoming false without anybody doing anything wrong, which is why the usual instruments do not see them: a control that was implemented is still recorded as implemented.

Assembled evidence and byproduct evidence

The single strongest predictor of whether a posture survives a year is whether the evidence is a byproduct of doing the work or is assembled when somebody asks. Assembled evidence is only ever as current as the last request. Between requests it does not decay so much as cease to exist, and the work of producing it is paid again in full every time.

Byproduct evidence keeps pace by construction. Nobody has to remember to update it, because updating it is not a separate task from doing the work. The practical test is whether producing the pack creates anything new, or only collects things that already existed.

This distinction is also why an organization with less documentation can be in a stronger position than one with more. A thin record the work emits is a standing position. A thorough record assembled once is a photograph.

Why the person matters as much as the process

A capability that lives in one undocumented person is indistinguishable, from outside, from a capability the organization has. The two come apart on exactly one day, and by then there is nothing to be done about it.

This is not really about turnover risk in the usual sense. It is that an unwritten procedure cannot be examined, improved or delegated, so it does not get better and it does not get cheaper. Everything anybody knows about it is one person's estimate of their own clarity.

The cheap test is whether somebody who has not done it before could follow what is written and produce the same thing. Not whether they could work it out. Whether they could follow it.

What assurance is not

It is not an audit. An audit is performed by somebody independent against evidence they inspect, and it produces findings about what they found.

It is not a measure of whether your practice is adequate. An organization can keep beautifully current, well-attributed records of something that falls short of what a customer or a framework expects. Durability and adequacy are separate questions, and this one is about durability alone.

It is not certification, and it is not legal advice. A durable record is not evidence of compliance with anything.

Common questions

Is assurance the same as continuous monitoring?: No, though they overlap. Continuous monitoring usually means a system watching a technical control and alerting on a deviation. Assurance is the broader question of whether a claim stays reproducible, most of which has nothing to do with a monitored control: whether an artifact carries a date, whether a closed finding is re-checked, whether anybody but one person can produce the pack. A monitoring tool answers none of those.
How often does a posture need re-checking?: There is no general answer, and any number given without knowing what you run would be arbitrary. The useful way to derive it is from what changes underneath you: an organization whose vendors ship AI features monthly has a shorter honest interval than one running a system that has not changed in a year. What matters more than the interval is whether the one you set was held, and whether missing it was noticed.
Can a small organization do this at all?: Yes, and usually more cheaply than a large one, because most of what makes a record durable is a habit rather than a system. Dates on artifacts, a written procedure somebody else has followed, and evidence exported from the system that produced it are all free. The expensive parts are retention and tamper-evidence, and those are properties of the tools you already pay for.

Find out where you stand

The assessment on this site asks up to 24 questions about what makes your evidence stop being reproducible, and returns a score, a verdict and, where a control is short, the one thing to fix first. It names no framework, it takes about ten minutes, and where nobody outside asks, the two questions about somebody else's deadline and somebody else's reader are dropped rather than scored against you.

It is a self-assessment of whether what you can show today would still be showable later, not an audit, not a certification, not a conformity assessment and not legal advice. It says nothing about whether the practice it describes is adequate.

Run the assessment