AI ASSURANCE TOOL

AI assurance lifecycle

PUBLIC SECTOR · MAPPED TO PUBLISHED GUIDANCE

v0.2 | November 2026
govassure.ai

Colour by Select any stage, layer or gate for the relevant guidance, the checklist and the risk of not having it.

BUSINESS & REGULATORY DRIVERS DSIT Introduction to AI assurance · Trusted third-party AI assurance roadmap · AI Playbook for the UK Government · ATRS · AI Cyber Security Code of Practice · NCSC secure AI guidelines · AI Security Institute · Data and AI Ethics Framework · Portfolio of AI assurance techniques · CAF A2 Accountable: SIRO | CISO | Senior Responsible Owner for each AI use case | Data Protection Officer | Head of Security Architecture | Service Owners

ASSURANCE ATTRIBUTES | WHAT EVERY PUBLIC-SECTOR AI SYSTEM MUST EXHIBIT

The AI assurance lifecycle — eight stages

Assurance layers and who is accountable

The AI lifecycle, end to end

PHASES

FEEDBACK LOOP — monitoring alerts, evaluation findings, incident lessons and ATRS updates return to PLAN and DESIGN, and revise the risk acceptance that let them through

GOVERNANCE CADENCE Daily Abuse and safety alerts · failed human-control escalations Weekly Model or prompt change review · open assurance findings Monthly AI register review · ATRS draft and update status Quarterly Risk appetite and ethics review · CAF / cyber return Annually Independent assurance for high-risk uses · full re-evaluation

LIFECYCLE GATES — WHAT BLOCKS, WHAT WARNS Checks an organisation can run against its AI estate. Thresholds are illustrative opening positions; every bypass is a time-bound Design Authority exception.