AI Assurance Directory

Printable checklists

Checkbox versions of the AI audit evidence checklist and the CMMC + AI items from CMMC and AI with CUI and CMMC Level 2 vs Level 3, plus a printable one-page checklist for each Path. Each line cites the official page that expects it. Last checked 2026-10-15. For a scored starting point, take the free AI assurance readiness self-check (18 cited questions).

Source article

ISO says certification, where an organization chooses it, is performed by independent certification bodies. See ISO 42001 explained. The FAA says project-specific issue papers and special conditions document the criteria for learned AI. See FAA AI Safety Assurance Roadmap.

One-page path checklists

1. Governance and accountability

2. Risk and intended use

3. Data and model evidence

  • EASA: a correct and complete ODD definition is a prerequisite to an adequate level of quality of the data sets.

    EASA Concept Paper Issue 02

  • EASA objective DM-01: identify data sources and collect data in accordance with the defined ODD while ensuring data quality requirements are satisfied. DoD Traceable expects auditable methodologies, data sources and design procedures.

    EASA Concept Paper Issue 02

  • EASA bases learning assurance on three separate and independent data sets.

    EASA Concept Paper Issue 02

  • Measure 2.1: test sets, metrics and details about the tools used during TEVV are documented.

    NIST AI RMF to ISO/IEC 42001 crosswalk

  • Maps to ISO B.6.2.4 verification and validation.

    NIST AI RMF to ISO/IEC 42001 crosswalk

  • Measure 2.5: limitations of generalizability beyond the development conditions are documented.

    NIST AI RMF to ISO/IEC 42001 crosswalk

4. Documentation and records

5. Operation, monitoring and corrective action

6. Aviation-specific note

Certification evidence for airborne AI is project-specific. The artifacts above are inputs to that conversation, not a replacement for it.

  • The FAA says project-specific issue papers and special conditions document the criteria.

    FAA AI Safety Assurance Roadmap

CMMC + AI items

These are the CUI and level items already cited in the checklist article and the two CMMC articles. They are not a new requirement set. CMMC has no AI-specific level on the pages we cite.

CMMC + AI: is CUI in the path?

  • NIST SP 800-171 applies to components of nonfederal systems that process, store, or transmit CUI, or that provide protection for such components. 32 CFR 170.19 is the CMMC scoping rule.

    NIST SP 800-171 Rev. 3

  • DFARS 252.204-7021 requires a CMMC status for all information systems used in performance of the contract that process, store, or transmit FCI or CUI.

    48 CFR 252.204-7021

  • A search of 32 CFR Part 170 for “artificial intelligence” and “machine learning” found no matches as of 14 October 2026. Levels are information-system levels.

    32 CFR Part 170

CMMC + AI: who operates the service?

  • For CMMC Level 2, an organization may use a cloud environment for CUI only if the offering is FedRAMP Authorized at the Moderate (or higher) baseline, or meets security requirements equivalent to it.

    32 CFR 170.16

  • A service provider that is not a cloud provider has its services in the organization’s assessment scope and assessed as part of it.

    32 CFR 170.19

  • The organization’s on-premises infrastructure connecting to the service is in the assessment scope.

    32 CFR 170.16

  • Use of an external service provider and its services is documented in the SSP and described in the provider’s service description and CRM.

    32 CFR 170.16

  • NIST SP 800-171A defines three assessment methods: examine, interview and test.

    NIST SP 800-171A

CMMC + AI: Level 2 vs Level 3 and current phase

  • Level 2 security requirements are identical to the requirements in NIST SP 800-171 R2. 32 CFR Part 170 describes 110 Level 2 requirements.

    32 CFR 170.14

  • Level 3 is selected NIST SP 800-172 Feb2021 requirements, assessed by DoD after Final Level 2 (C3PAO) for the same scope. The program overview describes 24 Level 3 requirements.

    32 CFR 170.18

  • DoD CIO says it is enforcing Rev 2 during the current suspension, while NIST has published Revision 3.

    DoD CIO, About CMMC

  • DoD CIO says Phase II was suspended on 13 July 2026. The implementing memo says requiring activities may only designate CMMC Level 1 (Self) or Level 2 (Self) during the suspension.

    Implementing Suspension of CMMC Phase II

  • The suspension does not eliminate the requirement to protect information under DFARS clause 252.204-7012.

    DoD CIO, About CMMC

Questions

Is this a substitute for the standard or the contract?

No. Each item is a starting-point evidence prompt taken from an existing cited article. It is informational only and is not professional, engineering, certification or legal advice.

Where did the items come from?

The first list is the AI audit evidence checklist article. The second list is the CMMC + AI items from that article and from the CMMC and AI with CUI and CMMC Level 2 vs Level 3 articles. Each Path also has a one-page checklist built only from that Path’s existing cited sources and articles. We did not add unverified items.

Free next step: take the AI assurance readiness self-check or create a free account. Quoted evidence stays on Pro.