CRG AI Assurance Laboratory

Independent evidence for decisions that cannot rely on vendor confidence alone.

The laboratory evaluates whether an AI system is sufficiently governed, reliable, secure, traceable and controlled for its stated institutional use. CRG Assurance Reports communicate a scoped assurance opinion and its limitations; they are not represented as statutory approval or accredited certification.

Commission an assurance engagementRegulation Intelligence
CRG AI Assurance Protocol 1.0

Ten assurance domains. Evidence before opinion.

Cybatar Riovic Group's evidence-based methodology for independently assessing whether an AI system is sufficiently governed, reliable, secure, traceable and controlled for its stated institutional use. It is an assurance methodology, not a statutory certification scheme.

Agent autonomy & tool controls

5 controls covering:

  • Bounded autonomy
  • Human approval for consequential actions
  • Environment separation
  • Transaction and budget limits
  • Agent traceability

Data & privacy

5 controls covering:

  • Data provenance
  • Sensitive data controls
  • Data minimisation
  • Retrieval quality
  • Privacy rights readiness

Fairness & human impact

5 controls covering:

  • Affected-group analysis
  • Bias and disparity evaluation
  • Human contestability
  • Accessibility and inclusion
  • Human factors and overreliance

Governance & accountability

5 controls covering:

  • Named AI accountability
  • Approved intended use
  • Policy and control ownership
  • Independent challenge
  • Management reporting

Monitoring & incident response

5 controls covering:

  • Production monitoring
  • AI incident taxonomy
  • Incident response playbook
  • Rollback and containment
  • Post-incident learning

Model capability & reliability

5 controls covering:

  • Fit-for-purpose evaluation
  • Failure-mode testing
  • Performance thresholds
  • Change regression testing
  • Fallback and graceful degradation

Use-case & risk classification

5 controls covering:

  • System and use-case inventory
  • Risk classification
  • Foreseeable misuse analysis
  • Impact assessment
  • Residual risk acceptance

Security & access

5 controls covering:

  • Identity and least privilege
  • Prompt injection resilience
  • Secrets and data exfiltration controls
  • Tool and API security
  • Supply-chain security

Transparency & traceability

5 controls covering:

  • AI disclosure
  • Decision traceability
  • Model and prompt versioning
  • Source and citation integrity
  • Limitations communication

Vendor & lifecycle governance

5 controls covering:

  • Provider due diligence
  • Contractual AI controls
  • Provider change monitoring
  • Decommissioning and exit
  • Third-party incident dependency
Assurance workflow

From scope to independently reviewed conclusion.

1. Scope & classify

Define intended use, system boundary, material risks, regulation, evidence period and independence requirements.

2. Test & verify

Execute control design and operating-effectiveness procedures, technical evaluations and evidence verification.

3. Find & remediate

Record exceptions by severity, require management response and retest material remediation.

4. Independent review

A reviewer distinct from the lead assessor challenges evidence, findings, limitations and the proposed opinion.

5. Assurance opinion

Conclusions range from insufficient evidence or adverse through qualified, limited assurance and reasonable assurance.

6. Continuous assurance

Material model, prompt, data, tool, regulation or deployment changes can trigger reassessment.