The GovAssure scheme
Critical departments and essential services are assessed against the NCSC Cyber Assessment Framework under the government GovAssure scheme. AI systems sit inside that cyber-risk picture even when there is no separate AI return.
CAF · NIST AI RMF · EU AI Act · OWASP
GOV Assured · AI assurance hub
A practical hub for UK public-sector AI assurance: self-assessment, a 40-control catalogue, lifecycle guidance, live intelligence from public sources, and an EU AI Act applicability checker.
Critical departments and essential services are assessed against the NCSC Cyber Assessment Framework under the government GovAssure scheme. AI systems sit inside that cyber-risk picture even when there is no separate AI return.
NCSC has not published an official AI profile of the CAF. This hub offers GOV Assured’s own AI overlay and catalogue so teams can rehearse evidence against CAF contributing outcomes while that gap remains.
Controls and guidance draw on OWASP AI Exchange, NCSC secure AI guidelines, the DSIT AI Cyber Security Code of Practice, NIST AI RMF / AI 600-1, and the EU AI Act — cited in the Sources note.
Official updates, AI-related threats and UK Parliament or government publications. Items link to their original source (new tab). Prefer live /api feeds when deployed; otherwise the static snapshot in /data/feeds.json.
Loading feeds…
Verified AI tools, security guidance and governance from UK government and public bodies. Cards cite official pages only (checked at build time). Status labels follow the source page (for example i.AI “Phase” on ai.gov.uk/our-work).
Incubator for AI (i.AI) products plus departmental systems evidenced by Algorithmic Transparency Recording Standard (ATRS) records or GOV.UK publications.
AI tooling to strengthen consultation analysis and help policymakers hear citizen voices at scale.
Why it matters Policy and engagement teams may be asked to trial or reuse Consult patterns for large consultation exercises.
AI meeting minutes assistant for government users (frontline / productivity suite).
Why it matters Typical “safe meeting notes” use case — check local data-handling rules before any similar tool is adopted.
Parliamentary procedure assistant (quick, reliable answers on House procedure). ATRS record published.
Why it matters Example of a live specialised LLM assistant with a public transparency record — useful ATRS template for similar tools.
Legal research / legislation assistant listed Live on i.AI Our Work; lab instance at lex.lab.i.ai.gov.uk. Open source on GitHub.
Why it matters Shows how legal-research copilots are being trialled inside government with a public lab endpoint.
i.AI discovery / research assistant listed in Beta on the Government work page.
Why it matters Early-stage research aid — treat as Beta and follow departmental AI use policy.
AI co-pilot for customer-service / civic engagement functions. Phase Live on frontline Our Work; chatbot components open-sourced.
Why it matters Pattern for contact-centre / advice copilots that other departments reuse or adapt.
MoJ speech-to-text / transcription capability for justice workflows. i.AI frontline page lists Phase as Scaling; GOV.UK transparency publication and ai.justice.gov.uk site.
Why it matters High-sensitivity transcription — security, retention and accuracy evidence will be asked for in CAF / assurance reviews.
Conversational assistant for finding government information on GOV.UK. Public ATRS record describes the service.
Why it matters Citizens may use Chat instead of search — useful to understand what it can and cannot answer, and how transparency is documented.
Cabinet Office Assist — algorithmic / AI assistant covered by a published ATRS record.
Why it matters Central department example of an internal assistant with a transparency record.
HMRC digital assistant for customer queries — ATRS record published.
Why it matters Large-scale citizen-facing AI; useful reference for service design and transparency expectations.
Internal HMRC generative AI assistant for security policy / guidance questions (ATRS).
Why it matters Rare public example of an internal cyber/security genAI tool with a transparency record — not a public scanning product.
DWP conversational / voice platform for customer interaction — ATRS record.
Why it matters Shows DWP-scale conversational AI in production with published transparency evidence.
DfE AI correspondence drafting tool — ATRS record.
Why it matters Common correspondence-drafting use case with formal transparency documentation.
Home Office Complexity Application Routing Solution for Visits — published ATRS record (routing / triage style system).
Why it matters Example of HO algorithmic routing in an operational immigration workflow — not a public genAI chatbot.
MoJ AICE chatbot Nova — ATRS record for an operational chatbot service.
Why it matters Complements Justice Transcribe as a second MoJ AI service with public transparency evidence.
NCSC AI guidance and threat assessments, plus AISI evaluation tooling. Active Cyber Defence (ACD) is NCSC’s broader defensive services suite — not AI-specific; see the note card rather than treating ACD as an AI product.
Joint guidelines covering secure design, development, deployment, and operation of AI systems (secure-by-design lifecycle).
Why it matters Baseline UK/international expectations when building or buying AI — cited by the DSIT AI Cyber Security Code of Practice.
Organisational guidance on integrating cyber security into AI projects from the start (secure by design, leadership, process).
Why it matters Practical entry point for anyone adopting AI in an organisation, not just model builders.
NCSC assessment of how AI was already changing the cyber threat in the near term.
Why it matters Threat context for risk registers and CAF evidence when AI-enabled intrusion is discussed.
Updated NCSC assessment: AI will almost certainly make intrusion more frequent and efficient; warns of a “digital divide” in defensive capability through 2027.
Why it matters Current planning horizon for CNI and departmental cyber strategies — pair with board-level threat briefings.
Security principles for anyone developing, deploying or operating systems with an ML component; underpin the secure AI guidelines.
Why it matters Concrete ML-specific risks (data, models, supply chain) beyond generic app security.
Practical NCSC blog guidance on least privilege, sandboxing, oversight and threat modelling for agentic AI deployments.
Why it matters Agentic / tool-using AI pilots are spreading — this is the current NCSC control narrative to cite.
NCSC blog on the ETSI Securing AI technical specification (baseline cyber security requirements for AI models and systems), following the UK Code of Practice.
Why it matters Links UK voluntary code to the emerging global minimum requirements suppliers may claim against.
NCSC blog on adapting vulnerability disclosure programmes for AI safeguard bypasses (“from bugs to bypasses”).
Why it matters Sets expectations for red-teaming / disclosure when models have safety filters — relevant to eval and assurance teams.
NCSC advice-guidance topic indexes for Artificial intelligence and Frontier AI — entry points to the wider NCSC AI corpus.
Why it matters Bookmark for the latest NCSC AI articles without hunting individual URLs.
NCSC Annual Review chapter covering AI security work, the AI Security Code of Practice, LASR, and agentic AI for cyber defence.
Why it matters Authoritative year-in-review of NCSC AI priorities for briefing senior stakeholders.
NCSC suite of defensive services for organisations (phishing, takedown, protective DNS, and related ACD offerings). Not an AI product — included so it is not mistaken for AI security tooling.
Why it matters Still useful defensive cover for departments running AI services; do not cite ACD as “AI assurance”.
Open-source framework for LLM / AI evaluations used by the AI Security Institute, with docs at inspect.aisi.org.uk and code on GitHub.
Why it matters Practical eval tooling departments can reuse for model / system testing and red-teaming evidence.
Cross-government playbooks, transparency mandates, cyber code of practice, and digital / AI opportunity plans.
Practical playbook for using AI safely and effectively across government.
Why it matters Default reference for UK government policy on using AI at work.
Standard and hub for publishing records of algorithmic / AI tools. Mandatory scope and exemptions policy for in-scope organisations.
Why it matters If your team ships an algorithmic tool, you may need an ATRS record — start from the hub and publish guidance.
Voluntary code for the cyber security of AI, building on NCSC secure AI guidelines.
Why it matters What to ask suppliers and in-house builders to align with on AI cyber security.
Government plan to capture AI opportunities across the UK economy and public sector.
Why it matters Sets the growth / adoption narrative that local AI business cases are expected to support.
Policy paper on modernising digital government (includes the digital / AI capability agenda).
Why it matters Broader digital reform context for AI programmes and shared platforms.
Official introduction to AI assurance techniques for organisations deploying AI.
Why it matters Shared vocabulary for assurance activities (testing, impact assessment, audit) before deeper CAF mapping.
Earlier roadmap for building the UK AI assurance ecosystem (standards, tools, professionalisation).
Why it matters Background reading — still cited, but check newer Playbook / Code of Practice for current practice.
Framework for automated decision-making in government (ethics, transparency, accountability).
Why it matters Still the named ADM ethics framework when automated decisions affect individuals.
Programme showcasing exemplar AI uses across government.
Why it matters Find peer examples before proposing a new AI project.
Rate CAF v4.0 contributing outcomes for your AI estate. Browser-only; export CSV/JSON.
Open →GA-* controls across the lifecycle, mapped to CAF, OWASP, NIST and the EU AI Act.
Open →Eight stages from Plan to Retire with gates, layers and official guidance chips.
Open →Official UK publications this model draws on, with Sources codes.
Open →Short definitions of the terms used on this site.
Open →Short question flow: likely applicability, risk tier and key dates. Not legal advice.
Open →CAF-oriented assessment app on assessment.govassured.com.
Open →AI safety, security, governance and ethics quiz.
Open →List systems, models, data and suppliers in scope for cyber and AI risk.
Use the AI overlay indicators of good practice against each contributing outcome.
Collect evidence against the 40-control catalogue and related OWASP / NIST / EU hooks.
Export CSV/JSON from this browser, close gaps, and revisit after material change.
OWASP AI Exchange control IDs are used under the project licence; URLs for OWASP and other non-government sources sit in the footer Sources note.
AI-focused assurance work that mirrors the GOV Assured services offer.
Self-assessment against CAF v4.0 with an AI overlay, readiness for the government GovAssure scheme context, and mapping to the AI Cyber Security Code of Practice and NCSC secure AI guidelines.
Support for AI go-live decisions, residual risk acceptance, ATRS drafting, and design-authority packs that record model, data, human-control and supplier choices.
Planning independent evaluation, red-teaming and assurance techniques drawn from the DSIT portfolio, including where EU AI Act high-risk duties may apply.
Reference patterns for model access control, prompt and tool mediation, logging, and DevSecOps for AI systems aligned to NCSC and OWASP AI Exchange controls.
AI safety, security, governance and ethics practice via the GOV Assured quiz and related material.
GOV Assured is a cyber assurance consultancy. This hub sets out AI assurance tools that run on govassured.com addresses: assessment, lifecycle, controls, guidance, glossary and an EU AI Act applicability checker. Mentions of GovAssure refer to the UK government scheme of that name; this site is published under the GOV Assured brand.
Write to the consultancy.