AI Assurance DirectoryArticles
Every factual claim links to a public source. Where we give analysis rather than a sourced fact, we label it. Official terms are also collected on the glossary. Subscribe via RSS, Atom or JSON Feed.
-
CISA joint principles for integrating AI into operational technology: what plant and infrastructure buyers can ask vendors
The four principles in the December 2025 CISA, ASD ACSC and partner guidance on AI in OT, with the vendor-transparency, testing and failsafe passages that matter to buyers.
-
EU AI Act Article 4 AI literacy: what the Commission Q&A and the amended text say
What Article 4 asks of providers and deployers after the 2026 AI Omnibus, per the Commission's Q&A and the Service Desk text. No certificate or specific training is mandated.
-
EU AI Act Article 6 high-risk classification: Annex I products, Annex III uses and the safety-component rule
How Article 6 sorts AI systems into high-risk, including the 2026 Omnibus paragraphs on safety components and the Article 6(3) documented-assessment route for Annex III.
-
EU AI Act Articles 14 and 26: human oversight, who builds it and who staffs it
Article 14 makes providers design high-risk AI for human oversight, including a stop control; Article 26 makes deployers assign competent people and keep logs. Quoted from the Service Desk text.
-
EU AI Act Articles 9 and 15: risk management, accuracy, robustness and cybersecurity for high-risk AI
What Articles 9 and 15 of the AI Act require of high-risk systems, quoted from the Service Desk text: lifecycle risk management, declared accuracy, fail-safe robustness and poisoning defenses.
-
MITRE ATLAS for AI red teaming: tactics, techniques, mitigations and case studies
What the public MITRE ATLAS data release contains, how a red team can use its IDs and mitigations in a test plan, and what it does not certify.
-
NIST AI RMF Playbook: Measure and Manage suggested actions for safety-critical AI
What the NIST AI RMF Playbook is and which Measure 2.5, 2.6 and Manage 2.4 suggested actions map to validation, fail-safe testing and bypass plans on a safety-critical program.
-
NIST Cyber AI Profile (IR 8596): what the preliminary draft covers and how far to rely on it
NIST IR 8596 is a preliminary-draft CSF 2.0 profile for AI cybersecurity with Secure, Defend and Thwart focus areas. What the NIST page says, its draft status, and what to ask suppliers.
-
NIST SP 800-53 control overlays for securing AI systems (COSAiS): the five use cases and what is still draft
NIST's COSAiS project is building SP 800-53 overlays for generative AI, predictive AI, single- and multi-agent AI, and AI developers. What the project pages say, and what to ask for meanwhile.
-
OWASP Top 10 for LLM and Gen AI apps (2025): questions to put to a vendor
How five entries of the OWASP 2025 LLM Top 10 (prompt injection, supply chain, poisoning, output handling, excessive agency) turn into vendor questions, using OWASP's own mitigation text.
-
Motor-vehicle AI under the AI Act — Annex I Section B and Article 2(2)
What the Commission AI Act Service Desk pages say about motor-vehicle regulations in Annex I Section B and which AI Act provisions Article 2(2) applies to them.
-
ARP4754B FDAL and IDAL when the function is machine learning
How FAA AC 20-174 treats FDAL and IDAL, what EASA Issue 2 says about IDAL A/B ML constituents, and why ARP4754B is not an AI certificate.
-
Automotive AI assurance — ISO 26262, ISO/PAS 8800 and UL 4600
What official ISO and UL catalog pages say about functional safety, AI in road vehicles, and autonomous-product safety cases — and what they do not say.
-
Automotive AI — separating tool-qualification claims from vehicle-level safety claims
How the cited vendor pages for automotive tools name ISO 26262 and ISO/PAS 8800, and why a tool claim is not a vehicle claim (editorial judgment).
-
Automotive ML component — what evidence will an assessor expect?
What the public ISO, UL and EU pages say about evidence for a machine-learning component in a road vehicle, and where they stop. Editorial judgment is labeled.
-
CDAO RAI Toolkit versus Tradewinds AIA Toolkit
Why the 2023 RAI Toolkit and the live Tradewinds AIA Toolkit are the same public self-evaluation resource, plus the December 2024 generative-AI companion PDF.
-
Choosing AI red-teaming tools for safety-critical programs
How official CDAO, NIST and DoD pages define AI red-teaming, which listed tools name those uses, and what no page makes a contract clause.
-
CMMC and AI tools handling CUI
What 32 CFR Part 170 and DFARS 252.204-7021 actually require when an AI tool processes CUI, and why there is no AI-specific CMMC clause.
-
DO-200B aeronautical data versus ML training sets
What FAA AC 20-153B treats as aeronautical data, why DO-200B is not EASA learning assurance, and what a program may still need both packages for.
-
DoD 3000.09 compliance checklist for autonomy vendors
A vendor-facing checklist from DoD Directive 3000.09: scope, human judgment, V&V and T&E, senior review, and what the directive excludes.
-
DoD RAI Implementation Pathway: what the 64 lines of effort ask industry
What CDAO’s public pages say the June 2022 RAI Strategy and Implementation Pathway is, how the toolkit implements it, and what is not a contractor certificate.
-
EASA AI Concept Paper Issue 2 explained for suppliers
What Issue 2 asks a supplier to show for Level 1 and Level 2 ML: ODD, independent data sets, learning assurance, and why it is not an AMC.
-
FDA’s List of Artificial Intelligence-Enabled Medical Devices — what it is and is not
What FDA’s AI-enabled device list page says about its purpose and its limits, and how a buyer or supplier should and should not use it (editorial note labeled).
-
FDA Good Machine Learning Practice guiding principles — what the page says
What FDA’s Good Machine Learning Practice guiding-principles page says about the IMDRF document, and how it sits beside the PCCP guidance (editorial note labeled).
-
How to qualify an ML tool under DO-330
A buyer-side walkthrough of the DO-178C 12.2 decision, TQL-5 versus TQL-1, and what no public table assigns to training or robustness tools.
-
IEC 61508-3 software requirements and ISO/IEC TR 5469 — where learned components sit
Official catalog scope statements for IEC 61508-3:2010 and ISO/IEC TR 5469:2024, with a labeled editorial reading for machinery and process buyers.
-
Process-industry SIS — IEC 61511 and the parent IEC 61508 publication
Official IEC catalog pages for safety instrumented systems in the process sector, and what they do not say about machine learning.
-
IEC 61511 SIS life-cycle questions for AI in process plants
IEC 61511-1:2016 and its 2017 consolidated version as catalogued by IEC, and an editorial question list for AI tools near a safety instrumented system.
-
IEC 62304 and FDA PCCP — two ways of talking about changes to AI device software
IEC 62304 and its 2015 amendment next to the FDA PCCP guidance: what each official page says, and an editorial comparison of what a change-control record must answer.
-
Industrial machinery ML — what evidence will a notified body expect?
What IEC and AI Act Service Desk pages say about software evidence and learned components in machinery safety functions, and where public text stops. Editorial judgment is labeled.
-
ISO 10218 scope and exclusions — a checklist for AI-enabled robot buyers
What the ISO catalog says ISO 10218-1:2025 covers and excludes, how it relates to Regulation (EU) 2023/1230, and an editorial buyer checklist.
-
ISO/IEC 42001 and NIST AI 100-1: the two source documents behind the crosswalk
Exact titles, what each document is, and the caveats NIST and the crosswalk itself state, before you rely on any clause-to-subcategory row.
-
ISO 42001 vs NIST AI RMF for defense contractors
What a DIB team should take from the certifiable AIMS versus the voluntary RMF, using NIST’s published crosswalk and DoD’s own statement that the RAI toolkit builds on the RMF.
-
ISO/PAS 8800 and ISO 26262 — reading the scope lines side by side
Side-by-side reading of the ISO catalog scope statements for ISO 26262-1:2018 and ISO/PAS 8800:2024, with a labeled editorial note on supplier questions.
-
Industrial machinery AI — Regulation 2023/1230, ISO 10218 and IEC 61508
Official EUR-Lex, ISO and IEC pages for machinery AI provisions, industrial-robot safety and the parent functional-safety publication.
-
Machinery Regulation 2023/1230 in AI Act Annex I Section B — what the official pages say
The Commission AI Act Service Desk lists Regulation (EU) 2023/1230 in Annex I Section B; Article 2(2) limits which AI Act provisions apply to such products.
-
Medical-device AI — FDA PCCP, IEC 62304 and EU MDR plus the AI Act
Official FDA, IEC and EUR-Lex pages for AI-enabled device software, software life-cycle processes, and MDR as AI Act Annex I item 11.
-
Medical device ML — what evidence does FDA expect in a submission?
What FDA’s January 2025 draft AI-enabled device software functions guidance and its PCCP guidance say a submission should contain, from the sections we read. Editorial judgment is labeled.
-
NASA SWEHB Artificial Intelligence topics 7.25 and 8.25 for flight software
What SWEHB 7.25 and 8.25 tell NASA AI/ML projects about NPR 7150.2 and safety-critical limits. Official titles stay Artificial Intelligence. Handbook topics, not a certificate.
-
NIST AI 100-2 adversarial ML terms for defense T&E
What NIST AI 100-2e2025’s adversarial-machine-learning taxonomy is, how it sits next to CDAO T&E and ATLAS, and what it does not certify.
-
NIST SP 800-218A SSDF for generative AI in defense software
What the July 2024 SSDF Community Profile adds for generative and dual-use models, how it sits next to CMMC and the AI RMF, and what it does not certify.
-
Process industries ML — what evidence will an assessor expect?
What the IEC catalog says about IEC 61511-1, IEC 61508-3 and ISO/IEC TR 5469 for an ML component near a safety instrumented system. Editorial judgment is labeled.
-
Process-industry SIS vendor pages — IEC 61511 named, IEC 61508 named, or neither
How four process-safety vendor pages word their standards claims, read against the IEC catalog scope of IEC 61511-1 and IEC 61508-1 (editorial reading labeled).
-
Prompt guardrails versus airborne runtime assurance
Why cloud LLM input/output rails are not NASA/ASTM runtime assurance, using the cited NeMo, Bedrock, Azure and NASA TM pages.
-
Turning the ISO/IEC 42001 to NIST AI RMF crosswalk into supplier evidence requests
How a buyer can use the rows NIST published to decide what documents to ask an AI supplier for, with the editorial steps clearly separated from the sourced mappings.
-
An AI assurance glossary for aerospace and defense
Official meanings of the terms that show up in FAA, EASA, NIST, DoD and CMMC AI work, each tied to the source that uses it.
-
An AI audit evidence checklist for regulated programs
A checklist of evidence artifacts for AI audits, each tied to the ISO/IEC 42001, NIST AI RMF, EU AI Act, EASA, NIST SP 800-171 or DoD source that expects it.
-
AI in MRO and predictive maintenance: regulatory considerations (FAA/EASA official material)
FAA Roadmap maintenance and retirement sentences, AC 43-218 IAHM with no AI words found, and EASA-hosted ForMuLA research — not an MRO AI regulation.
-
AI incident reporting: EU AI Act Article 73 vs DoD guidance
Article 73 sets timed serious-incident reports for high-risk AI. Public DoD pages describe RAI repositories and existing processes, not an Article 73 equivalent.
-
AI red-teaming requirements for defense programs
What official DoD, CDAO and NIST pages actually say about AI red-teaming, and what they do not make a contract clause.
-
Army, Navy and Air Force AI policies that name acquisition
What Army Project Linchpin, the Navy Strategy to Weaponize Data and Artificial Intelligence, and the DAF Artificial Intelligence Strategy actually say about buying and fielding AI.
-
Australia Defence Policy Settings for Responsible Use of AI
What Australia's Policy Settings for Responsible Use of Artificial Intelligence in Defence publish as lawfulness, values-based principles and proportionate controls, versus DST's research method.
-
Autonomy and DoD Directive 3000.09 explained
What DoD Directive 3000.09 (25 January 2023) actually covers: weapon-system autonomy, human judgment, senior review, and what it excludes.
-
Building an AI assurance case (GSN/AMLAS) for certification
What the GSN Community Standard and AMLAS actually specify, and why neither is a published FAA or EASA means of compliance.
-
Canada DND/CAF Artificial Intelligence Strategy
What the 2024 Department of National Defence and Canadian Armed Forces Artificial Intelligence Strategy publishes as its 2030 vision, five lines of effort, and procurement tasks.
-
CDAO test and evaluation of Artificial Intelligence models
CDAO Test and Evaluation of Artificial Intelligence Models Framework: four T&E focus areas, what the April 2024 document says it is not, and how JATIC software fits.
-
CMMC and AI with CUI - what the rules actually say
How CMMC and NIST SP 800-171 apply when an AI system, including a cloud AI service, handles controlled unclassified information, and where the rules are silent.
-
CMMC Level 2 vs Level 3 for AI systems
What 32 CFR Part 170 actually requires at CMMC Level 2 and Level 3 when an AI system handles CUI, and what the Phase 2 suspension changes.
-
CMMC Program scoping for generative systems that handle CUI
What 32 CFR Part 170 actually calls the program, including the live CMMC 2.0 resource page, and how Level 2 asset categories apply to generative components.
-
Data assurance for ML in avionics: EASA learning assurance
What EASA Issue 2 and the MLEAP research project say about data quality, the ODD, and the three data sets in the W-shaped process.
-
Data provenance and supply-chain security for ML models (SBOM/AIBOM)
What CISA, NIST and NTIA actually say about SBOMs for AI software, and how CycloneDX ML-BOM and SPDX AI profiles relate, without inventing a mandate.
-
Supplier flow-down clauses for SI/AI in defense contracts
No DFARS or FAR clause titled AI or Super Intelligence. What 252.204-7012, 7020, 7021 and FAR 52.204-21 actually require primes to flow down.
-
DO-178C and machine learning: where the gaps are
Where requirements-based airborne software assurance strains under data-driven machine learning, and what EASA, the FAA and SAE G-34 are doing about each gap.
-
DO-330 tool qualification for ML development and verification toolchains
When an ML training or verification program is a DO-330 tool. FTP1055 criteria, TQL-5 versus TQL-1, FAA Order 8110.49A, and what no public table assigns.
-
DoD RAI Toolkit vs NIST AI RMF: what each one is for
What the DoD RAI Toolkit and the NIST AI RMF each say about themselves, and the official statement that the toolkit builds on the RMF.
-
Does the FAA certify AI today? Current status
The FAA still has no published AI-specific certification standard. What Version I of the roadmap, the STEP discipline page, and the 2026 Small Airplane Issues List actually say.
-
EASA AI Concept Paper levels explained
What EASA Issue 2 says about Level 1 and Level 2 AI, and what proposed Issue 03 adds for Level 0 and Level 3.
-
EU AI Act general-purpose AI model obligations
Chapter V GPAI model duties apply from 2 August 2025. They are not the postponed high-risk system dates, and not an aviation AMC.
-
EU AI Act obligations for aerospace suppliers outside the EU
How Article 2 of the EU AI Act can apply to aerospace suppliers established outside the Union, and which aviation and defence exclusions the official text actually states.
-
EU AI Act scope for defense and aviation: what is in, what is out, and the new dates
How the AI Act's military exclusion, dual-use rule and civil aviation treatment work, and which compliance dates apply after the July 2026 Digital Omnibus.
-
Executive Order 14434: Super Intelligence (SI) terminology for aerospace and defense teams
What EO 14434 changes for U.S. executive-branch documents, and what it does not: statutes, regulations, historical records, and non-federal standards.
-
The FAA AI Safety Assurance Roadmap, explained
A plain-language walk through the FAA's Roadmap for Artificial Intelligence Safety Assurance Version I - what it commits to, what it leaves open, and what it means for applicants.
-
FAA and EASA AI certification timelines compared
FAA AI Safety Assurance Roadmap milestones versus EASA AI Roadmap 2.0 and RMT.0742 dates: what is published and what is still scheduled.
-
FAA proposed Part 108 BVLOS and DoD Directive 3000.09
Two live autonomy regimes: the FAA/TSA NPRM that would create 14 CFR Part 108 for civil UAS BVLOS, versus DoD Directive 3000.09 on autonomy in weapon systems.
-
FedRAMP and IL levels for AI SaaS in defense
What FedRAMP.gov and official DoD pages actually say about FedRAMP Certification versus DoD Impact Levels for AI cloud services — two different systems.
-
Formal verification of neural networks: what's usable today
What official neural-network verifier docs and papers actually claim, using ACAS Xu aviation examples, and what they do not make a certification path.
-
Human-machine teaming in DoD and NATO guidance
What official DoD, NATO, UK MOD and EASA pages actually say about human judgment, human control and human-AI teaming.
-
ISO/IEC 42001 vs NIST AI RMF: a practical crosswalk
How the certifiable ISO/IEC 42001 management system and the voluntary NIST AI RMF fit together, with example mappings taken from NIST's published crosswalk.
-
ISO/IEC 23894 and 5338 for engineering teams
What ISO catalog abstracts say ISO/IEC 23894:2023 risk guidance and ISO/IEC 5338:2023 life-cycle processes are, and that neither is a certifiable AIMS or aviation AMC.
-
ISO/IEC 24029 neural-network robustness is not an aviation AMC
ISO/IEC TR 24029-1 and 24029-2 assess neural-network robustness. Catalog text only: they are not an FAA or EASA AMC. Part 3 is still a draft.
-
What auditors ask for in an ISO/IEC 42001 certification audit
What UKAS- and ANAB-accredited certification bodies publish about an ISO/IEC 42001 audit, from public accreditation and certification-body material only.
-
ISO/IEC 42001 vs ISO 9001/AS9100 for aerospace quality systems
What ISO, IAQG and ANAB actually say about AI management systems versus quality management and the 9100-series — and that we found no official ICOP 42001 scheme.
-
ISO/IEC 42005:2025 AI system impact assessment
ISO/IEC 42005:2025 is guidance for AI system impact assessments. Catalog facts only: it complements 42001 and 23894 and is not a certifiable AIMS.
-
ISO/IEC TR 5469 and IEC 61508 for ML components
What official ISO and IEC catalog pages say about AI in safety-related functions, and what they do not say about SIL for machine learning.
-
ITAR/EAR export controls and AI models
What BIS and DDTC official pages actually control for AI models and software: USML technical data, EAR model weights under ECCN 4E091, and what they do not call a general AI license.
-
Japan MOD AI utilization policy and ATLA responsible AI R&D guideline
What Japan's July 2024 防衛省ＡＩ活用推進基本方針 and ATLA's Guideline for Responsible AI Application in R&D of AI-Equipped Defense Systems actually say.
-
How to map an AI model to DO-178C / DO-330 tool qualification
What DO-330 actually qualifies, why a trained model is usually the software item rather than a tool, and what the FAA has said about extending DO-330 to AI.
-
Model cards and system cards for defense AI documentation
What official model-card and system-card pages actually specify, and what CDAO and NIST documents do and do not require for defense programs.
-
NATO's revised AI Strategy and the Principles of Responsible Use
What NATO's 2021 and 2024 Artificial Intelligence Strategy summaries actually say about the six Principles of Responsible Use, TEV&V, DIANA and Allied industry.
-
NIST AI 600-1 (Generative AI Profile) for defense contractors
What NIST AI 600-1 actually is, which generative-AI risks it names, and how that sits next to CMMC and DoD Responsible AI rather than replacing them.
-
NIST AI 600-1 suggested actions for generative AI on a defense program
Which NIST AI 600-1 suggested actions name acquisition, contractors, national security and information security, and what they do not make mandatory for DoD work.
-
Which NIST SP 800-171 controls matter most when AI tools handle CUI?
Official pages do not rank a subset of 800-171 for AI. What CMMC, NIST and NSA/CISA actually say when AI systems process CUI.
-
Rotorcraft and eVTOL autonomy: FAA/EASA powered-lift and SC-VTOL AI-relevant guidance
FAA powered-lift AC 21.17-4, the FAA Safety Framework for Aircraft Automation, and EASA SC-VTOL: what they say, and that a search of SC-VTOL-02 found no AI or ML words.
-
Runtime assurance and simplex architectures for ML in flight
What NASA, ASTM F3269-21 and the 1998 Simplex paper say about runtime assurance for ML in flight — and what they do not call a means of compliance.
-
SAE G-34 / ARP6983 status: what is published versus still draft
EUROCAE WG-114 still lists ED-324 / ARP6983 as Draft. Companion ER drafts, published AIR dates, and what EASA and the FAA have and have not accepted.
-
Space systems and AI assurance (NASA/ESA/Space Force official guidance)
What NASA SWEHB Artificial Intelligence topics, ESA AISSA public pages and the Space Force FY2025 Data and AI plan actually say — and what they do not call a certification standard.
-
What JSP 936 Part 1 asks of industry partners and suppliers
Who UK MOD JSP 936 Part 1 binds, what must versus should means for suppliers, how legacy AI is treated, and how the AI Practitioner's Handbook relates.
-
UK MOD JSP 936 vs DoD Responsible AI
What official UK MOD and US DoD pages each claim about dependable or responsible AI, without inventing a clause-by-clause map.
-
UL 4600 is not an aviation or DoD 3000.09 means of compliance
What UL 4600’s public catalog actually scopes (autonomous vehicles, no human driver) versus FAA, EASA and DoD 3000.09 pages. Not an aviation AMC we have found.
Questions
Does every factual sentence in these articles have a public source?
Yes. Factual claims link to a public page. Sentences that are our analysis are labeled Analysis or Our reading. Official names stay as the publisher printed them.
Where is the machine-readable list of every article?
llms.txt lists every article URL and description. llms-full.txt repeats the full cited text. Article feeds are also published as RSS, Atom and JSON Feed.