What is AI assurance

AI governance and AI assurance are not the same thing

Governance is what you do. Assurance is how you show it. A function can govern its AI well and still fail at assurance, because doing the work and being able to prove it are different capabilities. Governance produces controls, owners and decisions. Assurance produces confidence in those controls for a reader who needs to rely on them, whether that is the board deciding whether to trust the programme, the regulator testing whether it is real or the enterprise customer deciding whether to buy. A maturing function usually has governance in hand and is reaching for assurance, because that is the harder half.

The levels of AI assurance

Assurance comes in degrees, and it helps to name them. The first is self-assessment, where the organisation reviews its own governance against a reference and states where it stands. The second is independent assurance, where an internal audit function or an external provider examines the governance and gives an opinion on it. The third is certification, where an accredited body audits the organisation against a standard such as ISO/IEC 42001 and issues a certificate. Each level asks more of the evidence, and each carries more weight with the reader precisely because it does. The Institute of Internal Auditors’ Three Lines Model describes how these roles separate, with management owning the controls and an independent function providing assurance over them.

What every level of assurance depends on

Under all three levels sits the same requirement, evidence. ISO 19011 describes an audit as the gathering of evidence and its evaluation against criteria, and that holds whether the audit is internal or external. Assurance is only as strong as the records it draws on. A control someone describes in a meeting is a claim. A control with a dated record showing it operated is evidence. This is where most AI assurance is thin, because governance records often live in shared drives and email, where they prove their contents but not their history. How to prepare for an AI governance audit sets out the qualities that make a record count.

Why AI raises the assurance bar

AI makes assurance harder in specific ways. Systems change without a release, as a model is retrained or a vendor updates it underneath you, so a control that held at assessment may not hold now. Systems act, so the record of what a system did matters as much as the record of what it was allowed to do. And the set of AI in use itself drifts, as teams adopt AI tools without a formal decision, so the first assurance question, what AI is even in scope, is one many organisations cannot answer confidently. Assurance over AI therefore depends on a current picture of the AI footprint, not a list drawn up once.

What AI assurance is not

Assurance is not a guarantee that nothing will go wrong, and it is not a score that collapses the judgement into a number. An assurance provider forms an opinion. It does not certify that a system is safe or lawful in some absolute sense. The reader who understands assurance reads a clean opinion as confidence built on evidence, not as a promise. Framing assurance as a green light or a pass mark misrepresents what it is, and the sophisticated reader this work is for will notice.

Where Aicura fits

Aicura helps at each level in a different way. For self-assessment, risk and impact assessments apply the frameworks you enable and return guidance against them, and Risks and Controls shows each control as applicable, implemented and tested. For an internal auditor, an assurance provider or a certification body, what matters is that each decision sits against the system it concerns, attributed to the person who made it, and that the version of the register record they read is the version that was assessed.

At Pro, the Evidence Vault keeps sealed snapshots of governance events as they happen and anchors each one to public infrastructure outside Aicura shortly after capture, so a reviewer can confirm when each was captured and that it has not changed since. Aicura does not form the opinion or issue a certificate. Your assurance providers do that, and you stand behind the governance.

Sources

• ISO 19011:2018, Guidelines for auditing management systems, International Organization for Standardization, iso.org
• ISO/IEC 42001:2023, AI management system, International Organization for Standardization, iso.org
• The IIA’s Three Lines Model, Institute of Internal Auditors, theiia.org

A note on this page

This explainer is general information on what AI assurance means and what it depends on. It is not legal advice and it does not tell you what level of assurance a particular obligation or counterparty requires. For how assurance applies to your organisation, read the primary sources above and take your own professional advice.