Introduction to AI Assurance

2.1 Introduction

Introduces foundational concepts of AI assurance as part of the wider AI governance landscape. Describes the guidance's aim to help organisations and regulators understand how to build responsible AI systems using assurance mechanisms and technical standards.

2.2 Why is AI assurance important?

Explains that while AI offers significant economic and social benefits, it also presents risks including bias and privacy loss. Notes that AI assurance is crucial for organisations to secure public trust, demonstrate compliance with regulation, and manage risks throughout the AI development lifecycle.

3.1 The importance of trust

Defines AI assurance as the process of measuring, evaluating and communicating the trustworthiness of AI systems. Describes how assurance builds justified trust by providing reliable, standardised evidence about system capabilities, limitations and risk mitigation, enabling responsible deployment and unlocking benefits.

3.2 AI assurance and governance

Outlines the UK's five cross-sectoral regulatory principles for AI: safety, transparency, fairness, accountability and governance, and contestability and redress. Explains that AI assurance techniques and standards help organisations and regulators operationalise these principles in practice.

3.3 AI governance and regulation

Describes how AI assurance enables organisations to demonstrate trustworthiness and compliance to regulators and the market, while supporting sector-specific regulators in implementing principles. Notes assurance is relevant for frontier AI, with the UK's AI Safety Institute developing tools to identify and mitigate risks from advanced AI.

4.1 Measure, evaluate and communicate

Effective assurance of AI systems requires gathering data on system performance and behaviour, assessing risks through comparison against standards and benchmarks, and communicating findings through reports, dashboards and public disclosures. Organisations need access to system documentation and design information to carry out these activities.

4.2 AI assurance mechanisms

Organisations should combine qualitative and quantitative assessment techniques across the AI lifecycle, including risk assessments, impact assessments, bias audits, compliance audits, conformity assessments and formal verification. A proportionate approach allows low-risk systems to use fewer techniques while high-risk systems employ more robust combinations, supported by baseline cyber security measures.

4.3 AI assurance and standards

AI assurance mechanisms should rest on global technical standards developed by organisations like ISO, which provide shared vocabularies, interface protocols, measurement methods, process guidance, and performance requirements across foundational, interface, measurement, process, and product categories to enable consistent and trustworthy assurance and support various techniques such as bias audits. Standards address foundational concepts like defining bias and fairness, establishing processes and governance for responsible innovation, providing methods to measure bias, and setting acceptable performance thresholds for deployment. The AI Standards Hub, created by The Alan Turing Institute, BSI, and NPL with government support, strengthens global technical AI standards by raising awareness, expanding participation in their development, coordinating UK engagement, and conducting research to ensure standards align with shared values.

4.4 The AI assurance ecosystem

The AI assurance ecosystem comprises multiple stakeholders with distinct roles: regulators set regulations, provide guidance and oversight, incentivise best practice, and support innovation through sandboxes or challenges; accreditation bodies such as UKAS attest to the competence and impartiality of third-party assurance providers against international standards; government drives the ecosystem's development through the DSIT AI assurance programme which builds market knowledge, identifies emerging assurance techniques, and supports novel technique development via initiatives like the Fairness Innovation Challenge. Research bodies including the Alan Turing Institute conduct research on trustworthy and ethical AI assurance and develop open tools, whilst civil society organisations provide oversight, multi-stakeholder feedback and scrutiny, develop resources and templates for assessing algorithmic impact particularly in healthcare, and inform the public of emerging risks; professional bodies establish standards and share training for assurance practitioners. The Fairness Innovation Challenge, jointly operated by DSIT and Innovate UK with government, regulators, academia and industry, develops practical approaches to auditing fairness and bias compliant with data protection and equalities law, and the IAPP AI Governance Center provides professionals with resources, training and certification for managing AI governance, risk and compliance; research from over 500 respondents found that 60% of organisations have or plan to establish a dedicated AI governance function within 12 months, 31% report a shortage of qualified governance professionals, and 56% believe their organisations lack understanding of AI deployment benefits and risks.

5.1 AI assurance landscape

Organisations can demonstrate good governance, understanding of risks and regulatory compliance through different combinations of assurance mechanisms and providers selected based on their specific needs and measured against relevant standards or regulations such as UK GDPR.

5.2 AI assurance spectrum

Assurance techniques apply to training data, AI models, complete systems deployed operationally, and the broader organisational context where systems are used. Both development and deployment lifecycles require assurance of relevant data, models, systems and governance processes.

5.3 Assuring data, models, systems and governance in practice

Organisations should establish robust processes for data handling, including a data strategy, clear accountability for data, and transparent collection and sharing processes, while complying with UK GDPR and Data Protection Act 2018, with all systems using personal data requiring a data protection impact assessment. To assure AI models and systems, organisations should use techniques such as impact assessments, bias audits, and performance testing with clear benchmarks, and must establish governance frameworks with standardised internal transparency, escalation avenues, risk management processes, and quality assurance throughout the AI lifecycle, including external redress mechanisms such as appeals processes for affected individuals and internal mitigations like metrics to identify unfair algorithms.

5.4 Risk assessment

Evaluates possible hazards from creating or using AI applications by gathering staff perspectives through workshops and detailed surveys, then quantifying and classifying these hazards to develop strategies for managing them across the organisation.

5.5 Impact assessment

Examines broader consequences for environmental, fairness, transparency and inclusivity outcomes using structured toolkits and questionnaires, resulting in documented actions to address potential harms from deploying an AI system.

5.6 Bias audit

An independent external expert collaborates with internal teams to measure whether algorithmic systems contain unfair discrimination in their decisions or training information, analysing findings and supporting implementation of corrective measures.

5.7 Compliance audit

Describes using compliance audits to review adherence to internal policies, external regulations and legal requirements relevant to AI products and processes. A third-party service provider works with the company using governance platforms to check alignment across different regulatory and legal requirements in various markets.

5.8 Conformity assessment

An impartial external body conducts exercises such as examination, verification and certification to confirm that products meet requirements in standards and regulations, with UK policy favouring accreditation by UKAS for high-risk applications.

5.9 Formal verification

Uses rigorous mathematical techniques to verify that system updates meet essential requirements before deployment, particularly valuable where failures could inflict serious harm on clients, organisations and regulatory compliance.

6.1 Steps to build AI assurance

Advises organisations to develop their AI assurance capability by considering existing regulations like UK GDPR and the Equality Act 2010, upskilling staff through training resources, reviewing internal governance and risk management processes, monitoring new regulatory guidance from sector regulators, and engaging with standards development organisations like BSI to help develop robust and accepted standards protocols.