AG-792
Assurance Framework Compliance
EU AI Act
NIST AI RMF
ISO 42001
AGS Assurance Framework | Group J — Meta-Governance | Version 2.1
Assurance Framework Compliance governs the classification, evidence collection, and attestation methodology for the three-tier AGS assurance framework (AGS-AUP, AGS-LA, AGS-RA), ensuring that governance assurance claims are supported by appropriate evidence and independently verifiable.
The AGS assurance framework defines three tiers of assessment:
AG-792 governs the process by which an organisation moves through these tiers, the evidence required at each tier, the qualifications required of assessors at the LA and RA tiers, and the conditions under which an assurance claim can be revoked. Without this dimension, an organisation could claim AGS compliance at any tier without producing evidence commensurate with that claim, undermining the credibility of the entire framework.
This protocol applies to any organisation that claims conformance with the AGS standard at any assurance tier. Specifically:
An assurance framework without governance over its own assurance process is self-undermining. If any organisation can claim "AGS compliant" without proportionate evidence, the claim becomes meaningless — exactly the problem that plagues self-certification regimes in AI governance today.
Concrete Failure Scenario: A financial services firm deploys autonomous trading agents and claims AGS-RA compliance in its prospectus filed with the FCA. The claim is based on an internal review performed by the firm's own compliance team, not an independent assessor. The firm has not engaged any external party, has not performed substantive testing of governance controls, and has not produced the evidence artefacts required for reasonable assurance. When the FCA examines the basis of the claim, the firm cannot produce an assurance report meeting AGS-RA requirements. The FCA issues an enforcement action for misleading disclosure, the firm's clients lose confidence in the governance claims, and the credibility of the AGS standard is damaged by association with an unsubstantiated claim.
The EU AI Act (Article 9) requires risk management systems to be documented and verifiable. ISO 42001 (Clause 9.2) requires internal audit programmes. SOX Section 404 requires independent attestation of internal controls. AG-792 operationalises the equivalent requirement for AGS: that conformance claims are backed by evidence at a level commensurate with the tier being claimed.
Test 6.1: Tier Claim Accuracy
Test 6.2: Assessor Independence
Test 6.3: Evidence Retention
| Score | Criteria |
|---|---|
| 0 | Organisation claims AGS conformance without specifying a tier or producing any evidence |
| 1 | Organisation has completed AUP self-attestation but has not engaged an independent assessor |
| 2 | Organisation has completed AGS-LA with an independent assessor and holds a current limited assurance report |
| 3 | Organisation has completed AGS-RA with substantive testing and holds a current reasonable assurance report with positive opinion |
Scenario A — Unsubstantiated Tier Claim: An organisation publishes "AGS-RA certified" on its website but has only completed a self-attestation checklist (AUP tier). A prospective client requests the assurance report. The organisation cannot produce one. The client withdraws from the procurement, and the organisation faces regulatory scrutiny for misleading claims.
Scenario B — Expired Assurance: An organisation completed AGS-LA 18 months ago but has not renewed. The assurance report has expired. The organisation continues to display the AGS-LA badge. Under AG-792, the conformance claim should have reverted to AUP at the 12-month mark. The stale claim is identified during a regulatory examination.
Scenario C — Conflicted Assessor: An assessor performing an AGS-RA engagement is discovered to be a significant shareholder in the assessed organisation. The conflict was not disclosed. The assurance report is invalidated, and the organisation's conformance claim reverts to AUP pending a new assessment by an independent assessor.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Tier specification on conformance claims | Art. 9 -- Risk management documentation | GOVERN 1.1 -- Legal and regulatory requirements | Clause 9.3 -- Management review |
| R2: AUP self-attestation checklist | Art. 9 -- Risk management system | GOVERN 1.1 -- Legal and regulatory requirements | Clause 9.2 -- Internal audit |
| R3: Independent assessor for LA | Art. 17 -- Quality management system | GOVERN 1.7 -- Accountability mechanisms | Clause 9.2 -- Internal audit |
| R4: Independent assessor for RA with substantive testing | Art. 17 -- Quality management system | GOVERN 1.7 -- Accountability mechanisms | Clause 9.2 -- Internal audit |
| R5: Assessor conflict of interest disclosure | Art. 17 -- Quality management system | — | Clause 9.2 -- Internal audit |
| R6: Assurance report content requirements | Art. 9 -- Risk management documentation | GOVERN 1.7 -- Accountability mechanisms | Clause 9.3 -- Management review |
| R7: No overclaiming of assurance tier | Art. 9 -- Risk management system | — | — |
| R8: 12-month assurance report validity | Art. 9 -- Risk management system | — | Clause 9.3 -- Management review |
| R9: Public register of assessments | Art. 17 -- Quality management system | GOVERN 1.7 -- Accountability mechanisms | — |
| R10 *: Open publication of framework documentation | — | — | — |
\* Standard-specific commitment; no direct regulatory equivalent.
Article 9 requires providers of high-risk AI systems to establish and maintain a risk management system. Article 17 requires a quality management system with documented procedures. AG-792 provides the assurance framework that enables organisations to demonstrate that these systems are in place and operating effectively, at a level of rigour commensurate with the assurance tier claimed.
GOVERN 1.1 addresses legal and regulatory requirements. GOVERN 1.7 addresses accountability mechanisms. The AGS assurance framework provides the accountability structure for governance conformance claims, ensuring they are verifiable and not merely declarative.
Clause 9.2 requires internal audit of the AI management system. Clause 9.3 requires management review. AG-792 extends these requirements to external assurance, defining the conditions under which an organisation can claim independent verification of its AI governance posture.