AI testing assurance
Find out whether the limits on an AI testing system hold before it tests you. We check a provider’s AI-driven testing, or your own, against our ten published controls, and test them in practice where the provider agrees.
What it answers.
- Will this AI testing system stay inside the scope we signed, even when it finds a way out?
- Can someone on our side stop it at once, without calling the provider?
- Where does our data go, and which models see it?
- What can we show our board or supervisor beyond the provider’s own word?
What is in scope.
Review of the contract, rules of engagement and technical controls of AI-driven security testing, bought from a provider or run by your own team, against our ten published controls. The exact boundary is written into the authorization before work starts.
- The contract, statement of work and rules of engagement, read against all ten controls
- Where the signed target list is enforced, and what the system does when it tries to pass it
- Outbound access from the testing environment, checked against the destinations the rules of engagement name
- Approval points and the stop you hold, including the written rule on who may restart
- The monitor that watches each action and the log of every action, and whether the agent can see or alter either
- Where the model runs and your data goes, whether your data trains any model, and which models and outside AI services are used
- Who checks each finding before it reaches you
- AI testing run by your own team, reviewed the same way
How it runs.
-
Agree the subject
We agree which AI testing is assessed, a provider’s service or your own, which engagement it covers and who on your side owns the result. Technical checks in a provider’s environment need the provider’s written agreement as well as yours.
-
Read the paper
We read the contract, statement of work and rules of engagement against each control, and list what is promised, what is missing and what is left to the model’s instructions.
-
Verify outside the model
We check that the system, not the prompt, enforces scope, that outbound access is closed except to named destinations, that a separate monitor watches each action, that the agent cannot alter its log, and where the model and your data sit.
-
Observe a run
We watch a live or staged run against agreed targets. The person who holds your stop uses it mid-run. In a staged run we add a target outside scope and an objective scope cannot reach, and record what the system refused, when it stopped and what the monitor flagged.
-
Report
Each control is marked met, partly met, not met or not evidenced, with the evidence and the provider’s response, and mapped to the regulatory texts you name.
-
Retest
After fixes, we check the controls that failed and confirm which are closed.
What you receive.
- A finding for each of the ten controls, marked met, partly met, not met or not evidenced, with the evidence behind it
- A record of the observed run: what the system did, what it refused, what the monitor flagged and when the stop took effect
- Contract and rules-of-engagement clauses that would close each gap
- A table linking each finding to the texts you name, such as the CBUAE guidance note, the QCB AI Guideline or the NCA draft guidelines
- An executive summary for the board or risk committee
- A retest letter confirming which controls are closed
What we need from you.
- The contract, statement of work and rules of engagement for the AI testing to be assessed
- The provider’s written agreement to technical checks in its environment, or a staged copy we can test
- The person who holds the stop, available during the observed run
- The regulatory texts and data-location rules that apply to you
Choose AI testing assurance before you sign with a provider that uses AI to test, before your own AI testing reaches production systems, or when your board or supervisor asks how you know its limits hold.
What the rules ask.
Each text quoted as published, with how binding it is and what this work hands back for it. Only a regulator can say whether work meets its rule.
United Arab Emirates
6 clauses Guidance
-
AI guidance note, Section 6(b)
Guidance“Independent third-party providers of AI, independent experts and third parties (willing to challenge and question the use of AI in an LFI) should be engaged periodically to assess the development of and use of AI including third-party AI providers.”
- What you get
- An outside assessment of a provider’s AI testing, with the evidence for each finding.
- Applies to
- Licensed financial institutions in the UAE
-
AI guidance note, Section 9(b)
Guidance“annual cybersecurity reviews by independent and suitably qualified third parties and pre-deployment tests and checks”
- What you get
- An assessment before you sign with a provider, which can be repeated each year.
-
AI guidance note, Section 9(a)
Guidance“Contracts should include provisions that ensure access to relevant information, audit rights and compliance with CBUAE requirements.”
- What you get
- Contract clauses for each gap, including the access and audit rights the technical checks need.
-
AI guidance note, Section 6(f)
Guidance“LFIs should at all times retain the clear and immediate ability, with human intervention, to cease use of an AI model system, technology or application deployed or utilized.”
- What you get
- Control 4 tested: the person who holds your stop uses it during the observed run, and we record when the halt took effect.
-
AI guidance note, Section 6(c)
Guidance“LFI should ensure that automatic updates their AI tools are tested before implementation.”
- What you get
- Control 9 checked: the models and AI services the provider names, and the notice it must give before changing them.
-
AI guidance note, Section 5(c)
Guidance“rules on data being retained in the country”
- What you get
- Control 8 checked: where the model runs and where your data goes, against the location rules you name.
Qatar
3 clauses Binding
-
Artificial Intelligence Guideline, clause 13.4.4
Binding“Have the authority and means to intervene in the operation of the High-Risk AI System or interrupt the system through a “stop” button or a similar procedure.”
- What you get
- Control 4 tested: a stop your own person holds and can use without calling the provider.
- Applies to
- The Supervisor of a high-risk AI system at a QCB-licensed entity. Whether it covers AI testing you buy is our reading, not QCB’s
-
Artificial Intelligence Guideline, clause 13.6.2
Binding“The AI System must have built in guard rails or specific limits that the AI cannot override.”
- What you get
- Controls 1 and 3 checked outside the model: whether the system itself enforces the target list and the approval points.
- Applies to
- Fully autonomous high-risk AI at a QCB-licensed entity
-
Artificial Intelligence Guideline, clause 13.6.5
Binding“The Supervisor(s) must have the capacity to close the system down in the event outputs from or data around the system seems aberrant.”
- What you get
- A timed record of the stop taking effect during the observed run.
Saudi Arabia
5 clauses Draft
-
Draft AI Cybersecurity Guidelines (AICG-1:2026), 4-1-3
Draft“Ensure AI Developers’ compliance with the entity AI cybersecurity requirements is contractually established, and monitoring and periodically assessing such compliance.”
- What you get
- A periodic assessment of your AI testing provider against the ten controls, with contract clauses for each gap.
- Applies to
- Public consultation draft. The draft says the guidelines are not mandatory
-
Draft AI Cybersecurity Guidelines (AICG-1:2026), 1-1-2
Draft“Conduct a cybersecurity risk assessment to classify AI agents’ actions by potential impact, likelihood and reversibility, and apply appropriate safeguards.”
- What you get
- Control 3 checked: who set the approval list, and whether the system can change it.
-
Draft AI Cybersecurity Guidelines (AICG-1:2026), 2-3-1
Draft“restricting protocols, ports, destinations and egress paths to approved requirements only”
- What you get
- Control 2 tested: outbound access from the testing environment, against the destinations the rules of engagement name.
-
Draft AI Cybersecurity Guidelines (AICG-1:2026), 2-7-2
Draft“Conduct AI system testing through different methods such as red teaming and adversarial evaluation and validate human override.”
- What you get
- The stop used during the observed run, to show that a person can override the system.
-
Draft AI Cybersecurity Guidelines (AICG-1:2026), 2-8-2
Draft“Log and monitor actions taken by AI systems and cybersecurity-relevant events, including data uploads and downloads, and AI-initiated actions that may impact the confidentiality, integrity or availability.”
- What you get
- Controls 5 and 7 checked: a monitor separate from the agent, and a complete log the agent cannot alter.
United States
5 clauses Guidance
-
Careful adoption of agentic AI services, Human in the loop, page 22
Guidance“Ensure decisions about when human approval is required are determined by system designers or operators, not delegated to the agentic AI system”
- What you get
- Control 3 checked: whether people set the approval points, and whether the system can change them.
- Applies to
- Organizations adopting agentic AI
-
Careful adoption of agentic AI services, Secure by default, page 20
Guidance“Set system configurations to fail-safe by default requiring agents to stop and escalate issues to human reviewers in uncertain scenarios”
- What you get
- Control 6 tested in a staged run: an objective scope cannot reach, to see whether the system stops and asks.
-
Careful adoption of agentic AI services, Isolation, page 20
Guidance“Isolate agents into enclaves with no write access to logs”
- What you get
- Control 7 checked: whether the agent can write to its own log.
-
Third-party service provider letter, Data Use and Exit Obligations
Guidance“Where relevant, Covered Entities should consider including a clause related to the acceptable use of Artificial Intelligence (“AI”), and whether the Covered Entity’s data may be used to train AI models or be otherwise disclosed to additional parties.”
- What you get
- Control 8 checked: whether the contract says if your data may train any model.
- Applies to
- NYDFS-regulated entities
-
Third-party service provider letter, Data Location and Transfer Restrictions
Guidance“Requirements for the TPSP to disclose where data may be stored, processed, or accessed; obtain prior written approval for cross-border transfers (or full prohibitions of this practice)”
- What you get
- Control 8 checked: where your data is stored, processed and accessed, against what the contract says.
- Applies to
- NYDFS-regulated entities. The letter says this provision is not explicitly required by its Cybersecurity Regulation
International
6 clauses Guidance
-
Sound practices for AI, final report, Sound Practice 12, page 60
Guidance“appropriately oversee the provision of third-party AI services. Financial institutions may (where appropriate) use independent auditors and pooled audits.”
- What you get
- An outside review of one third-party AI service, as you will use it.
- Applies to
- Financial institutions
-
Sound practices for AI, final report, Sound Practice 12, page 61
Guidance“Financial institutions obtain appropriate, risk-based assurance and information from third-party AI providers to understand, assess and manage relevant risks.”
- What you get
- Evidence from checks and an observed run, in place of the provider’s own statement.
-
Sound practices for AI, final report, Sound Practice 10, page 51
Guidance“‘Kill switch’: mechanisms enabling human intervention to halt or constrain AI operations”
- What you get
- Control 4 tested: what the stop halts, and how fast.
-
Sound practices for AI, final report, Sound Practice 10, page 53
Guidance“monitoring and documenting anomalous behaviour that may indicate misuse or scope creep”
- What you get
- Control 5 checked: whether the monitor flags a decoy target outside scope in a staged run.
-
Sound practices for AI, final report, page 26
Guidance“Financial institutions protect documentation and lifecycle records from unauthorised manipulation (modification or deletion) and, if possible, make them immutable or keep immutable copies”
- What you get
- Control 7 checked: whether the log is protected from change, and complete when set against what we observed.
-
Sound practices for AI, final report, page 59
Guidance“Highly autonomous AI systems may devise ways to escape or evade these environments, which may in turn warrant additional controls and safeguards.”
- What you get
- Scope, outbound access and the monitor tested in a run, not taken on trust.
Common questions.
Short answers, each resting on the texts quoted above or on our published reference pages.
- Does any regulator require this assessment?
- No regulator requires it by name. None of the 81 rules and benchmarks with public text in our testing rules reference, from the US, the Gulf and abroad, sets rules for tests run by AI, as of October 30, 2026. Several texts ask for what it checks. The UAE central bank’s guidance asks for independent experts to assess AI use, including third-party AI providers. Saudi Arabia’s draft NCA guidelines ask entities to assess AI developers’ compliance periodically. The FSB’s final sound practices say institutions may use independent auditors.
- Is this the same as CREST’s AI accreditation?
- No. CREST accredits testing firms, and since July 28, 2026 a firm can have its use of AI in penetration testing assessed. Our assessment looks at one service as you will use it, or at your own AI testing, against the ten controls. It does not replace an accreditation, and we do not issue one. An accredited provider can still be assessed for your engagement.
- Why test the controls instead of reading the provider’s documents?
- In 2026, AI systems under cyber evaluation reached real organizations because limits written down did not hold in practice. At the UK AI Security Institute, scope lived in the instructions to the model, and the institute says the margin rested “on human vigilance rather than a technical barrier”.
- Can you test inside our provider’s environment?
- Only with the provider’s written agreement as well as yours. Without it, we review the paper, observe a run from your side, and mark the controls we could not test as not evidenced. Audit rights in the contract help: the UAE central bank’s guidance asks that contracts with AI providers include them.
- Does a pass mean the system is safe?
- No. It means the controls held on the dates we checked, in the configuration we saw. A new model, a changed setting or a new hosting platform can undo that. That is why control 9 asks the provider to give notice before changing models, and why we retest.
- Does this cover AI testing our own team runs?
- Yes. The ten controls apply whoever operates the system. Your own team takes the provider’s place in the review.
- How is this different from testing our own AI systems?
- Red teaming an AI system tests it for unsafe or insecure behavior, such as prompt injection or ignoring a stop. This assessment checks the controls around an AI system that tests you. Say which one you mean when you ask.
- What happens to the findings?
- They go to you and the people you name. We do not publish them or name the provider.
The reference behind it.
Our dated, sourced pages on the rules, terms and evidence this service draws on.
Ten controls for AI that tests
The controls this assessment checks: what to require, the evidence behind each one and the question to put to any provider.
ControlsWhen AI under test reached real organizations
The 2026 incidents in which AI systems under evaluation acted outside their scope, and the causes they share.
IncidentsRules for AI that tests
What regulators and standards bodies ask of AI-driven testing so far, marked binding, guidance or draft.
RulesSecurity testing rules, US and the Gulf
What each US and Gulf testing rule requires, coded and sourced, including what each says about automated and AI-driven testing.
Testing rulesKill switch, scope enforcement and other terms
The words providers and regulators use for AI testing, defined and sourced.
GlossaryAI-driven testing reference
Terms, rules, controls and incidents in one dated section, reviewed every week.
Section home
Name the AI testing you want checked.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.