GRCLibrary.ai

Framework

AI Assurance Evidence and Attestation Framework

This framework defines the assurance-evidence and attestation model for AI systems: the claim taxonomy, evidence classes, attestation tiers, and sufficiency criteria by which the organization organizes the outputs of its existing assurance activities into a standing, audit-ready evidence base across the AI lifecycle. Its object is the evidence, not the activity that produces it: it indexes, grades, and marshals what the assurance activities already generate so that any assurance claim about an AI system can be traced to the artefacts that support it, at a known weight and currency, on demand.

Type
Framework
Version
1.0.10
Date
2026-10-27
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
AI Governance
Review frequency
6 to 12 months and upon material AI governance or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose and scope
  • 2. Governance
  • 3. The assurance evidence and attestation model
  • 4. Evidence-to-activity index
  • 5. Requirements
  • 6. Framework alignment
  • 7. Limitations

Frameworks it maps to

Related documents