AI Assurance
Know the risks in your AI, and what to do about them.
Boards are asking whether the AI now running across the organisation is secure, compliant and behaving as intended. SEDDA gives CISOs, CTOs and heads of AI an independent, evidence-led view of where it stands, and a practical route to closing the gaps.
Sound familiar?
Three situations we are asked to help with.
The board wants answers
Copilot, ChatGPT and a dozen pilots are live across the business. Your CFO has read about another model going rogue and wants to know what you are doing about it. You need an answer grounded in evidence, not reassurance.
An AI product is heading for live
A proof of concept is about to become a production service. You need to know whether its models, data, suppliers, security and human oversight are good enough to proceed, and against which standard.
AI adoption has outrun governance
Different teams are experimenting with different tools, data and models. Nobody can say what has been approved, what is in use or where the data goes. You need a path from this to something you can govern.
What we do
Assurance you can act on, from a first assessment to ongoing oversight.
AI Risk and Readiness Assessment
A structured view of your current AI implementation against recognised standards and the risk profile you have chosen to accept. You see where you are non-compliant, where risk sits and what to fix first.
ISO/IEC 42001 Readiness
Gap assessment, policies, procedures and implementation support to prepare your AI management system for certification. Certification itself is carried out by independent bodies, which we can introduce.
AI Governance and Oversight
Accountability, decision rights, approval routes, human review points and monitoring, so AI use is visible, approved and explainable to the board and to regulators.
Security and Adversarial Testing
Attack paths, misuse scenarios, prompt and integration risks, data exposure and resilience against adversarial behaviour, drawing on SEDDA’s security testing practice.
Supplier and Third-Party AI Assurance
Challenge to supplier claims, model and provider dependencies, contractual and operational controls, change management and concentration risk.
Continuous Assurance
AI changes continuously, so a point-in-time sign-off expires. We define evidence gates and reassessment triggers, and reassess when models, data, prompts, suppliers or permissions change. Tooling to automate this monitoring is in development and is described as such.
Tech moves at the speed of innovation, adoption moves at the speed of trust.
Evan Solomon, Canada’s Minister of Artificial Intelligence and Digital Innovation, as quoted by the University of Waterloo, October 2025
Innovation creates capability. Assurance creates trust.
SEDDA
Standards
Recognised frameworks, not a black box.
Where it helps, SEDDA structures evidence and findings against recognised frameworks so your position is understandable to auditors, regulators and the board. The framework is chosen to fit your sector, use case and risk.
SEDDA does not issue certificates. Certification against ISO/IEC 42001 is carried out by independent certification bodies. We prepare you for it and can introduce assessors.
We tell you where the risk is and how to address it. We do not replace your observability, data protection or security tooling. Where that visibility is missing, we say so, because the gap is itself a risk.
ISO/IEC 42001
The AI management system standard. Readiness, gap assessment and implementation support.
NIST AI RMF
The AI Risk Management Framework: govern, map, measure and manage AI risk.
NCSC CAF
The Cyber Assessment Framework for operators of essential services and the public sector.
UK Government AI assurance guidance
Assurance techniques and principles for responsible AI adoption.
ISO/IEC 27001 and sector rules
Information security management and sector-specific requirements where relevant.
Your own risk appetite
The baseline you accepted at go-live is a reference point in its own right. We report drift from it.
How it works
Assurance is not a one-off gate.
Reporting is tuned to the audience: headline risk for the board, detail for the technical team. Depth follows the consequence of getting the decision wrong.
01
Understand
Your AI estate, intended use, stakeholders, standards and the level of risk you are prepared to accept.
02
Assess
Configuration, telemetry, governance and supplier evidence examined against the agreed criteria.
03
Decide
Clear findings, residual risk and a prioritised plan. Acceptance or remediation decisions stay with your accountable people.
04
Reassess
Evidence revisited when models, data, prompts, suppliers or operating conditions change, on a cadence you set.
Insights
Our research on AI assurance.
-
Sovereign AI Is an Operational Control Problem, Not Just a Hosting Problem
Read more: Sovereign AI Is an Operational Control Problem, Not Just a Hosting ProblemHosting AI in your own country does not, by itself, make it sovereign. SEDDA defines AI sovereignty as…
Let’s talk
Start with a conversation about your AI estate.
Tell us what is in use, what is coming and what you need to be able to say about it. We will propose a proportionate first assessment.