Build an evidence trail your audit team can inspect.
Scoped testing and evidence packaging mapped to selected governance controls, with coverage and gaps stated explicitly. Indicative engagement bands: $50K–150K. Not certification or legal advice.
Different frameworks ask for different evidence.
The applicable obligations depend on the organization, system, role, and jurisdiction. Use qualified legal and certification professionals to determine requirements.
ISO 42001
An international AI management-system standard. Whether certification or specific evidence is required depends on the organization and procurement context.
- AI policy and governance
- Risk and impact assessment
- Data quality and lifecycle control
- Continuous monitoring and improvement
SR 11-7
U.S. banking guidance on model-risk governance and effective challenge. Applicability and required evidence should be determined by the institution's qualified risk team.
- Independent model validation
- Ongoing performance monitoring
- Documented limitations and assumptions
- Effective challenge and governance
EU AI Act
Obligations vary with system classification, provider/deployer role, and jurisdiction. Qualified counsel should determine which requirements and timelines apply.
- Risk management system
- Data governance and traceability
- Human oversight and transparency
- Post-market monitoring
This service starts with concrete artifacts: scoped adversarial tests, risk and limitation records, monitoring outputs, and decision logs. The SCBE test taxonomy can form a candidate crosswalk to selected controls, but the mapping must be reviewed for the actual system and audit scope.
Evidence, not slideware.
Four proposed deliverables, finalized against the agreed system, controls, and evidence format.
Test evidence package
JSONL output from the agreed project and system-specific tests, with evaluator decisions, uncertainty, coverage notes, and a reviewed control crosswalk.
- Full L1–L6 test pyramid output
- Clause-tagged pass/fail records
- Reproducible seeds and config manifests
- Hash-signed for chain of custody
Risk assessment report
Formatted for SR 11-7 review, signed and timestamped. The document your model risk committee presents upstream.
- Model inventory and classification
- Assumption and limitation register
- Adversarial finding summary
- Remediation recommendations
Drift monitoring setup
Ongoing adversarial probe suite wired to your endpoints. Quarterly re-tests with side-by-side drift reports.
- Scheduled adversarial probe runs
- Drift deltas vs. baseline capture
- Alerting hooks for significant regressions
- Quarterly monitoring digest
Audit response dossier
Everything your compliance team hands to auditors, pre-formatted. The "open the folder, hand it over" package.
- Executive summary and scope letter
- Clause-by-clause evidence index
- PDF and JSONL deliverables bundled
- Auditor FAQ and response templates
Three indicative engagement bands.
An MNDA can precede system access. Final price, timing, evidence format, and acceptance criteria are set by the written scope.
Initial Audit
Bounded initial pass. A 2–3 week delivery is a target after access is ready, not a blanket guarantee.
- One-time test run against your LLM
- Full evidence package (Deliverables 01+02+04)
- Risk assessment report
- 30-day support window for auditor questions
Annual Program
Continuous compliance. Your quarterly drift monitoring and audit response partner.
- Initial audit included
- Quarterly re-tests and drift monitoring
- Audit response support through the year
- Policy updates as regulations evolve
Enterprise
Dedicated liaison. Custom tests. Direct-to-auditor support calls.
- Everything in Annual Program
- Custom test authoring to your threat model
- Dedicated compliance liaison
- Direct-to-auditor support calls
Draft control crosswalk → SCBE test tiers.
This is a candidate engineering map, not a complete legal interpretation. Each row must be reviewed against the selected controls and actual evidence.
| ISO 42001 Clause | SCBE Test Coverage |
|---|---|
| Clause 8.2 — AI risk assessment | L3L4Functional and integration test suites |
| Clause 8.3 — AI impact assessment | L5End-to-end integration tests with impact scoring |
| Clause 8.4 — Data quality management | L2L3Input validation and schema enforcement tests |
| Clause 9.1 — Monitoring, measurement, analysis | L6Quarterly adversarial re-tests + drift reports |
| Clause 9.2 — Internal audit | L1L6Full pyramid replay with signed artifacts |
| Clause 10.1 — Continual improvement | L6Drift monitoring reports and remediation deltas |
| Clause A.6 — AI system lifecycle | L4L5Lifecycle integration and regression tests |
An inspectable technical foundation.
Our evidence is only as good as the system behind it. Here's what powers the paper trail.
SCBE-AETHERMOORE
A 14-layer governance pipeline with experimental geometry-based risk scoring and a project-authored test taxonomy. The formulas and implementation are open to inspection; effectiveness must be measured for the deployment in scope. Patent pending (USPTO #63/961,403).
The current evidence includes in-project regression checks and archived experiments. The 91/91 result is corpus fit, not generalization; compliance checks are project checks with documented coverage gaps, not certification.
Questions compliance teams ask first.
Do you certify us?
No. Certification is handled by an accredited certification body. This service can prepare scoped project evidence for your compliance team to review.
What LLMs do you test?
Compatible endpoints and checkpoints can be considered after access, data handling, evaluator fit, and required controls are scoped.
How long does the initial audit take?
Two to three weeks is an indicative target for a bounded initial scope after access is ready. The written scope sets the actual date.
Can you work with our existing GRC platform?
JSONL and PDF artifacts can be mapped to an agreed import schema. Compatibility with a specific GRC platform is verified during scoping.
Do you sign under NDA?
Yes. Every engagement starts with a mutual NDA (MNDA) before we see any model, endpoint, or internal documentation. Your red-team findings never leave the engagement.