AI Assurance
Trust in an AI system has to be earned, and shown.
Assurance is evidence. It answers the question every board and regulator eventually asks: how do we know this system does what we say it does? For AI that means testing it before it is used and watching it afterwards, checking for errors and unfair outcomes, keeping a record of how it was built and changed, and being able to explain a decision to the person it affected.
Some of that evidence can come from inside the organisation, and some should come from someone independent. The European Union's AI Act requires high-risk systems to pass a conformity assessment before they are sold or used, in some cases by an outside body, the ISO/IEC 42001 standard describes a management system for AI that an outside body can audit, and the NIST AI Risk Management Framework offers a common way to organise the work. The UK government has also published guidance on AI assurance. Assurance does not remove the risk. It shows that someone looked, and what they found.
This theme is about the practical side of proving an AI system is fit for its purpose: what to test, what to record, who should check, and what to do when the results are not good enough.
Directors and trustees, risk, audit and compliance teams, internal and external auditors, and the people who buy or build AI systems.