AI Assurance Services
for Regulated Enterprises.

AI assurance is independent, documented validation that an AI system meets specified quality, safety, fairness, and regulatory requirements. It is needed by any organisation deploying AI in regulated sectors — government, financial services, healthcare — or supplying AI capabilities to organisations in the EU market subject to the EU AI Act's high-risk AI system requirements.

High-risk AI systems under the EU AI Act require documented risk management (Article 9), data governance evidence (Article 10), transparency and instructions for use (Article 13), and accuracy, robustness, and cybersecurity evidence (Article 15). Self-assessment is permitted for most high-risk categories, but must be supported by auditable test artefacts — not policy documents alone.

Bias testing begins by identifying protected attribute groups relevant to the AI system's decision domain. We then measure model performance (accuracy, precision, recall, false positive rate) separately across each group and compute fairness metrics: demographic parity (equal positive prediction rates), equal opportunity (equal true positive rates), and calibration (equal confidence-to-outcome alignment). Disparities above acceptable thresholds are flagged as fairness failures.

The NIST AI RMF (published January 2023) is a voluntary framework for managing AI risks across four functions: Govern (establishing accountability and culture), Map (identifying and contextualising AI risks), Measure (quantifying and assessing risk), and Manage (prioritising and implementing risk responses). It is increasingly referenced in US government procurement and aligns with ISO 42001.

Australia's Voluntary AI Ethics Framework (DISR, 2019) defines eight principles organisations should apply to AI systems: human, social and environmental wellbeing; human-centred values; fairness; privacy protection and security; reliability and safety; transparency and explainability; contestability; and accountability. While voluntary, government procurement guidance increasingly treats adherence as a vendor requirement.

A security audit evaluates controls against known vulnerability classes (authentication, authorisation, injection, cryptography). AI assurance adds dimensions a security audit cannot cover: statistical model accuracy and fairness across demographic groups, hallucination rate and groundedness, bias in training data and outputs, and conformity with AI-specific regulatory frameworks such as the EU AI Act and NIST AI RMF.