Legal, Risk & Compliance · Module
AI Assurance & Model Risk
Inventory, validate and attest every AI system and Digital Employee that affects people
AI Assurance & Model Risk gives tenants an inventory and assurance process for AI systems, models and Digital Employees that affect customers, employees or money. Validation packs, bias tests, ratings and attestations draw on real evaluation and monitoring data.
What it does
AI Assurance & Model Risk is designed to give tenants an inventory and assurance process for AI systems, models and Digital Employees that affect customers, employees or money, drawing on real evaluation and monitoring data rather than questionnaires alone. One3 applies the same process to its own agents.
Inventory and classification
The inventory is auto-populated from Model Hub routes, AI Workforce agents and skills, fraud models and tenant-registered external AI systems, with owner, purpose, data used and affected populations. A new agent deployment creates an inventory item automatically. A questionnaire classifies each use case by impact, for example employment, credit-adjacent or consumer-facing, and by jurisdictional risk classes such as EU AI Act categories used as a framework (to be verified). High-impact items require validation before production use, enforced through the AI Governance gate.
Validation and testing
Validation packs bring together evaluation evidence (quality, safety, cost, latency), test dataset datasheets and known limitations, signed off by an independent validator who is not the owner. Bias tests compute group fairness metrics on outcomes where lawful attributes or approved proxies exist, with minimum sample sizes and confidence intervals; a threshold breach blocks promotion. Recruit screening suggestions are one planned subject. Bias metrics are deterministic statistics, not language model output.
Ratings and attestations
Model risk ratings combine impact, complexity, validation results and monitoring status, with approval and a review date set by the rating. Owners attest periodically that use stays within purpose, human oversight is in place and incidents are reported; missing attestations escalate.
GA
Monitoring linkage attaches drift, incidents and guardrail events to inventory items, and severe incidents trigger rating review. Standards mapping links ISO 42001, NIST AI RMF and EU AI Act obligations to GRC controls (licensing to verify). Model cards and transparency notices are generated from recorded data only. AI impact assessments link to DPIAs. Material model, prompt or route changes require revalidation. Planned for W4 (Year 3).
Features
What AI Assurance & Model Risk includes
Model and AI system inventory
Auto-populated from Model Hub, AI Workforce, fraud models and registered external systems.
Use-case risk classification
Impact and jurisdictional risk classes, with high-impact items gated before production.
Validation packs
Eval evidence, datasheets and limitations signed off by an independent validator.
Bias testing
Group fairness metrics with minimum sample sizes and confidence intervals; breaches block promotion.
Model risk rating
Rating from impact, complexity, validation and monitoring, with approval and review date.
Attestations
Periodic owner attestations with escalation when missing.
Monitoring linkage
Drift, incidents and guardrail events attached to inventory items.
Standards mapping
ISO 42001, NIST AI RMF and EU AI Act obligations mapped to GRC controls (licensing to verify).
Model cards and transparency notices
Generated from recorded data only, reviewed before publish.
Impact assessments and change management
AI impact assessments linked to DPIAs; material changes require revalidation.
Workflow
Deploying a high-impact agent
- 1
A new Digital Employee deployment creates an inventory item
- 2
The owner classifies the use case as high-impact
- 3
A validation pack is assembled from eval results
- 4
Bias tests run where lawful
- 5
An independent validator signs off and a risk rating is approved
- 6
The AI Governance gate allows production use and attestations are scheduled
AI
AI skills and Digital Employees
Validation pack assembly
Assembles packs from eval harness results, datasheets and incidents for validator sign-off.
Impact questionnaire pre-fill
Pre-fills classification questions from inventory metadata.
Model card drafts
Drafts model cards and transparency notices from recorded data only.
Incident and drift linkage
Links incidents to inventory items with severity suggestions.
Digital Employees that use this module
- AI Agent Governance Auditor
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Does this cover One3's own Digital Employees?
Yes. AI Workforce agents and skills appear in the inventory automatically and follow the same validation and attestation process.
Are bias metrics generated by AI?
No. Bias metrics are deterministic statistics with minimum sample sizes and confidence intervals.
Does it make us EU AI Act compliant?
It maps obligations to controls as a framework. Compliance depends on your systems and must be verified with counsel.
See AI Assurance & Model Risk in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.