Evidence beats intent

AI disclosure in the interface Users must know when they are interacting with or being assessed by AI. Evidence: Screenshot of disclosure in the shipped UI. Capability and limitation statement Sets honest expectations and reduces misplaced reliance. Evidence: Published statement linked from the product. Challenge and escalation route Affected users need a path to a human. Evidence: Documented route with SLA and owner.

Provenance register Every source has a documented origin and right of use. Evidence: Signed-off register, versioned. Minimisation review Only data necessary for the purpose is processed. Evidence: Review record with excluded fields listed. Retention and deletion Prompts and outputs are retained no longer than justified. Evidence: Configured retention policy. No-train assurance for sensitive data Confidential input must not leak into provider training. Evidence: Contract clause reference and config proof.

Versioned golden evaluation set Quality claims need a stable, reviewable basis. Evidence: Repo link and change history. Release-blocking thresholds Quality must have teeth, not just dashboards. Evidence: CI config showing the gate. Subgroup performance analysis Aggregate quality hides disparity across groups. Evidence: Disaggregated results by relevant subgroup. Drift monitoring Inputs change even when the model does not. Evidence: Dashboard plus alert thresholds.

Adversarial red-team Jailbreaks, injection and exfiltration must be tested, not assumed. Evidence: Report with findings and remediation status. Untrusted content isolation Retrieved or user-supplied content must not act as instructions. Evidence: Architecture note plus test cases. Output filtering for the risk domain Context-specific harms need context-specific filters. Evidence: Filter configuration and eval results. Rate limiting and abuse detection Limits blast radius of misuse and cost attacks. Evidence: Config plus alerting rules.

Oversight model matched to severity Consequential decisions need review, not just a confidence score. Evidence: Severity mapping signed by the accountable owner. Reviewer competence and capacity Oversight is theatre if reviewers cannot realistically review. Evidence: Training record and throughput analysis. Override telemetry Override rate is the clearest signal of real-world trust. Evidence: Instrumented metric on the dashboard.

Rehearsed rollback You must be able to undo a model or prompt change fast. Evidence: Drill record with measured time. Cost budget and alerting Inference cost is a live operational risk. Evidence: Budget threshold and alert config. AI-aware incident runbook Standard runbooks miss AI failure modes. Evidence: Runbook plus last exercise date. Model lifecycle register Provider deprecation is a scheduled, survivable event if tracked. Evidence: Register with version end-of-life dates.

Severity drives rigour

An internal drafting aid and an automated eligibility decision do not need the same controls. Agree the decision-severity tier at Frame, then apply the control set that matches. Over-applying controls to low-risk tools is how assurance loses credibility.

Controls are design inputs

Every control here is cheap at Prove and expensive at launch. The pattern that kills programmes is discovering a data-provenance or oversight requirement two weeks before a committed go-live date.

Residual risk gets signed

You will not close every control. Write the residual risk in plain language, name the accountable owner, date it, and put it in front of the steering group. Undocumented residual risk is the only unacceptable kind.