Evaluation & Testing

Validate that production-bound LLM and agentic AI systems have been tested against direct prompt injection, indirect prompt injection, jailbreak, refusal evasion, and (where applicable) multi-modal adversarial inputs, with documented findings, remediation, and re-test cycles.

Ensure that each AI system is subject to a documented risk assessment and AI System Impact Assessment (AIIA) aligned with ISO/IEC 23894 and ISO/IEC 42005, completed prior to production deployment and refreshed on material change or annually.

Ensure that every model promoted to production is uniquely versioned, traceable to its training data, evaluation results, and approval, and subject to controlled change-management with rollback capability.

Validate performance, fairness, and disparate-impact metrics for AI systems with protected-class implications, using methods appropriate to the system type and use case, with documented findings and remediation.

Validate that production predictive ML, computer-vision, recommender, and speech models have been tested against evasion attacks, model-extraction attacks, membership-inference attacks, data-poisoning detection, and (for vision) physical-world perturbations, with documented findings and remediation.

Require explicit, documented evaluation against defined thresholds — covering performance, fairness, robustness, safety, and (where applicable) drift baselines — as a gate to production deployment for every AI system.