# AI Assurance Directory

> Which AI assurance tools actually help you certify — with the cited evidence. Built for safety-critical and regulated manufacturing, with aerospace and defense as the flagship. Tools are mapped to DO-178C, ARP4754B, EASA learning assurance, DoD RAI, CMMC, NIST AI RMF, ISO 26262, IEC 62304, IEC 61508 and IEC 61511. Every claim links to an official source.

Sources last verified 15 October 2026. Every tool listing and factual statement links to a public source; unverifiable items are omitted. The content on this site is informational only. It is not professional, engineering, certification or legal advice, and it should not be relied on as such. Where this site speaks in its own voice about current U.S. federal executive-branch policy, it uses Super Intelligence (SI) and notes that those systems were formerly called artificial intelligence (AI). Official titles of cited documents, standards, frameworks, and sources stay exactly as published. Official names of statutes, regulations, historical documents, and non-federal standards stay exactly as published.

This file is the public index for AI crawlers and researchers. It lists only public summaries. Quoted evidence, coverage-cell detail, buyer-kit questions and exports are Pro and are omitted here. Full public text of explainers, articles and listings is /llms-full.txt.

## Framework explainers
- [ISO/IEC 42001](https://aiassurancedirectory.com/frameworks/iso-42001/): The first international management-system standard for AI. It governs how an organization manages AI risk, not how an individual AI product is certified. Status: Published December 2023 (edition 1).
- [NIST AI RMF](https://aiassurancedirectory.com/frameworks/nist-ai-rmf/): A voluntary, sector-agnostic US framework that organizes AI risk work into four functions - Govern, Map, Measure and Manage. Status: AI RMF 1.0 released January 2023; Generative AI Profile (NIST AI 600-1) published July 2024.
- [FAA AI Safety Assurance Roadmap](https://aiassurancedirectory.com/frameworks/faa-ai-safety-assurance-roadmap/): The FAA's statement of principles and priorities for assuring the safety of AI in aircraft. It is a roadmap, not a certification standard. Status: Version I; FAA says it plans to update the roadmap periodically.
- [DO-178C / DO-330](https://aiassurancedirectory.com/frameworks/do-178c-do-330/): The core airborne software assurance standard and its tool-qualification companion, and why machine learning does not fit them cleanly. Status: DO-178C published 2011; recognized by FAA AC 20-115D (issued 2017-07-21, active).
- [SAE G-34](https://aiassurancedirectory.com/frameworks/sae-g-34/): The joint SAE and EUROCAE committee writing aviation AI standards. Two information reports are issued; the ML development-assurance standard (ARP6983 / ED-324) is still a draft in the sources we checked. Status: AIR6988 (2021) and AIR6987 (2024) issued; ED-324 / ARP6983 listed as draft, target publication 31 December 2026.
- [EASA AI Concept Paper](https://aiassurancedirectory.com/frameworks/easa-ai-concept-paper/): EASA's preliminary guidance for Level 1 and 2 machine-learning applications in aviation, including the W-shaped learning assurance process. Included because the FAA and SAE work builds on and parallels it. Status: Issue 02 published 6 March 2024; Proposed Issue 03 consultation 3 June–12 August 2026 (not final rules).
- [CMMC / NIST SP 800-171](https://aiassurancedirectory.com/frameworks/cmmc-nist-sp-800-171/): How DoD contractor cybersecurity rules apply to AI systems that process controlled unclassified information. The rules are technology-neutral, and CMMC Phase 2 is currently suspended. Status: CMMC Phase 1 in effect since 10 Nov 2025; Phase 2 suspended 13 July 2026.
- [DoD Responsible AI](https://aiassurancedirectory.com/frameworks/dod-responsible-ai/): The Department of Defense's five AI ethical principles, its Responsible AI Strategy and Implementation Pathway, and the public CDAO toolkit (released as RAI, now titled AIA Toolkit). Status: Principles adopted February 2020; RAI Toolkit publicly released 14 November 2023; live Tradewinds page now titles it the AIA Toolkit.
- [EU AI Act](https://aiassurancedirectory.com/frameworks/eu-ai-act/): The EU's horizontal AI regulation. For aerospace and defense, the key points are its military exclusion, its treatment of civil aviation, and the dates moved by the 2026 Digital Omnibus. Status: In force; Chapter V GPAI from 2 Aug 2025; high-risk Chapter III postponed by Regulation (EU) 2026/1744 to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I).
- [ISO/IEC 23894](https://aiassurancedirectory.com/frameworks/iso-iec-23894/): International guidance on managing AI-specific risk for organizations that develop, produce, deploy or use AI products, systems and services. Status: Published February 2023 (edition 1).
- [ISO/IEC TR 5469](https://aiassurancedirectory.com/frameworks/iso-iec-tr-5469/): A technical report on properties, risk factors, methods and processes when AI is used in, around, or to design safety-related functions. Status: Published January 2024 (edition 1, technical report).
- [UK MOD JSP 936](https://aiassurancedirectory.com/frameworks/uk-mod-jsp-936/): The Ministry of Defence's principal policy directive for safe and responsible AI adoption across Defence projects that include AI. Status: Part 1 Directive published 13 November 2024 (JSP 936 V1.1).
- [NATO PRUAI](https://aiassurancedirectory.com/frameworks/nato-responsible-use-of-ai/): Six Allied principles for AI in defence — Lawfulness, Responsibility and Accountability, Explainability and Traceability, Reliability, Governability, and Bias Mitigation. Status: Endorsed in the 2021 AI Strategy; restated in the revised AI Strategy of 10 July 2024.
- [UL 4600](https://aiassurancedirectory.com/frameworks/ul-4600/): ANSI/UL standard for building and evaluating a safety argument for vehicles that operate in an autonomous mode without human supervision. Status: ANSI/UL 4600 new edition dated 17 March 2023.
- [ARP4754B](https://aiassurancedirectory.com/frameworks/arp4754b/): SAE guidelines for developing civil aircraft and systems. FAA AC 20-174 still recognizes the A revision as an acceptable development-assurance method; the FAA AI roadmap names SAE ARP4754. Status: ARP4754B is the current SAE listing; FAA AC 20-174 (30 September 2011) still names ARP4754A.
- [DO-330](https://aiassurancedirectory.com/frameworks/do-330/): RTCA DO-330 / EUROCAE ED-215 is the tool-qualification companion to DO-178C. Qualification effort scales with tool qualification level (TQL-1 through TQL-5). Status: Recognized by FAA AC 20-115D (issued 2017-07-21, active); FAA AI roadmap names DO-330/ED-215.
- [DO-200B](https://aiassurancedirectory.com/frameworks/do-200b/): RTCA DO-200B is the standard for processing aeronautical data. FAA AC 20-153B treats it as an acceptable means for data-process approval and Letters of Acceptance. Status: AC 20-153B issued 19 April 2016 recognizes DO-200B; DO-200A is no longer an acceptable means for new applications under that AC.
- [DoD Directive 3000.09](https://aiassurancedirectory.com/frameworks/dod-3000-09/): DoD policy for autonomous and semi-autonomous weapon systems. It requires appropriate human judgment over the use of force, V&V and T&E, and senior review. It does not cover unarmed or non-weapon AI. Status: Effective 25 January 2023; reissues and cancels the 21 November 2012 directive.
- [DoD RAI Strategy](https://aiassurancedirectory.com/frameworks/dod-rai-strategy/): The Department’s RAI Strategy and Implementation Pathway operationalizes the five AI ethical principles. The June 2022 pathway names 64 lines of effort. It is Department direction, not a product certificate. Status: Principles adopted February 2020; RAI Strategy and Implementation Pathway signed June 2022.
- [CDAO RAI Toolkit](https://aiassurancedirectory.com/frameworks/cdao-rai-toolkit/): CDAO’s public self-evaluation toolkit for aligning AI projects to DoD (now DoW) AI Ethical Principles. Released November 2023 as the RAI Toolkit; the live Tradewinds page titles it the AIA Toolkit. Status: Publicly released 14 November 2023; live Tradewinds page titled AIA Toolkit; IL2 and IL5.
- [NIST SP 800-218A](https://aiassurancedirectory.com/frameworks/nist-800-218a/): A July 2024 SSDF Community Profile that adds generative-AI and dual-use foundation-model practices to NIST SP 800-218. Guidance for model producers, system producers and acquirers — not a certification. Status: Final, 26 July 2024; use with SP 800-218 SSDF 1.1.
- [ISO 26262](https://aiassurancedirectory.com/frameworks/iso-26262/): Functional safety for safety-related E/E systems installed in series production road vehicles, excluding mopeds. Addresses hazards from malfunctioning E/E behaviour, not AI-specific methods. Status: Published December 2018 (edition 2); International Standard to be revised.
- [ISO/PAS 8800](https://aiassurancedirectory.com/frameworks/iso-pas-8800/): Publicly Available Specification for safety-related E/E systems that use AI in series production road vehicles. Addresses vehicle-level risk from AI output insufficiencies, systematic errors and random hardware errors. Status: Published December 2024 (edition 1, Publicly Available Specification).
- [FDA AI-DSF / PCCP](https://aiassurancedirectory.com/frameworks/fda-ai-dsf-pccp/): FDA recommendations for AI-enabled device software functions, including optional predetermined change control plans (PCCPs) reviewed with a marketing submission. Not a certification standard. Status: Lifecycle/marketing-submission guidance draft January 2025; PCCP guidance final August 2025.
- [IEC 62304](https://aiassurancedirectory.com/frameworks/iec-62304/): Life-cycle requirements for medical device software when the software is itself a medical device or is embedded in one. Does not cover validation and final release of the medical device. Status: Published 9 May 2006 (edition 1.0); consolidated with Amendment 1, 26 June 2015.
- [EU MDR + AI Act](https://aiassurancedirectory.com/frameworks/eu-mdr-ai-act/): Regulation (EU) 2017/745 remains Union medical-device law. The AI Act Annex I Section A still lists that regulation as item 11, so Article 6(1) high-risk classification can apply when an AI system is a safety component of, or is itself, such a product. Status: MDR in force; AI Act Annex I as consolidated 27 July 2026 on the Commission Service Desk.
- [IEC 61508](https://aiassurancedirectory.com/frameworks/iec-61508/): Basic safety publication for electrical, electronic and programmable electronic systems that carry out safety functions. Facilitates sector standards; does not by itself confer an AI-specific SIL. Status: Published 30 April 2010 (edition 2.0).
- [Machinery Regulation 2023/1230](https://aiassurancedirectory.com/frameworks/eu-machinery-2023-1230/): Union machinery product-safety regulation that covers safety risks from digital technologies, including machine-learning software that ensures safety functions. Also listed in AI Act Annex I Section B. Status: In force; consolidated text current as of 27 July 2026 on EUR-Lex.
- [ISO 10218](https://aiassurancedirectory.com/frameworks/iso-10218/): Safety requirements for industrial robots treated as partly completed machinery, before integration under ISO 10218-2. Explicitly not applicable to medical, military, airborne or service robots. Status: Published February 2025 (edition 3).
- [IEC 61511](https://aiassurancedirectory.com/frameworks/iec-61511/): Process-sector implementation of IEC 61508:2010. Requirements for specifying, designing, installing, operating and maintaining a safety instrumented system so it can achieve or maintain a safe state of the process. Status: Published 24 February 2016 (edition 2.0); consolidated with Amendment 1, 16 August 2017.

## Articles
- [CISA joint principles for integrating AI into operational technology: what plant and infrastructure buyers can ask vendors](https://aiassurancedirectory.com/articles/cisa-joint-principles-secure-integration-of-ai-in-operational-technology/): The four principles in the December 2025 CISA, ASD ACSC and partner guidance on AI in OT, with the vendor-transparency, testing and failsafe passages that matter to buyers.
- [EU AI Act Article 4 AI literacy: what the Commission Q&A and the amended text say](https://aiassurancedirectory.com/articles/eu-ai-act-article-4-ai-literacy/): What Article 4 asks of providers and deployers after the 2026 AI Omnibus, per the Commission's Q&A and the Service Desk text. No certificate or specific training is mandated.
- [EU AI Act Article 6 high-risk classification: Annex I products, Annex III uses and the safety-component rule](https://aiassurancedirectory.com/articles/eu-ai-act-article-6-high-risk-classification-safety-components/): How Article 6 sorts AI systems into high-risk, including the 2026 Omnibus paragraphs on safety components and the Article 6(3) documented-assessment route for Annex III.
- [EU AI Act Articles 14 and 26: human oversight, who builds it and who staffs it](https://aiassurancedirectory.com/articles/eu-ai-act-articles-14-and-26-human-oversight-provider-and-deployer-duties/): Article 14 makes providers design high-risk AI for human oversight, including a stop control; Article 26 makes deployers assign competent people and keep logs. Quoted from the Service Desk text.
- [EU AI Act Articles 9 and 15: risk management, accuracy, robustness and cybersecurity for high-risk AI](https://aiassurancedirectory.com/articles/eu-ai-act-articles-9-and-15-risk-management-accuracy-robustness-cybersecurity/): What Articles 9 and 15 of the AI Act require of high-risk systems, quoted from the Service Desk text: lifecycle risk management, declared accuracy, fail-safe robustness and poisoning defenses.
- [MITRE ATLAS for AI red teaming: tactics, techniques, mitigations and case studies](https://aiassurancedirectory.com/articles/mitre-atlas-for-ai-red-teaming/): What the public MITRE ATLAS data release contains, how a red team can use its IDs and mitigations in a test plan, and what it does not certify.
- [NIST AI RMF Playbook: Measure and Manage suggested actions for safety-critical AI](https://aiassurancedirectory.com/articles/nist-ai-rmf-playbook-measure-and-manage-suggested-actions-for-safety-critical-ai/): What the NIST AI RMF Playbook is and which Measure 2.5, 2.6 and Manage 2.4 suggested actions map to validation, fail-safe testing and bypass plans on a safety-critical program.
- [NIST Cyber AI Profile (IR 8596): what the preliminary draft covers and how far to rely on it](https://aiassurancedirectory.com/articles/nist-cyber-ai-profile-ir-8596-preliminary-draft/): NIST IR 8596 is a preliminary-draft CSF 2.0 profile for AI cybersecurity with Secure, Defend and Thwart focus areas. What the NIST page says, its draft status, and what to ask suppliers.
- [NIST SP 800-53 control overlays for securing AI systems (COSAiS): the five use cases and what is still draft](https://aiassurancedirectory.com/articles/nist-sp-800-53-cosais-control-overlays-for-securing-ai-systems/): NIST's COSAiS project is building SP 800-53 overlays for generative AI, predictive AI, single- and multi-agent AI, and AI developers. What the project pages say, and what to ask for meanwhile.
- [OWASP Top 10 for LLM and Gen AI apps (2025): questions to put to a vendor](https://aiassurancedirectory.com/articles/owasp-top-10-for-llm-applications-2025-buyer-questions/): How five entries of the OWASP 2025 LLM Top 10 (prompt injection, supply chain, poisoning, output handling, excessive agency) turn into vendor questions, using OWASP's own mitigation text.
- [Motor-vehicle AI under the AI Act — Annex I Section B and Article 2(2)](https://aiassurancedirectory.com/articles/ai-act-annex-i-section-b-motor-vehicles-ai/): What the Commission AI Act Service Desk pages say about motor-vehicle regulations in Annex I Section B and which AI Act provisions Article 2(2) applies to them.
- [ARP4754B FDAL and IDAL when the function is machine learning](https://aiassurancedirectory.com/articles/arp4754b-fdal-idal-for-ml-functions/): How FAA AC 20-174 treats FDAL and IDAL, what EASA Issue 2 says about IDAL A/B ML constituents, and why ARP4754B is not an AI certificate.
- [Automotive AI assurance — ISO 26262, ISO/PAS 8800 and UL 4600](https://aiassurancedirectory.com/articles/automotive-ai-iso-26262-pas-8800-ul-4600/): What official ISO and UL catalog pages say about functional safety, AI in road vehicles, and autonomous-product safety cases — and what they do not say.
- [Automotive AI — separating tool-qualification claims from vehicle-level safety claims](https://aiassurancedirectory.com/articles/automotive-ai-tool-claims-versus-vehicle-level-claims/): How the cited vendor pages for automotive tools name ISO 26262 and ISO/PAS 8800, and why a tool claim is not a vehicle claim (editorial judgment).
- [Automotive ML component — what evidence will an assessor expect?](https://aiassurancedirectory.com/articles/automotive-ml-component-what-evidence-will-an-assessor-expect/): What the public ISO, UL and EU pages say about evidence for a machine-learning component in a road vehicle, and where they stop. Editorial judgment is labeled.
- [CDAO RAI Toolkit versus Tradewinds AIA Toolkit](https://aiassurancedirectory.com/articles/cdao-rai-toolkit-vs-tradewinds-aia/): Why the 2023 RAI Toolkit and the live Tradewinds AIA Toolkit are the same public self-evaluation resource, plus the December 2024 generative-AI companion PDF.
- [Choosing AI red-teaming tools for safety-critical programs](https://aiassurancedirectory.com/articles/choosing-ai-red-teaming-tools-for-safety-critical-programs/): How official CDAO, NIST and DoD pages define AI red-teaming, which listed tools name those uses, and what no page makes a contract clause.
- [CMMC and AI tools handling CUI](https://aiassurancedirectory.com/articles/cmmc-and-ai-tools-handling-cui/): What 32 CFR Part 170 and DFARS 252.204-7021 actually require when an AI tool processes CUI, and why there is no AI-specific CMMC clause.
- [DO-200B aeronautical data versus ML training sets](https://aiassurancedirectory.com/articles/do-200b-aeronautical-data-vs-ml-training-sets/): What FAA AC 20-153B treats as aeronautical data, why DO-200B is not EASA learning assurance, and what a program may still need both packages for.
- [DoD 3000.09 compliance checklist for autonomy vendors](https://aiassurancedirectory.com/articles/dod-3000-09-compliance-checklist-for-autonomy-vendors/): A vendor-facing checklist from DoD Directive 3000.09: scope, human judgment, V&V and T&E, senior review, and what the directive excludes.
- [DoD RAI Implementation Pathway: what the 64 lines of effort ask industry](https://aiassurancedirectory.com/articles/dod-rai-implementation-pathway-for-industry/): What CDAO’s public pages say the June 2022 RAI Strategy and Implementation Pathway is, how the toolkit implements it, and what is not a contractor certificate.
- [EASA AI Concept Paper Issue 2 explained for suppliers](https://aiassurancedirectory.com/articles/easa-ai-concept-paper-issue-2-for-suppliers/): What Issue 2 asks a supplier to show for Level 1 and Level 2 ML: ODD, independent data sets, learning assurance, and why it is not an AMC.
- [FDA’s List of Artificial Intelligence-Enabled Medical Devices — what it is and is not](https://aiassurancedirectory.com/articles/fda-ai-enabled-device-list-what-it-is-and-is-not/): What FDA’s AI-enabled device list page says about its purpose and its limits, and how a buyer or supplier should and should not use it (editorial note labeled).
- [FDA Good Machine Learning Practice guiding principles — what the page says](https://aiassurancedirectory.com/articles/fda-good-machine-learning-practice-guiding-principles/): What FDA’s Good Machine Learning Practice guiding-principles page says about the IMDRF document, and how it sits beside the PCCP guidance (editorial note labeled).
- [How to qualify an ML tool under DO-330](https://aiassurancedirectory.com/articles/how-to-qualify-an-ml-tool-under-do-330/): A buyer-side walkthrough of the DO-178C 12.2 decision, TQL-5 versus TQL-1, and what no public table assigns to training or robustness tools.
- [IEC 61508-3 software requirements and ISO/IEC TR 5469 — where learned components sit](https://aiassurancedirectory.com/articles/iec-61508-3-software-requirements-and-learned-components/): Official catalog scope statements for IEC 61508-3:2010 and ISO/IEC TR 5469:2024, with a labeled editorial reading for machinery and process buyers.
- [Process-industry SIS — IEC 61511 and the parent IEC 61508 publication](https://aiassurancedirectory.com/articles/iec-61511-process-sis-and-ai/): Official IEC catalog pages for safety instrumented systems in the process sector, and what they do not say about machine learning.
- [IEC 61511 SIS life-cycle questions for AI in process plants](https://aiassurancedirectory.com/articles/iec-61511-sis-lifecycle-questions-for-ai-in-process-plants/): IEC 61511-1:2016 and its 2017 consolidated version as catalogued by IEC, and an editorial question list for AI tools near a safety instrumented system.
- [IEC 62304 and FDA PCCP — two ways of talking about changes to AI device software](https://aiassurancedirectory.com/articles/iec-62304-and-fda-pccp-change-control-for-ai-software/): IEC 62304 and its 2015 amendment next to the FDA PCCP guidance: what each official page says, and an editorial comparison of what a change-control record must answer.
- [Industrial machinery ML — what evidence will a notified body expect?](https://aiassurancedirectory.com/articles/industrial-machinery-ml-what-evidence-will-a-notified-body-expect/): What IEC and AI Act Service Desk pages say about software evidence and learned components in machinery safety functions, and where public text stops. Editorial judgment is labeled.
- [ISO 10218 scope and exclusions — a checklist for AI-enabled robot buyers](https://aiassurancedirectory.com/articles/iso-10218-scope-exclusions-for-ai-robot-buyers/): What the ISO catalog says ISO 10218-1:2025 covers and excludes, how it relates to Regulation (EU) 2023/1230, and an editorial buyer checklist.
- [ISO/IEC 42001 and NIST AI 100-1: the two source documents behind the crosswalk](https://aiassurancedirectory.com/articles/iso-42001-nist-ai-100-1-source-documents-and-crosswalk-caveats/): Exact titles, what each document is, and the caveats NIST and the crosswalk itself state, before you rely on any clause-to-subcategory row.
- [ISO 42001 vs NIST AI RMF for defense contractors](https://aiassurancedirectory.com/articles/iso-42001-vs-nist-ai-rmf-for-defense-contractors/): What a DIB team should take from the certifiable AIMS versus the voluntary RMF, using NIST’s published crosswalk and DoD’s own statement that the RAI toolkit builds on the RMF.
- [ISO/PAS 8800 and ISO 26262 — reading the scope lines side by side](https://aiassurancedirectory.com/articles/iso-pas-8800-and-iso-26262-reading-the-scope-lines/): Side-by-side reading of the ISO catalog scope statements for ISO 26262-1:2018 and ISO/PAS 8800:2024, with a labeled editorial note on supplier questions.
- [Industrial machinery AI — Regulation 2023/1230, ISO 10218 and IEC 61508](https://aiassurancedirectory.com/articles/machinery-regulation-2023-1230-iso-10218-iec-61508/): Official EUR-Lex, ISO and IEC pages for machinery AI provisions, industrial-robot safety and the parent functional-safety publication.
- [Machinery Regulation 2023/1230 in AI Act Annex I Section B — what the official pages say](https://aiassurancedirectory.com/articles/machinery-regulation-ai-act-annex-i-section-b-item-21/): The Commission AI Act Service Desk lists Regulation (EU) 2023/1230 in Annex I Section B; Article 2(2) limits which AI Act provisions apply to such products.
- [Medical-device AI — FDA PCCP, IEC 62304 and EU MDR plus the AI Act](https://aiassurancedirectory.com/articles/medical-device-ai-fda-pccp-iec-62304-mdr/): Official FDA, IEC and EUR-Lex pages for AI-enabled device software, software life-cycle processes, and MDR as AI Act Annex I item 11.
- [Medical device ML — what evidence does FDA expect in a submission?](https://aiassurancedirectory.com/articles/medical-device-ml-what-evidence-does-fda-expect-in-a-submission/): What FDA’s January 2025 draft AI-enabled device software functions guidance and its PCCP guidance say a submission should contain, from the sections we read. Editorial judgment is labeled.
- [NASA SWEHB Artificial Intelligence topics 7.25 and 8.25 for flight software](https://aiassurancedirectory.com/articles/nasa-swehb-super-intelligence-topics-flight-software/): What SWEHB 7.25 and 8.25 tell NASA AI/ML projects about NPR 7150.2 and safety-critical limits. Official titles stay Artificial Intelligence. Handbook topics, not a certificate.
- [NIST AI 100-2 adversarial ML terms for defense T&E](https://aiassurancedirectory.com/articles/nist-ai-100-2-adversarial-ml-defense-te/): What NIST AI 100-2e2025’s adversarial-machine-learning taxonomy is, how it sits next to CDAO T&E and ATLAS, and what it does not certify.
- [NIST SP 800-218A SSDF for generative AI in defense software](https://aiassurancedirectory.com/articles/nist-sp-800-218a-ssdf-generative-ai-defense/): What the July 2024 SSDF Community Profile adds for generative and dual-use models, how it sits next to CMMC and the AI RMF, and what it does not certify.
- [Process industries ML — what evidence will an assessor expect?](https://aiassurancedirectory.com/articles/process-industries-ml-what-evidence-will-an-assessor-expect/): What the IEC catalog says about IEC 61511-1, IEC 61508-3 and ISO/IEC TR 5469 for an ML component near a safety instrumented system. Editorial judgment is labeled.
- [Process-industry SIS vendor pages — IEC 61511 named, IEC 61508 named, or neither](https://aiassurancedirectory.com/articles/process-sis-vendor-pages-iec-61511-named-versus-implied/): How four process-safety vendor pages word their standards claims, read against the IEC catalog scope of IEC 61511-1 and IEC 61508-1 (editorial reading labeled).
- [Prompt guardrails versus airborne runtime assurance](https://aiassurancedirectory.com/articles/prompt-guardrails-vs-airborne-runtime-assurance/): Why cloud LLM input/output rails are not NASA/ASTM runtime assurance, using the cited NeMo, Bedrock, Azure and NASA TM pages.
- [Turning the ISO/IEC 42001 to NIST AI RMF crosswalk into supplier evidence requests](https://aiassurancedirectory.com/articles/using-the-iso-42001-nist-ai-rmf-crosswalk-for-supplier-evidence-requests/): How a buyer can use the rows NIST published to decide what documents to ask an AI supplier for, with the editorial steps clearly separated from the sourced mappings.
- [An AI assurance glossary for aerospace and defense](https://aiassurancedirectory.com/articles/ai-assurance-glossary-aerospace-defense/): Official meanings of the terms that show up in FAA, EASA, NIST, DoD and CMMC AI work, each tied to the source that uses it.
- [An AI audit evidence checklist for regulated programs](https://aiassurancedirectory.com/articles/ai-audit-evidence-checklist/): A checklist of evidence artifacts for AI audits, each tied to the ISO/IEC 42001, NIST AI RMF, EU AI Act, EASA, NIST SP 800-171 or DoD source that expects it.
- [AI in MRO and predictive maintenance: regulatory considerations (FAA/EASA official material)](https://aiassurancedirectory.com/articles/ai-in-mro-predictive-maintenance-faa-easa/): FAA Roadmap maintenance and retirement sentences, AC 43-218 IAHM with no AI words found, and EASA-hosted ForMuLA research — not an MRO AI regulation.
- [AI incident reporting: EU AI Act Article 73 vs DoD guidance](https://aiassurancedirectory.com/articles/ai-incident-reporting-eu-ai-act-article-73-vs-dod/): Article 73 sets timed serious-incident reports for high-risk AI. Public DoD pages describe RAI repositories and existing processes, not an Article 73 equivalent.
- [AI red-teaming requirements for defense programs](https://aiassurancedirectory.com/articles/ai-red-teaming-requirements-for-defense-programs/): What official DoD, CDAO and NIST pages actually say about AI red-teaming, and what they do not make a contract clause.
- [Army, Navy and Air Force AI policies that name acquisition](https://aiassurancedirectory.com/articles/army-navy-air-force-ai-acquisition-policies/): What Army Project Linchpin, the Navy Strategy to Weaponize Data and Artificial Intelligence, and the DAF Artificial Intelligence Strategy actually say about buying and fielding AI.
- [Australia Defence Policy Settings for Responsible Use of AI](https://aiassurancedirectory.com/articles/australia-defence-responsible-use-of-ai/): What Australia's Policy Settings for Responsible Use of Artificial Intelligence in Defence publish as lawfulness, values-based principles and proportionate controls, versus DST's research method.
- [Autonomy and DoD Directive 3000.09 explained](https://aiassurancedirectory.com/articles/autonomy-and-dod-directive-3000-09-explained/): What DoD Directive 3000.09 (25 January 2023) actually covers: weapon-system autonomy, human judgment, senior review, and what it excludes.
- [Building an AI assurance case (GSN/AMLAS) for certification](https://aiassurancedirectory.com/articles/building-an-ai-assurance-case-gsn-amlas/): What the GSN Community Standard and AMLAS actually specify, and why neither is a published FAA or EASA means of compliance.
- [Canada DND/CAF Artificial Intelligence Strategy](https://aiassurancedirectory.com/articles/canada-dnd-caf-artificial-intelligence-strategy/): What the 2024 Department of National Defence and Canadian Armed Forces Artificial Intelligence Strategy publishes as its 2030 vision, five lines of effort, and procurement tasks.
- [CDAO test and evaluation of Artificial Intelligence models](https://aiassurancedirectory.com/articles/cdao-test-and-evaluation-ai-systems/): CDAO Test and Evaluation of Artificial Intelligence Models Framework: four T&E focus areas, what the April 2024 document says it is not, and how JATIC software fits.
- [CMMC and AI with CUI - what the rules actually say](https://aiassurancedirectory.com/articles/cmmc-and-ai-with-cui/): How CMMC and NIST SP 800-171 apply when an AI system, including a cloud AI service, handles controlled unclassified information, and where the rules are silent.
- [CMMC Level 2 vs Level 3 for AI systems](https://aiassurancedirectory.com/articles/cmmc-level-2-vs-level-3-for-ai/): What 32 CFR Part 170 actually requires at CMMC Level 2 and Level 3 when an AI system handles CUI, and what the Phase 2 suspension changes.
- [CMMC Program scoping for generative systems that handle CUI](https://aiassurancedirectory.com/articles/cmmc-program-scoping-generative-ai-cui/): What 32 CFR Part 170 actually calls the program, including the live CMMC 2.0 resource page, and how Level 2 asset categories apply to generative components.
- [Data assurance for ML in avionics: EASA learning assurance](https://aiassurancedirectory.com/articles/data-assurance-ml-avionics-easa-learning-assurance/): What EASA Issue 2 and the MLEAP research project say about data quality, the ODD, and the three data sets in the W-shaped process.
- [Data provenance and supply-chain security for ML models (SBOM/AIBOM)](https://aiassurancedirectory.com/articles/data-provenance-and-supply-chain-security-for-ml-models-sbom-aibom/): What CISA, NIST and NTIA actually say about SBOMs for AI software, and how CycloneDX ML-BOM and SPDX AI profiles relate, without inventing a mandate.
- [Supplier flow-down clauses for SI/AI in defense contracts](https://aiassurancedirectory.com/articles/dfars-far-flowdown-ai-si-defense-contracts/): No DFARS or FAR clause titled AI or Super Intelligence. What 252.204-7012, 7020, 7021 and FAR 52.204-21 actually require primes to flow down.
- [DO-178C and machine learning: where the gaps are](https://aiassurancedirectory.com/articles/do-178c-and-machine-learning-gaps/): Where requirements-based airborne software assurance strains under data-driven machine learning, and what EASA, the FAA and SAE G-34 are doing about each gap.
- [DO-330 tool qualification for ML development and verification toolchains](https://aiassurancedirectory.com/articles/do-330-tool-qualification-ml-toolchains/): When an ML training or verification program is a DO-330 tool. FTP1055 criteria, TQL-5 versus TQL-1, FAA Order 8110.49A, and what no public table assigns.
- [DoD RAI Toolkit vs NIST AI RMF: what each one is for](https://aiassurancedirectory.com/articles/dod-rai-toolkit-vs-nist-ai-rmf/): What the DoD RAI Toolkit and the NIST AI RMF each say about themselves, and the official statement that the toolkit builds on the RMF.
- [Does the FAA certify AI today? Current status](https://aiassurancedirectory.com/articles/does-the-faa-certify-ai-today/): The FAA still has no published AI-specific certification standard. What Version I of the roadmap, the STEP discipline page, and the 2026 Small Airplane Issues List actually say.
- [EASA AI Concept Paper levels explained](https://aiassurancedirectory.com/articles/easa-ai-concept-paper-levels-explained/): What EASA Issue 2 says about Level 1 and Level 2 AI, and what proposed Issue 03 adds for Level 0 and Level 3.
- [EU AI Act general-purpose AI model obligations](https://aiassurancedirectory.com/articles/eu-ai-act-gpai-model-obligations/): Chapter V GPAI model duties apply from 2 August 2025. They are not the postponed high-risk system dates, and not an aviation AMC.
- [EU AI Act obligations for aerospace suppliers outside the EU](https://aiassurancedirectory.com/articles/eu-ai-act-obligations-aerospace-suppliers-outside-eu/): How Article 2 of the EU AI Act can apply to aerospace suppliers established outside the Union, and which aviation and defence exclusions the official text actually states.
- [EU AI Act scope for defense and aviation: what is in, what is out, and the new dates](https://aiassurancedirectory.com/articles/eu-ai-act-scope-defense-and-aviation/): How the AI Act's military exclusion, dual-use rule and civil aviation treatment work, and which compliance dates apply after the July 2026 Digital Omnibus.
- [Executive Order 14434: Super Intelligence (SI) terminology for aerospace and defense teams](https://aiassurancedirectory.com/articles/executive-order-14434-super-intelligence-aerospace-defense/): What EO 14434 changes for U.S. executive-branch documents, and what it does not: statutes, regulations, historical records, and non-federal standards.
- [The FAA AI Safety Assurance Roadmap, explained](https://aiassurancedirectory.com/articles/faa-ai-safety-assurance-roadmap-explained/): A plain-language walk through the FAA's Roadmap for Artificial Intelligence Safety Assurance Version I - what it commits to, what it leaves open, and what it means for applicants.
- [FAA and EASA AI certification timelines compared](https://aiassurancedirectory.com/articles/faa-easa-ai-certification-timelines/): FAA AI Safety Assurance Roadmap milestones versus EASA AI Roadmap 2.0 and RMT.0742 dates: what is published and what is still scheduled.
- [FAA proposed Part 108 BVLOS and DoD Directive 3000.09](https://aiassurancedirectory.com/articles/faa-part-108-bvlos-and-dod-3000-09/): Two live autonomy regimes: the FAA/TSA NPRM that would create 14 CFR Part 108 for civil UAS BVLOS, versus DoD Directive 3000.09 on autonomy in weapon systems.
- [FedRAMP and IL levels for AI SaaS in defense](https://aiassurancedirectory.com/articles/fedramp-and-il-levels-for-ai-saas-in-defense/): What FedRAMP.gov and official DoD pages actually say about FedRAMP Certification versus DoD Impact Levels for AI cloud services — two different systems.
- [Formal verification of neural networks: what's usable today](https://aiassurancedirectory.com/articles/formal-verification-neural-networks-whats-usable-today/): What official neural-network verifier docs and papers actually claim, using ACAS Xu aviation examples, and what they do not make a certification path.
- [Human-machine teaming in DoD and NATO guidance](https://aiassurancedirectory.com/articles/human-machine-teaming-requirements-dod-nato/): What official DoD, NATO, UK MOD and EASA pages actually say about human judgment, human control and human-AI teaming.
- [ISO/IEC 42001 vs NIST AI RMF: a practical crosswalk](https://aiassurancedirectory.com/articles/iso-42001-vs-nist-ai-rmf-crosswalk/): How the certifiable ISO/IEC 42001 management system and the voluntary NIST AI RMF fit together, with example mappings taken from NIST's published crosswalk.
- [ISO/IEC 23894 and 5338 for engineering teams](https://aiassurancedirectory.com/articles/iso-iec-23894-and-5338-for-engineering-teams/): What ISO catalog abstracts say ISO/IEC 23894:2023 risk guidance and ISO/IEC 5338:2023 life-cycle processes are, and that neither is a certifiable AIMS or aviation AMC.
- [ISO/IEC 24029 neural-network robustness is not an aviation AMC](https://aiassurancedirectory.com/articles/iso-iec-24029-neural-network-robustness/): ISO/IEC TR 24029-1 and 24029-2 assess neural-network robustness. Catalog text only: they are not an FAA or EASA AMC. Part 3 is still a draft.
- [What auditors ask for in an ISO/IEC 42001 certification audit](https://aiassurancedirectory.com/articles/iso-iec-42001-certification-audit-what-auditors-ask/): What UKAS- and ANAB-accredited certification bodies publish about an ISO/IEC 42001 audit, from public accreditation and certification-body material only.
- [ISO/IEC 42001 vs ISO 9001/AS9100 for aerospace quality systems](https://aiassurancedirectory.com/articles/iso-iec-42001-vs-iso-9001-as9100-aerospace-quality/): What ISO, IAQG and ANAB actually say about AI management systems versus quality management and the 9100-series — and that we found no official ICOP 42001 scheme.
- [ISO/IEC 42005:2025 AI system impact assessment](https://aiassurancedirectory.com/articles/iso-iec-42005-ai-system-impact-assessment/): ISO/IEC 42005:2025 is guidance for AI system impact assessments. Catalog facts only: it complements 42001 and 23894 and is not a certifiable AIMS.
- [ISO/IEC TR 5469 and IEC 61508 for ML components](https://aiassurancedirectory.com/articles/iso-iec-tr-5469-and-iec-61508-for-ml/): What official ISO and IEC catalog pages say about AI in safety-related functions, and what they do not say about SIL for machine learning.
- [ITAR/EAR export controls and AI models](https://aiassurancedirectory.com/articles/itar-ear-export-controls-and-ai-models/): What BIS and DDTC official pages actually control for AI models and software: USML technical data, EAR model weights under ECCN 4E091, and what they do not call a general AI license.
- [Japan MOD AI utilization policy and ATLA responsible AI R&D guideline](https://aiassurancedirectory.com/articles/japan-mod-ai-utilization-policy/): What Japan's July 2024 防衛省ＡＩ活用推進基本方針 and ATLA's Guideline for Responsible AI Application in R&D of AI-Equipped Defense Systems actually say.
- [How to map an AI model to DO-178C / DO-330 tool qualification](https://aiassurancedirectory.com/articles/mapping-ai-models-to-do-178c-do-330-tool-qualification/): What DO-330 actually qualifies, why a trained model is usually the software item rather than a tool, and what the FAA has said about extending DO-330 to AI.
- [Model cards and system cards for defense AI documentation](https://aiassurancedirectory.com/articles/model-cards-and-system-cards-for-defense-ai-documentation/): What official model-card and system-card pages actually specify, and what CDAO and NIST documents do and do not require for defense programs.
- [NATO's revised AI Strategy and the Principles of Responsible Use](https://aiassurancedirectory.com/articles/nato-revised-ai-strategy-principles-of-responsible-use/): What NATO's 2021 and 2024 Artificial Intelligence Strategy summaries actually say about the six Principles of Responsible Use, TEV&V, DIANA and Allied industry.
- [NIST AI 600-1 (Generative AI Profile) for defense contractors](https://aiassurancedirectory.com/articles/nist-ai-600-1-for-defense-contractors/): What NIST AI 600-1 actually is, which generative-AI risks it names, and how that sits next to CMMC and DoD Responsible AI rather than replacing them.
- [NIST AI 600-1 suggested actions for generative AI on a defense program](https://aiassurancedirectory.com/articles/nist-ai-600-1-generative-actions-defense/): Which NIST AI 600-1 suggested actions name acquisition, contractors, national security and information security, and what they do not make mandatory for DoD work.
- [Which NIST SP 800-171 controls matter most when AI tools handle CUI?](https://aiassurancedirectory.com/articles/nist-sp-800-171-controls-ai-tools-cui/): Official pages do not rank a subset of 800-171 for AI. What CMMC, NIST and NSA/CISA actually say when AI systems process CUI.
- [Rotorcraft and eVTOL autonomy: FAA/EASA powered-lift and SC-VTOL AI-relevant guidance](https://aiassurancedirectory.com/articles/rotorcraft-evtol-autonomy-faa-easa-powered-lift/): FAA powered-lift AC 21.17-4, the FAA Safety Framework for Aircraft Automation, and EASA SC-VTOL: what they say, and that a search of SC-VTOL-02 found no AI or ML words.
- [Runtime assurance and simplex architectures for ML in flight](https://aiassurancedirectory.com/articles/runtime-assurance-simplex-architectures-ml-in-flight/): What NASA, ASTM F3269-21 and the 1998 Simplex paper say about runtime assurance for ML in flight — and what they do not call a means of compliance.
- [SAE G-34 / ARP6983 status: what is published versus still draft](https://aiassurancedirectory.com/articles/sae-g-34-arp6983-status/): EUROCAE WG-114 still lists ED-324 / ARP6983 as Draft. Companion ER drafts, published AIR dates, and what EASA and the FAA have and have not accepted.
- [Space systems and AI assurance (NASA/ESA/Space Force official guidance)](https://aiassurancedirectory.com/articles/space-systems-and-ai-assurance-nasa-esa-ussf/): What NASA SWEHB Artificial Intelligence topics, ESA AISSA public pages and the Space Force FY2025 Data and AI plan actually say — and what they do not call a certification standard.
- [What JSP 936 Part 1 asks of industry partners and suppliers](https://aiassurancedirectory.com/articles/uk-mod-jsp-936-supplier-obligations/): Who UK MOD JSP 936 Part 1 binds, what must versus should means for suppliers, how legacy AI is treated, and how the AI Practitioner's Handbook relates.
- [UK MOD JSP 936 vs DoD Responsible AI](https://aiassurancedirectory.com/articles/uk-mod-jsp-936-vs-dod-responsible-ai/): What official UK MOD and US DoD pages each claim about dependable or responsible AI, without inventing a clause-by-clause map.
- [UL 4600 is not an aviation or DoD 3000.09 means of compliance](https://aiassurancedirectory.com/articles/ul-4600-vs-aviation-and-dod-autonomy/): What UL 4600’s public catalog actually scopes (autonomous vehicles, no human driver) versus FAA, EASA and DoD 3000.09 pages. Not an aviation AMC we have found.

## Tool directory
- [All tools](https://aiassurancedirectory.com/tools/): Filterable directory; each entry cites its public source.
- [6clicks (ISO 42001)](https://aiassurancedirectory.com/tools/6clicks-iso-42001/): 6clicks. GRC with a pre-configured ISO/IEC 42001:2023 AIMS, Hailey AI mapping, SoA and Hub & Spoke. Cross-maps ISO 27001 and the EU AI Act. Homepage names SaaS, sovereign cloud or on-prem, and cloud, on-premises, air-gapped or hybrid. Industries: Defense & national security, Other safety-critical.
- [AADvance Control System](https://aiassurancedirectory.com/tools/rockwell-aadvance/): Rockwell Automation. Distributed, scalable safety instrumented system with fail-safe to TMR architectures. Official page: IEC 61508 certified (TÜV and Exida); TÜV-suitable for IEC 61508 up to SIL 3 and IEC 61511-1. SIL 1–3 in the same system. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [ABB High Integrity I/O (S800 and Select I/O)](https://aiassurancedirectory.com/tools/abb-high-integrity-io/): ABB. ABB SIL3 I/O for System 800xA High Integrity. Select I/O High Integrity is listed as certified for IEC 61508-SIL3 and compatible with AC 800M controllers using SM812. Page does not name IEC 61511. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [ABB System 800xA High Integrity](https://aiassurancedirectory.com/tools/abb-800xa-high-integrity/): ABB. ABB describes System 800xA High Integrity as a TÜV-certified SIL3 safety system and a complete SIS, deployable with System 800xA or independently. Page says it gives flexibility to meet IEC 61508 and IEC 61511 requirements. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [Adelard ASCE](https://aiassurancedirectory.com/tools/adelard-asce/): Adelard (NCC Group). Assurance-case software with CAE (including ASCAD 2.0 for autonomous systems and AI-driven machine-learning behaviour) and GSN Version 3 plus a Modular GSN plugin. Node-locked and floating licences; both can operate with limited or no Internet. Customer stories name MoD DE&S QEC ATM and aerospace. Industries: Aerospace & aviation, Defense & national security, Other safety-critical.
- [Advai](https://aiassurancedirectory.com/tools/advai/): Advai. UK AI testing and monitoring platform for performance, safety, security and robustness, with Defence & Government among named sectors. Platform covers agents, LLMs, computer vision, time series and multimodal systems; Model Arena for vendor selection. Industries: Defense & national security, Cross-industry.
- [Adversarial Robustness Toolbox (ART)](https://aiassurancedirectory.com/tools/ibm-art/): Linux Foundation AI & Data (started at IBM). Python library hosted by LF AI & Data for evaluating and defending ML models against evasion, poisoning, extraction and inference. PyPI 1.20.1 (7 July 2025) lists Python 3.10–3.12. Supports TensorFlow, Keras, PyTorch and similar frameworks. MIT-licensed. DARPA HR001120C0013 acknowledgment. Industries: Defense & national security, Cross-industry.
- [AdvoCATE](https://aiassurancedirectory.com/tools/nasa-advocate/): NASA Ames Research Center. NASA Ames Assurance Case Automation Toolset for GSN arguments, hazard analysis, bow-tie risk models and verification artifacts. NTRS User Guide 1.4 covers safety risk management. DARPA Assured Autonomy acknowledgment. Industries: Aerospace & aviation, Space systems.
- [aeShield](https://aiassurancedirectory.com/tools/aeshield/): aeSolutions. Functional-safety documentation platform for IEC 61511 SIL calculations, SRS, cause-and-effect and test plans. Official page heading: IEC 61511 Functional Safety Compliance Made Simple. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [AI Practitioner's Handbook (AIPH)](https://aiassurancedirectory.com/tools/uk-mod-aiph/): UK Ministry of Defence / Defence AI Centre. UK MOD Part 2-style handbook (BETA) to comply with JSP 936 Part 1. Guidance for leaders, developers and users. DAIC AI Assurance Framework (Published 27 February 2026) covers people, process, evidence and technology; names SROs and RAISOs. Industries: Defense & national security.
- [AI Verify Testing Framework](https://aiassurancedirectory.com/tools/ai-verify-testing-framework/): AI Verify Foundation / IMDA / PDPC. Testing framework of 11 internationally recognised AI governance principles for Traditional and Generative AI. Mapped to NIST AI RMF (13 Oct 2023), NIST AI 600-1 (29 May 2025) and ISO/IEC 42001 (21 July 2025). IMDA/PDPC MVP 25 May 2022; GitHub 7 June 2023. Industries: Cross-industry.
- [Algorithmic Impact Assessment (Canada AIA)](https://aiassurancedirectory.com/tools/canada-aia/): Treasury Board of Canada Secretariat. Treasury Board Secretariat questionnaire (65 risk and 41 mitigation questions) that scores automated decision systems into Levels I–IV under the Directive on Automated Decision-Making. Developed in the open under an MIT licence. Mandatory for in-scope Government of Canada systems. Industries: Cross-industry.
- [Aligned Elements](https://aiassurancedirectory.com/tools/aligned-elements/): Aligned AG. Medical-device ALM and eQMS for design-control and technical-file work. Homepage names pre-defined IEC 62304 Design Control templates. Regulatory-compliance page names IEC 62304-1:2015 software safety classification. Not an FDA PCCP product. Industries: Medical devices.
- [Amazon Bedrock Guardrails](https://aiassurancedirectory.com/tools/amazon-bedrock-guardrails/): Amazon Web Services. Configurable AWS safeguards for generative AI: content filters, denied topics, word lists, PII/sensitive-information filters, contextual grounding and Automated Reasoning checks. ApplyGuardrail can run those filters without invoking a foundation model. Industries: Cross-industry.
- [Ansys medini analyze](https://aiassurancedirectory.com/tools/ansys-medini-analyze/): Ansys. Model-based safety analysis (HAZOP, HARA, FTA, FMEA/FMEDA) for E/E and software. Named standards: ISO 26262, IEC 61508, ARP 4761, ISO 21448 (SOTIF) and MIL-STD-882E. SOTIF covers hazards from sensor and perception-algorithm limitations. Not a model verifier. Industries: Other safety-critical, Aerospace & aviation, Defense & national security, Automotive.
- [Ansys SCADE Suite](https://aiassurancedirectory.com/tools/ansys-scade-suite/): Ansys. Model-based development environment for critical embedded software. KCG C/Ada code generator is qualified as a development tool for DO-178B up to Level A and DO-178C/DO-330 at TQL-1. Avionics and Flight Controls named. Not a neural-network verifier. Industries: Aerospace & aviation, Other safety-critical, Automotive, Industrial machinery and robotics.
- [Apptega (ISO 42001)](https://aiassurancedirectory.com/tools/apptega-iso-42001/): Apptega. ISO 42001 compliance software with pre-built questionnaires, evidence collection, Audit Manager and harmonized multi-framework controls. Assigns tasks to internal teams and shares updates with auditors. The page names 12,000+ compliance programs and a Foresite Cybersecurity customer quote. Industries: Cross-industry.
- [Arthur (Agent Security & Governance)](https://aiassurancedirectory.com/tools/arthur-ai/): Arthur. Discovers agents across endpoints, cloud and private data centers; traces tool calls; enforces policies and guardrails. Official page names fully hosted SaaS, on-prem, or hybrid. An Arthur column maps product evidence to ISO 42001, the EU AI Act and NIST AI RMF. Industries: Cross-industry.
- [Asenion AI Control System](https://aiassurancedirectory.com/tools/asenion-ai-control-system/): Asenion. Asenion AI Control System turns EU AI Act, ISO/IEC 42001 and NIST AI RMF requirements into Assess, Verify and Witness controls with audit-grade evidence. Asenion is ISO/IEC 42001 certified for the Control System. A homepage quote names the former Fairly brand. Industries: Cross-industry.
- [Astah System Safety (GSN)](https://aiassurancedirectory.com/tools/astah-gsn/): Change Vision. GSN modeling in Astah System Safety. Names GSN Community Standard version 1.0 and OMG SACM (ARM) import/export, plus SysML Requirement-to-Goal sync, STPA/STAMP, Auto-Layout and an in-app Script Editor. Marketing page lists automotive (ISO 26262), aerospace (DO-178B), rail, nuclear and defense. Industries: Other safety-critical, Aerospace & aviation, Defense & national security, Automotive, Medical devices, Process industries.
- [Astrée](https://aiassurancedirectory.com/tools/absint-astree/): AbsInt. Sound static analyzer for safety-critical C and C++. Names hazard identification against ISO 26262, DO-178C, IEC-61508 and EN-50128, plus Qualification Support Kits for those standards. Bosch Automotive Steering and Airbus are named users. Not a neural-network verifier. Industries: Automotive, Industrial machinery and robotics, Aerospace & aviation, Other safety-critical.
- [Azure AI Content Safety](https://aiassurancedirectory.com/tools/azure-ai-content-safety/): Microsoft. Azure service with text and image APIs that detect sexual content, violence, hate and self-harm, plus Prompt Shields, groundedness detection, protected-material scanning and a Task adherence API. F0 and S0 tiers. Industries: Cross-industry.
- [BTC TestStack](https://aiassurancedirectory.com/tools/btc-teststack/): BTC Embedded Systems. Testing stack (successor to BTC EmbeddedPlatform / EmbeddedTester) for model-based, hand-written and AI-generated code. TÜV Süd certificate names ISO 26262 (automotive), IEC 61508-3 (industrial) and IEC 62304 (medical). ISO 26262 TCL including ASIL D. Industries: Automotive, Medical devices, Industrial machinery and robotics, Other safety-critical.
- [CAISAR](https://aiassurancedirectory.com/tools/caisar/): CEA List. CEA List open-source platform (CAISAR 6.0, June 2026) for characterizing AI safety and robustness. WhyML specifications discharged by PyRAT, Marabou, nnenum, alpha-beta-CROWN and others. Examples include functional properties of ACAS Xu. Industries: Aerospace & aviation, Other safety-critical.
- [CDAO AI Assurance (AIA) Toolkit](https://aiassurancedirectory.com/tools/dod-rai-toolkit/): DoD Chief Digital and Artificial Intelligence Office. CDAO self-evaluation toolkit that operationalizes DoW AI Ethical Principles. Released November 2023 as the RAI Toolkit; the live Tradewinds page titles it AIA Toolkit. For Program Managers, AI Developers, Acquisition Teams, Legal/Compliance and End Users; IL2 and IL5. Industries: Defense & national security.
- [CDAO Joint AI Test Infrastructure Capability (JATIC)](https://aiassurancedirectory.com/tools/cdao-jatic/): DoD Chief Digital and Artificial Intelligence Office. CDAO program (funded FY23–FY29) of Python AI T&E libraries, the RAVEN MLOps platform and the maite types/protocols. Focused on CV classification and object detection for UAV, satellite and autonomous-driving missions. Public packages on GitHub, Conda and PyPI. Not a certification. Industries: Defense & national security.
- [CDAO Test and Evaluation of Artificial Intelligence Models Framework](https://aiassurancedirectory.com/tools/cdao-te-ai-models-framework/): DoD Chief Digital and Artificial Intelligence Office. April 2024 public CDAO primer on what to consider in a T&E strategy for AI models in a Defense context. Four focus areas, a performance iceberg beyond correctness, and named links to the DoD Ethical AI Principles and NIST AI RMF. Explicitly not binding policy. Industries: Defense & national security.
- [Check Point AI Guardrails](https://aiassurancedirectory.com/tools/checkpoint-ai-guardrails/): Check Point. Check Point AI Guardrails (Guard API at api.lakera.ai/v2/guard) screens LLM and agent traffic for prompt attacks, data leakage, content violations and off-policy tool use. Model-agnostic; 100+ languages. Available as SaaS or self-hosted. Industries: Cross-industry.
- [CISA Software Bill of Materials for AI — Minimum Elements](https://aiassurancedirectory.com/tools/cisa-sbom-ai/): CISA (with G7 partners). May 2026 joint CISA/G7 guidance on supplemental SBOM elements for SI software, plus general SBOM minimum elements. Live heading uses Super Intelligence (SI); the guidance title still says AI. Not exhaustive or mandatory. July 2026 general elements add no AI-only fields. Industries: Cross-industry.
- [Cisco AI Defense](https://aiassurancedirectory.com/tools/cisco-ai-defense/): Cisco. Cisco AI Defense: algorithmic red teaming across 200+ threat subcategories, AI Runtime Protection guardrails, and network-layer enforcement across cloud, VPC and on-premises AI POD. Datasheet maps findings to NIST AI-RMF. Industries: Cross-industry.
- [Cloudflare AI Security for Apps](https://aiassurancedirectory.com/tools/cloudflare-ai-security-for-apps/): Cloudflare. Cloudflare WAF detections for LLM apps (formerly Firewall for AI; docs updated 8 September 2026): PII, unsafe-topic and prompt-injection scanning of JSON requests to cf-llm endpoints. Model-agnostic. Enterprise paid add-on; the WAF must be enabled. Industries: Cross-industry.
- [CODESYS Virtual Safe Control SL](https://aiassurancedirectory.com/tools/codesys-virtual-safe-control/): CODESYS. Virtual safety controller in a Linux container. Official page: certified according to IEC 61508 for SIL 3 applications, without IEC 61508 hardware certification of the host. TÜV SÜD. Diversified Encoding dual-channel. Not a trained-model SIL. Industries: Industrial machinery and robotics, Other safety-critical.
- [Collibra AI Command Center](https://aiassurancedirectory.com/tools/collibra-ai-governance/): Collibra. Collibra AI Command Center (evolved from AI Governance; docs dated 7 October 2026): unified registry for AI agents, models and use cases, AI Trust Score, guardian agents and agent contracts. Out-of-the-box EU AI Act, NIST AI RMF and AI UC-1 assessment templates. Industries: Cross-industry.
- [ComplianceQuest Medical Device QMS](https://aiassurancedirectory.com/tools/compliancequest-medical/): ComplianceQuest. Salesforce-native QMS and PLM for medical device manufacturers. Official SaMD page names FDA Predetermined Change Control Plans (PCCP), IEC 62304 lifecycle requirements, cybersecurity documentation and IMDRF SaMD guidance. Not a model verifier. Industries: Medical devices.
- [ControlMap (ISO 42001)](https://aiassurancedirectory.com/tools/controlmap-iso-42001/): ScalePad. MSP-native GRC platform with ISO/IEC 42001 in a 63+ framework library: mapped controls, evidence and reporting. Partners import the framework to client tenants and cross-map against current frameworks. 2026 release notes add ISO 42001 Jump Start and an ISO 27001 crosswalk. Industries: Cross-industry.
- [Counterfit](https://aiassurancedirectory.com/tools/microsoft-counterfit/): Microsoft. MIT-licensed CLI (banner Version 1.1.0) that wraps Adversarial Robustness Toolbox, TextAttack and AugLy to assess ML-system security. Linux or Windows WSL; optional Azure Container Instance. Python 3.8+. Windows and macOS native support is still listed as work in progress. Industries: Cross-industry.
- [Credo AI](https://aiassurancedirectory.com/tools/credo-ai/): Credo AI. Enterprise AI governance with GAIA assistant, Agent Registry, 300+ integrations and ready-to-deploy policy packs for the EU AI Act, NIST AI RMF and ISO 42001. Named sectors: insurance, financial services, federal and healthcare. Industries: Cross-industry.
- [Croissant (MLCommons)](https://aiassurancedirectory.com/tools/mlcommons-croissant/): MLCommons. MLCommons metadata format and Apache-2.0 Python library (pip install mlcroissant; Python 3.10+) that describes ML datasets in four layers, plus a v1.0 RAI vocabulary (dataBiases, dataLimitations, dataUseCases). Discoverable via Google Dataset Search; loaders for TensorFlow, JAX and PyTorch. Industries: Cross-industry.
- [CycloneDX (AI/ML-BOM)](https://aiassurancedirectory.com/tools/cyclonedx/): OWASP / Ecma TC54. OWASP/Ecma TC54 BOM standard (CycloneDX 1.7, released 21 October 2025) published as ECMA-424 2nd edition (10 December 2025). Homepage names 260+ tools, the defense industrial base, satellite and space systems, and medical-device HBOM/SBOM. The ML-BOM guide names the EU AI Act and NIST AI RMF. Industries: Aerospace & aviation, Defense & national security, Space systems, Medical devices.
- [DeltaV SIS](https://aiassurancedirectory.com/tools/emerson-deltav-sis/): Emerson. Safety instrumented system used across process industries for ESD, burner management, fire and gas and pipeline. Official brochure: meets IEC 61508 and IEC 61511 requirements for physical separation; built for IEC 61511 compliance; TÜV and exida certified for SIL 3 without restriction. Industries: Process industries, Other safety-critical.
- [Drata (ISO 42001)](https://aiassurancedirectory.com/tools/drata-iso-42001/): Drata. Compliance automation that maps ISO 42001 AI-management-system controls, evidence, ownership and risk so enterprises can run an AIMS and stay audit-ready. Help Center also names an AIMS policy template and automated evidence collection. Not a model-assurance tool. Industries: Cross-industry.
- [Edge Case](https://aiassurancedirectory.com/tools/edge-case/): Edge Case. Safety-as-a-Service: Guardian Digital Safety Twin plus AI/ML software-safety, system-safety engineering, T&E and certification practices. The homepage names AUSA 2025 defense programs and quotes Aurora on third-party safety expertise. Industries: Defense & national security, Other safety-critical.
- [ENVOLOK](https://aiassurancedirectory.com/tools/envolok/): ENVOLOK. Command-line program that checks a modification against an FDA-authorized Predetermined Change Control Plan before it ships. Official page: DEPLOY, BLOCK or UNKNOWN; offline; no network calls during evaluation. Not a QMS or model verifier. Industries: Medical devices.
- [ERAN](https://aiassurancedirectory.com/tools/eran/): SRI Lab, ETH Zurich. ETH SRI Lab Apache-2.0 analyzer (DeepZ, DeepPoly, GPUPoly) for complete and incomplete verification of feedforward, convolutional and residual networks, including ACAS Xu. Python 3.6+ and TensorFlow 1.11+. Uses ELINA; Gurobi for RefineZono/RefinePoly. Industries: Aerospace & aviation.
- [EU AI Act Service Desk](https://aiassurancedirectory.com/tools/eu-ai-act-service-desk/): European Commission. Official Commission Service Desk and Single Information Platform for the AI Act (in force 1 August 2024). Explorer and Compliance Checker. Annex I civil-aviation entry is unmanned-aircraft-limited. Consolidated text as at 27 July 2026. Industries: Aerospace & aviation, Cross-industry.
- [exSILentia](https://aiassurancedirectory.com/tools/exsilentia/): exida. Modular safety-lifecycle suite for process-safety management and SIS functional-safety work. Official module table includes IEC 61511 Compliance Documentation and SILver, an IEC 61508 compliant SIL-verification calculation engine. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [Fiddler AI](https://aiassurancedirectory.com/tools/fiddler-ai/): Fiddler AI. AI control plane for agentic and predictive models: continuous evaluations, inline guardrails and governance. Government page names DoD ML/LLM deployment, AWS GovCloud, and air-gapped options. Homepage FAQ names SaaS, VPC or on-premises. Industries: Defense & national security, Cross-industry.
- [Foretellix Foretify](https://aiassurancedirectory.com/tools/foretellix-foretify/): Foretellix. Foretify Physical AI Development Toolchain for training and validation of AI-powered autonomous-vehicle stacks: data curation, synthetic scenario generation, and coverage and safety-evidence evaluation. Not an aviation AMC. Industries: Other safety-critical, Automotive.
- [garak](https://aiassurancedirectory.com/tools/nvidia-garak/): NVIDIA. NVIDIA LLM vulnerability scanner (Generative AI Red-teaming & Assessment Kit). Probes hallucination, leakage, prompt injection, jailbreaks and more. Generators include Hugging Face, OpenAI, Bedrock, NIM and REST. pip or conda, Python 3.11–3.13. Apache-2.0. Industries: Cross-industry.
- [Giskard](https://aiassurancedirectory.com/tools/giskard/): Giskard. LLM-agent testing (Python SDK and Hub UI), red-teaming and runtime Guards with an EU AI Act Policy Pack (OPA/Rego). On-premise Hub for public-sector and defense workloads. Named sectors: banking and insurance. Industries: Defense & national security, Cross-industry.
- [Google Cloud Model Armor](https://aiassurancedirectory.com/tools/google-model-armor/): Google Cloud. Google Cloud service that screens LLM prompts and responses for responsible-AI safety categories, prompt injection and jailbreak, and sensitive data. Templates set confidence thresholds. Works on Google Cloud or other cloud providers. Industries: Cross-industry.
- [Greenlight Guru (SiMD/SaMD)](https://aiassurancedirectory.com/tools/greenlight-guru-samd/): Greenlight Guru. QMS and product-development software for software-enabled medical devices (SiMD/SaMD). Official page says the solution auto-generates audit-ready records to stay compliant with IEC 62304, linking tests and design changes to the DHF. Not an FDA PCCP authoring product. Industries: Medical devices.
- [GRIF SIL module](https://aiassurancedirectory.com/tools/grif-sil-module/): TotalEnergies. SIL calculation and verification software in the GRIF suite. Page headline: assessment of the availability level according to IEC 61508 and IEC 61511. Lists PFD and PFH computation and HFT and architectural constraints. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [Guardrails AI](https://aiassurancedirectory.com/tools/guardrails-ai/): Guardrails AI. Apache-2.0 Python framework (pip install guardrails-ai; Python 3.10–3.13) that runs Input/Output Guards of Hub validators on LLM traffic and can emit structured LLM output. Optional Flask server via guardrails start. Version 0.11.0. Industries: Cross-industry.
- [HEART (Hardened Extension of ART)](https://aiassurancedirectory.com/tools/jatic-heart/): IBM (CDAO JATIC collaboration). MIT-licensed Python 3.9–3.11 library (pip install heart-library; 0.7.0) that extends ART for DoD T&E. Modules: attacks, estimators, metrics. Aligns to MAITE; depends on ART ≥1.20.1. CDAO contract W519TC-23-9-2037. Optional Gradio front end. Industries: Defense & national security.
- [HiddenLayer AI Security Platform](https://aiassurancedirectory.com/tools/hiddenlayer/): HiddenLayer. AI security platform with government and defense pages: NIST AI RMF alignment, contractor and open-source model scanning, real-time monitoring, and air-gapped options for classified disconnected environments. The homepage also names AI Discovery, supply-chain, attack simulation and runtime security. Industries: Defense & national security, Cross-industry.
- [HIMA HIMax](https://aiassurancedirectory.com/tools/hima-himax/): HIMA. Fault-tolerant safety controller for process-industry SIS including fire-and-gas. Official fire-and-gas page: TÜV-certified HIMax suitable for use up to SIL 3 and certified in accordance with IEC 61511 up to SIL 3. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [Holistic AI](https://aiassurancedirectory.com/tools/holistic-ai/): Holistic AI. Identify, Protect and Enforce platform: shadow-AI discovery, agentic red-teaming and framework assessments for the EU AI Act, NIST AI RMF and ISO 42001. Guardian Agents (Sentinel watch/detect; Operative act/enforce) via the HAI Guardian SDK. 15+ read-only integrations. Industries: Cross-industry.
- [Honeywell Safety Manager SC](https://aiassurancedirectory.com/tools/honeywell-safety-manager-sc/): Honeywell. Third-generation QMR (2oo4D) safety platform for ESD/SIS applications in the Process Control industry. TÜV Rheinland certified up to SIL 3. Official standards list includes IEC 61508/61511. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [Hugging Face Dataset Cards](https://aiassurancedirectory.com/tools/huggingface-dataset-cards/): Hugging Face. Hub dataset documentation: each dataset README.md is a dataset card with YAML metadata. Force-modality tags (3d, audio, geospatial, image, tabular, text, timeseries, video) and RL-environment tags describe compatibility; they do not create a new repository type. Industries: Cross-industry.
- [Hugging Face Model Cards](https://aiassurancedirectory.com/tools/huggingface-model-cards/): Hugging Face. Hub model cards are README.md files with YAML metadata (license, datasets, library_name, pipeline_tag, model-index evals). CDAO's Generative AI RAI Toolkit names the Hugging Face model-card template as a documentation tool for traceability. Industries: Cross-industry.
- [Hyperproof (ISO 42001)](https://aiassurancedirectory.com/tools/hyperproof-iso-42001/): Hyperproof. Compliance operations platform with an out-of-the-box ISO 42001 AIMS template (Annex A) in a 160+ framework library. Guide covers Clauses 4–10, Annexes A–D and AI risk vs impact assessments. Crosswalks name NIST AI RMF. Audit Module for inviting the auditor. Industries: Cross-industry.
- [IARPA TrojAI](https://aiassurancedirectory.com/tools/iarpa-trojai/): IARPA (with NIST test and evaluation). IARPA program (BAA W911NF-19-S-0012, closed) and NIST T&E resources for detecting Trojan/backdoor attacks in trained AIs before deployment. T&E partners: JHU APL, NIST, SEI and Sandia. NIST still hosts a leaderboard and baseline detector; that page is no longer updated. Industries: Defense & national security.
- [IBM watsonx.governance](https://aiassurancedirectory.com/tools/ibm-watsonx-governance/): IBM. IBM AI governance product: enterprise inventory, shadow-AI detection, policy enforcement, and Compliance Accelerators that name the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Sold for cloud and on-prem. Infosys 2,700+ use cases; US Open court-fairness case. Industries: Cross-industry.
- [IEC Certification Kit (for ISO 26262 and IEC 61508)](https://aiassurancedirectory.com/tools/mathworks-iec-certification-kit/): MathWorks. MathWorks kit of TÜV SÜD certificates and qualification work products for ISO 26262 (ASIL A–D), IEC 61508 (SIL 1–4) and IEC 62304. Supported-products table names IEC 61511:2016 for PLC Coder. ISO 26262 guidance covers AI-assisted model editing, review and test generation. Industries: Automotive, Medical devices, Industrial machinery and robotics, Process industries, Other safety-critical.
- [Inspect (UK AI Security Institute)](https://aiassurancedirectory.com/tools/uk-aisi-inspect/): UK AI Security Institute. UK AISI MIT-licensed LLM evaluation framework (pip install inspect-ai; Python ≥3.10). 200+ ready-to-run evals, 20+ model providers, and sandboxes for Docker, Kubernetes, Modal, Proxmox and Vagrant. Industries: Cross-industry.
- [INTEGRITY RTOS](https://aiassurancedirectory.com/tools/ghs-integrity/): Green Hills Software. Separation-kernel RTOS with integrated platforms for automotive, industrial safety, medical devices and avionics. Certifications named: ISO 26262 ASIL D, IEC 61508 SIL 3, FDA Class II and Class III medical device approval, and DO-178B/C DAL A for INTEGRITY-178. Not an AI model verifier. Industries: Automotive, Medical devices, Industrial machinery and robotics, Aerospace & aviation, Other safety-critical.
- [ISMS.online (ISO 42001)](https://aiassurancedirectory.com/tools/isms-online-iso-42001/): ISMS.online. ISMS.online ISO 42001 page (Updated 14 July 2026): pre-configured templates and frameworks, dynamic risk management and document management. Certification described as valid three years with annual surveillance. ARM path from gap analysis to certification. Industries: Cross-industry.
- [Jama Connect for Medical Device & Life Sciences](https://aiassurancedirectory.com/tools/jama-connect-medical/): Jama Software. Requirements, risk and V&V platform for medical device and life-sciences teams. Official frameworks list includes Medical Software Development: IEC 62304, plus FDA 21 CFR 820.30, EU MDR and ISO 14971. Suitably validated by TÜV SÜD for safety-related development. Not an FDA PCCP product. Industries: Medical devices.
- [Kenexis SIS](https://aiassurancedirectory.com/tools/kenexis-sis/): Kenexis. Safety-lifecycle tool formerly named Vertigo. Page heading: ISA/IEC 61511 SIS Lifecycle Management and SIL Verification. Lists a SIL verification calculation engine, failure rate database, SRS documentation and dashboards. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [KUKA iiQKA.OS2](https://aiassurancedirectory.com/tools/kuka-iiqka-os2/): KUKA. Operating system and virtual robot controller for KUKA industrial robots. Official page: AI-capable, ready for ISO 10218:2025 and new machinery regulations; compliant with the machinery regulations (MACH REG). LINUX-based. Not a trained-model SIL. Industries: Industrial machinery and robotics, Other safety-critical.
- [LDRA (AI and machine learning capability)](https://aiassurancedirectory.com/tools/ldra-ai-ml/): LDRA. LDRA AI/ML capability page covering test generation, change-impact analysis and AI/ML in safety-critical sectors. The aviation section names EASA guidance for Level 1 and 2 machine-learning applications. Not a neural-network verifier. Industries: Aerospace & aviation, Other safety-critical, Automotive, Medical devices, Industrial machinery and robotics.
- [Llama Guard 4](https://aiassurancedirectory.com/tools/meta-llama-guard-4/): Meta. Meta Llama Guard 4 (12B): natively multimodal safety classifier pruned from Llama 4 Scout. Classifies LLM prompts and responses against MLCommons hazard categories S1–S14. Runs on a single GPU; documented as a drop-in for Llama Guard 3 8B/11B. First output line is safe or unsafe. Industries: Cross-industry.
- [Llama Prompt Guard 2](https://aiassurancedirectory.com/tools/llama-prompt-guard-2/): Meta. Meta Llama Prompt Guard 2 BERT classifiers (86M and 22M) that label a prompt string benign or malicious for prompt injection and jailbreaks. Drop-in replacement for Prompt Guard. Designed for Llama 4 Scout/Maverick and Llama 3. Llama 4 Community License. Industries: Cross-industry.
- [LYNX MOSA.ic.AI](https://aiassurancedirectory.com/tools/lynx-mosa-ic-ai/): Lynx Software Technologies. Deterministic CPU and GPU runtime for AI at the mission-critical edge. Combines MOSA.ic with CoreSuite; not a training platform. The 8 April 2026 launch names a path to DO-178C, not a completed product certificate. Industries: Aerospace & aviation, Defense & national security.
- [Marabou](https://aiassurancedirectory.com/tools/marabou/): Neural Network Verification project (Stanford and collaborators). SMT-based neural-network verifier (Marabou 2.0). ONNX main format; also .nnet, TensorFlow and VNNLIB. pip install maraboupy (Python 3.8–3.11). Default: DeepPoly bound tightening and DeepSoI. Optional Gurobi, parallelism and Split-and-Conquer. ACAS Xu example. Research product. Industries: Aerospace & aviation.
- [MathWorks AI Verification Library for Deep Learning Toolbox](https://aiassurancedirectory.com/tools/mathworks-ai-verification/): MathWorks. Formal robustness verification, output bounds, adversarial examples and out-of-distribution detection for MATLAB, ONNX and PyTorch networks, with airborne runway-sign and ACAS Xu worked examples. Industries: Aerospace & aviation, Other safety-critical.
- [MathWorks DO Qualification Kit](https://aiassurancedirectory.com/tools/mathworks-do-qualification-kit/): MathWorks. Documentation, test cases and procedures to qualify supported Simulink and Polyspace tools for DO-178C, DO-278A, DO-254 and DO-330. The FAQ says the kit does not prequalify tools; qualification is project-specific. Industries: Aerospace & aviation.
- [MITRE ATLAS](https://aiassurancedirectory.com/tools/mitre-atlas/): MITRE. MITRE public knowledge base of adversary tactics, techniques, mitigations and case studies against AI systems. Monthly YAML from atlas-data: latest content 2026.09 (15 September 2026), format 6.0.0, plus STIX, Excel and ATT&CK Navigator layers. Industries: Cross-industry.
- [Model Card Toolkit](https://aiassurancedirectory.com/tools/tensorflow-model-card-toolkit/): TensorFlow / Google. Archived Python toolkit (pip model-card-toolkit, Python 3.7+) that generates Model Cards as HTML from proto/JSON. The TFX ModelCardGenerator moved to tfx-addons from v2.0.0. Apache-2.0. Industries: Cross-industry.
- [ModelOp](https://aiassurancedirectory.com/tools/modelop/): ModelOp. Enterprise AI Command Center (Center 3.3) that maps each use case to the EU AI Act, NIST AI RMF and ISO 42001, orchestrates reviews, generates model cards, and adds inline agent prompt-injection blocking. MADE integrates 50+ technologies. Industries: Cross-industry.
- [Monitaur](https://aiassurancedirectory.com/tools/monitaur/): Monitaur. AI governance for inventory, a 33-control library, FlightSim pre-deployment simulation (vendor: AI pen test) and Automate Record production logging mapped to NIST AI RMF, ISO 42001 and the EU AI Act. Industries: Cross-industry.
- [NASA ProgPy](https://aiassurancedirectory.com/tools/nasa-progpy/): NASA Prognostics Center of Excellence. NASA ProgPy 1.8.0 (2024 NASA Software of the Year): pip install progpy; Python ≥3.9,<3.14. PHM and remaining-useful-life research with an optional LSTM datadriven extra and a prog_server SOA. Partners named: DLR, Northrop Grumman and Vanderbilt. NASA-1.3 — no OSI badge. Industries: Aerospace & aviation, Space systems.
- [NASA SWEHB Artificial Intelligence topics (7.25 and 8.25)](https://aiassurancedirectory.com/tools/nasa-swehb-ai/): NASA. NASA SWEHB AI/ML topics under NPR 7150.2. Official titles: 7.25 - Artificial Intelligence And Software Engineering and 8.25 - Artificial Intelligence And Software Assurance. Topic 7.25 names OCE, OSMA, OCHMO and OCIO and keeps AI non-safety-critical without an approved AI safety case. Industries: Space systems.
- [Neural Network Dependability Kit (NNDK)](https://aiassurancedirectory.com/tools/nn-dependability-kit/): fortiss. Open-source fortiss toolbox for engineering neural networks in safety-critical domains: dependability metrics, test-case generation, formal verification and runtime neuron-activation-pattern monitoring. Jupyter examples on GTSRB, MNIST, KITTI. Used in driving, medical imaging and space navigation. Industries: Other safety-critical, Space systems.
- [NIST AI RMF Playbook](https://aiassurancedirectory.com/tools/nist-ai-rmf-playbook/): NIST AI Resource Center. NIST AI RMF Playbook of suggested actions aligned to Govern, Map, Measure and Manage sub-categories in AI RMF 1.0. Neither a checklist nor a set of steps. Suggestions are voluntary. Downloadable as PDF, CSV, Excel and JSON. The Playbook will be updated after AI RMF 1.0 is revised. Industries: Cross-industry.
- [NIST ARIA (Assessing Risks and Impacts of AI)](https://aiassurancedirectory.com/tools/nist-aria/): NIST Information Technology Laboratory. NIST ITL evaluation (Assessing Risks and Impacts of AI): sector- and task-agnostic model testing, red-teaming and field testing. LLM pilot. Schedule Kickoff May 2024 through Summer 2025 Pilot Summary Report Out. That report is still listed as coming soon. Industries: Cross-industry.
- [NIST Dioptra](https://aiassurancedirectory.com/tools/nist-dioptra/): NIST. NIST test platform (docs and release 1.2.1) for assessing trustworthy characteristics of AI models. The official README says it supports the Measure function of the NIST AI RMF. Docker images for nginx, MLflow, REST API and CPU workers. Public source under CC BY 4.0. Industries: Cross-industry.
- [nnenum](https://aiassurancedirectory.com/tools/nnenum/): Stanley Bak. Python 3.9+ neural-network verifier (pip install .; nnenum 1.0.1, GPL-3.0-or-later) for ReLU networks. Combines zonotopes with star sets, uses the ImageStar trick through ONNX Runtime, and ships ACAS Xu ONNX/vnnlib examples. VNN-COMP 2020: only tool to verify all ACAS-Xu benchmarks. Industries: Aerospace & aviation.
- [NNV (Neural Network Verification Toolbox)](https://aiassurancedirectory.com/tools/nnv/): VeriVITAL, Vanderbilt University. MATLAB toolbox for set-based neural-network verification using Star sets and zonotopes. 10+ architectures and 48 layer types; ONNX and VNNLIB. Official aerospace domain and all 45 ACAS Xu networks. AFOSR, DARPA and NSF. Industries: Aerospace & aviation.
- [NVIDIA NeMo Guardrails](https://aiassurancedirectory.com/tools/nvidia-nemo-guardrails/): NVIDIA. Open-source Python toolkit (pip nemoguardrails; Python 3.10–3.13) that adds programmable input, dialog, retrieval, execution and output rails to LLM applications. Library plus optional FastAPI server. Apache-2.0. Industries: Cross-industry.
- [OneTrust AI Governance](https://aiassurancedirectory.com/tools/onetrust-ai-governance/): OneTrust. AI governance that inventories systems, agents, models, datasets and vendors; applies EU AI Act, NIST AI RMF and ISO 42001 templates; and describes runtime guardrails plus a Python AI Guard SDK on Amazon Bedrock, Microsoft Foundry, Databricks and Gemini. Industries: Cross-industry.
- [Optro AI Governance](https://aiassurancedirectory.com/tools/optro-ai-governance/): Optro. Enterprise AI governance that inventories models, agents and third-party apps and automates 25+ frameworks including the EU AI Act, ISO 42001 and NIST AI RMF. Shadow AI; agents draft and recommend, the team decides. fairnow.ai currently serves this product. Industries: Cross-industry.
- [Palo Alto Prisma AIRS](https://aiassurancedirectory.com/tools/paloalto-prisma-airs/): Palo Alto Networks. Prisma AIRS AI Runtime Security: Network Intercept (inline firewall) and API Intercept (REST API/Python SDK) for prompt injection, jailbreak, memory poisoning and tool misuse. Network Intercept deploys on public cloud or on-premises microperimeter. Industries: Cross-industry.
- [Parasoft C/C++test](https://aiassurancedirectory.com/tools/parasoft-c-ctest/): Parasoft. Unified C/C++ static analysis, unit testing, MC/DC coverage and requirements traceability. TÜV SÜD–certified C/C++test names automotive (ISO 26262), medical (IEC 62304), industrial (IEC 61508) and aerospace/defense (DO-178C DAL A). Badges also list ISO/PAS 8800. Industries: Automotive, Medical devices, Industrial machinery and robotics, Aerospace & aviation, Defense & national security, Other safety-critical.
- [Perforce QAC](https://aiassurancedirectory.com/tools/perforce-qac/): Perforce. Static analyzer for C, C++ and Rust (formerly Helix QAC). TÜV SÜD certified for ISO 26262 (automotive) up to ASIL D, IEC 61508 (general industry) up to SIL 4, and IEC 62304 (medical devices) up to Software Safety Class C. Also names a DO-330 pack for DO-178C. Not a neural-network verifier. Industries: Automotive, Medical devices, Industrial machinery and robotics, Aerospace & aviation, Defense & national security, Other safety-critical.
- [Portkey Guardrails](https://aiassurancedirectory.com/tools/portkey-guardrails/): Portkey. Guardrails on the Portkey AI Gateway: input and output checks with deny, log, fallback and retry. Failed checks can pass with HTTP 246 or kill the request with 446. Feature comparison names Portkey-Managed SaaS; new fully air-gapped deployments are no longer offered. Industries: Cross-industry.
- [PREMIS](https://aiassurancedirectory.com/tools/argevide-premis/): Argevide. Web assurance-case tool for modular GSN arguments, including Eliminative Argumentation defeaters, an AI Assistant, Safety Performance Indicators, and CI/CD or API integration. Supports Core GSN and partially Modular and Argument Pattern Extensions. Metamodel named OMG SACM and ISO/IEC 15026. Industries: Other safety-critical.
- [Promptfoo](https://aiassurancedirectory.com/tools/promptfoo/): Promptfoo. Open-source gen-AI red-teaming tool that scans 50+ vulnerability types and maps plugins to the NIST AI RMF, ISO/IEC 42001 and EU AI Act. Runs locally against HTTP APIs, browsers or models. MIT-licensed. Industries: Cross-industry.
- [PyRAT](https://aiassurancedirectory.com/tools/pyrat/): CEA List (AISER team). CEA List neural-network verifier (Python Reachability Assessment Tool) using abstract interpretation. Site: VNN-COMP 2024 second place, all 12 regular-track benchmarks, more than 1700 properties, ACAS-XU collision-avoidance example. CAISAR news ranks PyRAT third at VNN-Comp 2026. Industries: Aerospace & aviation, Other safety-critical.
- [PyRIT](https://aiassurancedirectory.com/tools/microsoft-pyrit/): Microsoft AI Red Team. Microsoft AI Red Team framework for automated and human-led generative-AI red teaming. Python 3.13 recommended; pip install pyrit. Ships Crescendo, TAP and Skeleton Key, CoPyRIT GUI, pyrit_scan/pyrit_shell, and SQLite or Azure SQL memory. MIT-licensed. Industries: Cross-industry.
- [QNX OS for Safety](https://aiassurancedirectory.com/tools/qnx-os-for-safety/): QNX (BlackBerry). Safety-certified microkernel RTOS (QOS 8.0) certified by TÜV Rheinland to ISO 26262 ASIL D, IEC 61508 SIL 3, IEC 62304 Class C and ISO/SAE 21434. C/C++ toolchains classified TCL3/T3. FAQ names car, surgical robot, drone, power plant, machinery and control systems. Not an airborne runtime. Industries: Automotive, Medical devices, Industrial machinery and robotics, Other safety-critical.
- [QuantPi](https://aiassurancedirectory.com/tools/quantpi/): QuantPi. Enterprise AI validation layer that tests models, agents and physical AI before and after deployment. Public cloud, on-premises via HPE Private Cloud AI, and air-gapped. MCP integration; SSO/RBAC and zero data retention. TÜV Süd’s first CARAT partner laboratory worldwide. Industries: Other safety-critical, Cross-industry.
- [Rapita Verification Suite (RVS)](https://aiassurancedirectory.com/tools/rapita-rvs/): Rapita Systems. Rapita Verification Suite for requirements-based testing, MC/DC coverage, WCET timing and scheduling visualization. Qualification kits for DO-178C; kits have supported more than 20 DO-178B and C projects up to DAL A. Rapi Coupling is in development (expected H1 2027). Industries: Aerospace & aviation, Other safety-critical, Automotive.
- [Re:In (Moasoftware)](https://aiassurancedirectory.com/tools/moasoftware-rein/): Moasoftware. Data-quality platform the vendor maps to ARP6983/ED-324 §§6.2–6.5 (bias, diversity, sufficiency, balance, augmentation, reliability reports). W-Shape four stages. Dated 25 August 2026; updated 6 October 2026. Industries: Aerospace & aviation.
- [Resaro Approved Intelligence Platform](https://aiassurancedirectory.com/tools/resaro-aip/): Resaro. On-premise, air-gapped TEVV platform that produces ASQI-structured deployment evidence for civil and defence AI. CI/CD-native workflows over text and image; used in the IMDA/AI Verify Global AI Assurance Pilot. Industries: Defense & national security, Other safety-critical.
- [Saidot](https://aiassurancedirectory.com/tools/saidot/): Saidot Ltd.. Graph-based AI governance platform: 260+ risks, 620+ controls, 110+ policies and 170+ third-party models. Product page: meet 110+ policies including ISO/IEC 42001 and NIST AI RMF, plus the EU AI Act workflow. Homepage names Azure Marketplace; ISO 27001 is the vendor ISMS. Industries: Cross-industry.
- [Saimple](https://aiassurancedirectory.com/tools/numalis-saimple/): Numalis. Static analyzer that uses abstract interpretation to assess neural-network robustness, citing ISO/IEC 24029. Sold as SaaS and on-premises. Numalis names Article 15 explainability reports and EASA MLEAP work. Industries: Aerospace & aviation, Defense & national security, Other safety-critical.
- [Scytale (ISO 42001)](https://aiassurancedirectory.com/tools/scytale-iso-42001/): Scytale. Compliance hub for an ISO 42001 AIMS: automated evidence collection, 24/7 continuous control monitoring, auditor-approved policy templates, vendor risk management and an audit dashboard. Cross-maps common controls with ISO 27001. Industries: Cross-industry.
- [Secureframe (defense contractor offering)](https://aiassurancedirectory.com/tools/secureframe-defense/): Secureframe. CMMC and CUI platform for the Defense Industrial Base. Secureframe Defense automates enclave, documentation and monitoring; the CMMC page names GCC High, Defense Navigator, FedRAMP Moderate MDM and a CyberAB RPO listing. Not an AI-model assurance tool. Industries: Defense & national security.
- [ServiceNow AI Control Tower](https://aiassurancedirectory.com/tools/servicenow-ai-control-tower/): ServiceNow. ServiceNow AI Control Tower inventories agents, models, copilots, MCP servers and datasets against the CMDB. Out-of-the-box content packs named for the EU AI Act and NIST AI RMF. Built on the ServiceNow AI Platform. Not an airborne runtime. Industries: Cross-industry.
- [Sigstore model-transparency](https://aiassurancedirectory.com/tools/sigstore-model-transparency/): Sigstore / OpenSSF. Python CLI and API (model_signing) that signs ML models with Sigstore, keys or certificates so users can verify integrity and provenance. DSSE in-toto bundle; optional PKCS #11. Apache-2.0. Industries: Cross-industry.
- [SILability](https://aiassurancedirectory.com/tools/xsericon-silability/): xSeriCon. SIL verification software for SIFs. Page title: SIL Verification Software for IEC 61508/61511. Supports architectural constraint models for IEC 61508 (Route 1H and 2H) and IEC 61511 (2003 and 2016 editions), low, high and continuous demand. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [SILcet](https://aiassurancedirectory.com/tools/safetyandsis-silcet/): Enertria. SIL verification tool for safety instrumented functions, offered as SILcet Cloud and SILcet Pro Plus. Official page says it complies with IEC 61508, IEC 61511 and ISA TR84.00.02. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [SIMATIC PCS 7 Safety](https://aiassurancedirectory.com/tools/siemens-pcs7-safety/): Siemens. Process-industry safety integrated with SIMATIC PCS 7. SIMATIC S7 Safety Matrix (Engineering Tool and Viewer) is described as a holistic approach to functional safety in accordance with IEC 61511 across the safety lifecycle. Architectures certified up to SIL 3. Not an AI-management platform. Industries: Process industries, Other safety-critical.
- [SPDX AI Profile](https://aiassurancedirectory.com/tools/spdx-ai-profile/): Linux Foundation / SPDX. SPDX 3.0.1 AI Profile for documenting AI packages, models and datasets. Conformant AIPackage elements must carry hasConcludedLicense and hasDeclaredLicense. Records training, limitations, safety-risk level (serious/high/medium/low) and energy use by stage. Industries: Cross-industry.
- [Sprinto (ISO 42001)](https://aiassurancedirectory.com/tools/sprinto-iso-42001/): Sprinto. Autonomous trust platform for an audit-ready ISO/IEC 42001 AIMS. Heading: Get ISO 42001 ready, minus the grunt work. 4,000+ customers; AI discovery across extensions, devices, integrations and SSO; real-time policy-drift reviews; one-click Trust Centre. Industries: Cross-industry.
- [Stages Process Management Software](https://aiassurancedirectory.com/tools/ul-stages/): UL Solutions. Process-management software with bidirectional traceability between process models and standard objectives. Official table names ISO 26262, ISO/PAS 8800 and UL 4600 under Automotive; IEC 62304 under Medical devices; IEC 61508 and IEC 61511-1 under Industrial. Industries: Automotive, Medical devices, Industrial machinery and robotics, Process industries, Aerospace & aviation, Defense & national security, Other safety-critical.
- [Strike Graph (ISO 42001)](https://aiassurancedirectory.com/tools/strikegraph-iso-42001/): Strike Graph. Compliance platform for ISO 42001 AIMS: pre-loaded mapped controls, 100% pre-built AIMS policy and procedure templates, Verify AI documentation checks, gap analysis, evidence dashboards and export to an external assessor. Industries: Cross-industry.
- [TESSY](https://aiassurancedirectory.com/tools/razorcat-tessy/): Razorcat Development GmbH. Automated unit, module and integration testing of embedded C/C++. Official page: qualified for IEC 61508, IEC 62304, ISO 26262 and EN 50128. Call Pair Coverage is named as an ISO 26262 alternative for integration tests. TÜV SÜD certificate names ISO 26262-8:2018. Industries: Automotive, Medical devices, Industrial machinery and robotics, Other safety-critical.
- [Thoropass (ISO 42001)](https://aiassurancedirectory.com/tools/thoropass-iso-42001/): Thoropass. ISO 42001 compliance and audit platform with pre-built policy templates, an AI System Impact Assessment, automated evidence collection, a Risk Register, continuous monitoring, and one-audit-multiple-frameworks evidence reuse from a single platform. Industries: Cross-industry.
- [Trustible](https://aiassurancedirectory.com/tools/trustible/): Trustible. AI governance platform for regulated enterprises: intake, inventory, risk triaging and continuous monitoring. Maps controls to the EU AI Act, NIST AI RMF and ISO 42001. Official 10 April 2026 Leidos story covers defense, intelligence, civil and health programs. Industries: Defense & national security, Cross-industry.
- [Universal Robots PolyScope](https://aiassurancedirectory.com/tools/universal-robots-polyscope/): Universal Robots. Software platform for Universal Robots cobots, from simple cells to AI-ready systems. Safety FAQ: PolyScope 5 and PolyScope X certified to EN ISO 10218-1:2011; targeting ISO 10218-1:2025 by January 2027 aligned with EU Machinery Regulation 2023/1230. Industries: Industrial machinery and robotics, Other safety-critical.
- [Vanta](https://aiassurancedirectory.com/tools/vanta/): Vanta. Compliance automation covering ISO 42001, NIST AI RMF and CMMC (mapped to NIST SP 800-171/172). The ISO 42001 product page also maps evidence to the EU AI Act. Not an AI-model assurance tool. Industries: Cross-industry, Defense & national security.
- [VectorCAST](https://aiassurancedirectory.com/tools/vectorcast/): Vector. Embedded unit, integration and coverage test automation for C, C++ and Ada. Used in aerospace, automotive, medical device, industrial and railway programs. Tool validation packages for IEC 61508, ISO 26262 and IEC 62304 include TÜV SÜD certificates. Reqs2x AI tests require engineer review. Industries: Automotive, Medical devices, Industrial machinery and robotics, Aerospace & aviation, Other safety-critical.
- [Yokogawa ProSafe-RS](https://aiassurancedirectory.com/tools/yokogawa-prosafe-rs/): Yokogawa. TÜV SIL3 safety instrumented system described as a safety PLC for the process industries. Complied functional-safety standards listed: IEC 61508, IEC 61511-1 and IEC 62061. Used in over 3,500 projects. Not an AI-management platform. Industries: Process industries, Other safety-critical.

## Policies
- [Methodology](https://aiassurancedirectory.com/methodology/): Inclusion criteria, tagging rules and what was left out.
- [Coverage matrix](https://aiassurancedirectory.com/coverage/): Cited mapping and analyst-assessment counts by listing and framework. Cell detail is Pro.
- [Coverage methodology](https://aiassurancedirectory.com/coverage/methodology/): How cited mappings, cited-literature papers and analyst assessments differ, including the Evidence strength badge and Pro gating.
- [Listing policy](https://aiassurancedirectory.com/listing-policy/): Sponsors do not affect listings. Editorial verification rules.
- [Sponsor media kit](https://aiassurancedirectory.com/sponsor/): Who the audience is, what a labeled sponsor slot is, and the listing-policy rules. No traffic or prices.
- [Suggest a tool](https://aiassurancedirectory.com/suggest/): Placeholder form and mailto; nothing is sent yet.
- [Compare tools](https://aiassurancedirectory.com/compare/): Side-by-side table from cited listing data. Parameterized views are noindex. 17 indexable pair landings. Quoted evidence is Pro.
- [NIST Dioptra vs Microsoft PyRIT](https://aiassurancedirectory.com/compare/nist-dioptra-vs-microsoft-pyrit/): Cited public fields only. Dioptra names the AI RMF Measure function; PyRIT is Microsoft AI Red Team gen-AI red teaming.
- [Credo AI vs Holistic AI](https://aiassurancedirectory.com/compare/credo-ai-vs-holistic-ai/): Both cited pages name EU AI Act, NIST AI RMF and ISO 42001. Not a recommendation.
- [Vanta vs Drata ISO 42001](https://aiassurancedirectory.com/compare/vanta-vs-drata-iso-42001/): Compliance-automation listings that name ISO 42001. Vanta also names NIST AI RMF and CMMC.
- [HiddenLayer vs Cisco AI Defense](https://aiassurancedirectory.com/compare/hiddenlayer-vs-cisco-ai-defense/): Both cited pages name NIST AI RMF. HiddenLayer names air-gapped government options.
- [Marabou vs NNV](https://aiassurancedirectory.com/compare/marabou-vs-nnv/): Open-source neural-network verifiers that name ACAS Xu. Not a ranking.
- [Promptfoo vs NVIDIA garak](https://aiassurancedirectory.com/compare/promptfoo-vs-nvidia-garak/): Open-source gen-AI scanners. Promptfoo names NIST AI RMF, ISO 42001 and the EU AI Act.
- [Ansys SCADE Suite vs Rapita RVS](https://aiassurancedirectory.com/compare/ansys-scade-suite-vs-rapita-rvs/): Airborne-software tools that name DO-178C qualification paths. Not neural-network verifiers.
- [MathWorks DO Qualification Kit vs LDRA AI/ML](https://aiassurancedirectory.com/compare/mathworks-do-qualification-kit-vs-ldra-ai-ml/): Kit names DO-178C/DO-330 artifacts; LDRA names EASA Level 1 and 2 ML applications.
- [Azure AI Content Safety vs Google Model Armor](https://aiassurancedirectory.com/compare/azure-ai-content-safety-vs-google-model-armor/): Commercial prompt/response safety screens from cited cloud docs.
- [CDAO JATIC vs NIST ARIA](https://aiassurancedirectory.com/compare/cdao-jatic-vs-nist-aria/): Government T&E and evaluation programs. Not a certification.
- [Arthur vs Credo AI](https://aiassurancedirectory.com/compare/arthur-ai-vs-credo-ai/): Both cited pages name EU AI Act, NIST AI RMF and ISO 42001. Arthur names SaaS/on-prem; Credo names GAIA.
- [Promptfoo vs Microsoft PyRIT](https://aiassurancedirectory.com/compare/promptfoo-vs-microsoft-pyrit/): Open-source gen-AI red-team tools. Promptfoo names NIST AI RMF, ISO 42001 and the EU AI Act.
- [Vanta vs Secureframe Defense](https://aiassurancedirectory.com/compare/vanta-vs-secureframe-defense/): Compliance-automation listings that name CMMC. Vanta also names ISO 42001, NIST AI RMF and the EU AI Act.
- [HiddenLayer vs Palo Alto Prisma AIRS](https://aiassurancedirectory.com/compare/hiddenlayer-vs-paloalto-prisma-airs/): HiddenLayer names NIST AI RMF and air-gapped options; Prisma AIRS names Network and API Intercept.
- [Trustible vs IBM watsonx.governance](https://aiassurancedirectory.com/compare/trustible-vs-ibm-watsonx-governance/): Both cited pages name EU AI Act, NIST AI RMF and ISO 42001. Not a recommendation.
- [NVIDIA NeMo Guardrails vs Amazon Bedrock Guardrails](https://aiassurancedirectory.com/compare/nvidia-nemo-guardrails-vs-amazon-bedrock-guardrails/): Runtime prompt/response screens. Neither cited page tags a directory framework.
- [Ansys medini analyze vs Astah GSN](https://aiassurancedirectory.com/compare/ansys-medini-analyze-vs-astah-gsn/): Both cited pages name ISO 26262. Medini is safety analysis; Astah is GSN modeling.
- [Monthly briefing](https://aiassurancedirectory.com/briefing/): Public teaser of cited source-change topics for the current issue. Dated sentences are Pro. Not a regulator news feed.
- [Pricing](https://aiassurancedirectory.com/pricing/): Which tools help you certify: evidence packs, RFP bank, readiness self-check and monthly briefing. Free public summaries. Pro $49/month or $490/year. Team (5 users) $149/month or $1,490/year. Enterprise contact. Secure checkout by Stripe.
- [Team and Enterprise](https://aiassurancedirectory.com/teams/): Five Team seats on one Stripe subscription. Enterprise invoicing and security questionnaires: contact@sparkygroup.net.
- [RFP question bank](https://aiassurancedirectory.com/rfp/): Public teasers for a vendor-neutral aerospace/defense AI-assurance RFP bank. Full questions and citations are Pro.
- [AI assurance readiness self-check](https://aiassurancedirectory.com/readiness/): Free 18-question self-check. Each item cites an official page already used on this directory. Optional email saves the result to a free account. Not a certification.
- [Updates](https://aiassurancedirectory.com/updates/): Dated changelog of directory changes, also as RSS at /updates/rss.xml.
- [Content changelog](https://aiassurancedirectory.com/changelog/): Auto-built from git history of articles, framework explainers and tool listings.
- [What changed this month](https://aiassurancedirectory.com/updates/this-month/): Monthly digest generated from the updates log. Not a regulator news feed.
- [Articles RSS](https://aiassurancedirectory.com/articles/rss.xml): RSS 2.0 feed of source-cited articles.
- [Articles Atom](https://aiassurancedirectory.com/articles/atom.xml): Atom 1.0 feed of source-cited articles.
- [Articles JSON Feed](https://aiassurancedirectory.com/articles/feed.json): JSON Feed 1.1 of source-cited articles.
- [About](https://aiassurancedirectory.com/about/): Practitioner-built directory: which AI assurance tools actually help you certify, with cited evidence. The founder has 25+ years in aerospace and defense engineering and program leadership, aerospace engineering degrees, and AI governance experience. Employers are not named.
- [Industries](https://aiassurancedirectory.com/industries/): Cited overviews for safety-critical and regulated manufacturing, with aerospace and defense as the flagship.
- [Industry: Aerospace and aviation](https://aiassurancedirectory.com/industries/aerospace/): Airborne, air-traffic and aviation-certification contexts for AI.
- [Industry: Defense and national security](https://aiassurancedirectory.com/industries/defense/): Defense programs and defense-industrial-base contractors using AI.
- [Industry: Safety-critical systems](https://aiassurancedirectory.com/industries/safety-critical/): Functional safety and autonomous-product arguments. Dedicated automotive, medical, machinery and process landings sit beside this page.
- [Industry: Space systems](https://aiassurancedirectory.com/industries/space/): Spacecraft software and space-system AI pages from NASA, ESA and the U.S. Space Force.
- [Industry: Automotive](https://aiassurancedirectory.com/industries/automotive/): Series-production road vehicles and autonomous-product safety arguments.
- [Industry: Medical devices](https://aiassurancedirectory.com/industries/medical-devices/): AI-enabled device software, IEC 62304 software lifecycle, and EU MDR listed in AI Act Annex I.
- [Industry: Industrial machinery and robotics](https://aiassurancedirectory.com/industries/industrial-machinery/): IEC 61508, EU Machinery Regulation 2023/1230 AI provisions, and ISO 10218 industrial robots.
- [Industry: Process industries](https://aiassurancedirectory.com/industries/process-industries/): Safety instrumented systems under IEC 61511, the process-sector implementation of IEC 61508:2010.

## Buyer kits (public teasers only)
- [Buyer kits](https://aiassurancedirectory.com/kits/): Titles and one-line teasers. Vendor questions and CSV downloads are Pro except the NIST AI RMF sample kit.
- [NIST AI RMF vendor-question checklist](https://aiassurancedirectory.com/kits/nist-ai-rmf/): Vendor questions from the NIST AI RMF to ISO/IEC 42001 crosswalk.
- [ISO/IEC 42001 vendor-question checklist](https://aiassurancedirectory.com/kits/iso-42001/): Vendor questions from the NIST–ISO crosswalk and the ISO explainer.
- [EU AI Act vendor-question checklist](https://aiassurancedirectory.com/kits/eu-ai-act/): Vendor questions from Regulation (EU) 2024/1689.
- [Aerospace / DO-178C vendor-question checklist](https://aiassurancedirectory.com/kits/do-178c-do-330/): Vendor questions from FAA and EASA pages already cited on the public checklists.
- [DoD AI guidance vendor-question checklist](https://aiassurancedirectory.com/kits/dod-responsible-ai/): Vendor questions from the DoD AI ethical principles page.
- [AI in airborne software certification: vendor questions](https://aiassurancedirectory.com/kits/airborne-ai-cert/): Vendor questions from EASA Issue 2, FAA AC 20-115D / AC 20-174, RTCA FTP1055 and the FAA AI roadmap.
- [DoD RAI procurement checklist](https://aiassurancedirectory.com/kits/dod-rai-procurement/): Vendor questions from the RAI pathway, Directive 3000.09 and CMMC/DFARS pages.
- [DoD Responsible AI Toolkit alignment](https://aiassurancedirectory.com/kits/dod-rai-toolkit-alignment/): Vendor questions from the CDAO RAI Toolkit, Tradewinds AIA Toolkit and the DoD AI Ethical Principles.
- [EASA AI Concept Paper Level 1 and Level 2](https://aiassurancedirectory.com/kits/easa-ai-l1-l2/): Vendor questions from EASA Concept Paper Issue 2 guidance for Level 1 and Level 2 machine-learning applications.
- [CMMC-adjacent AI data handling](https://aiassurancedirectory.com/kits/cmmc-ai-data-handling/): Vendor questions from 32 CFR Part 170, DFARS 252.204-7021 and NIST SP 800-171 for AI systems that process CUI.
- [Automotive AI safety: vendor questions](https://aiassurancedirectory.com/kits/automotive-ai-safety/): Vendor questions from ISO 26262-1:2018, ISO/PAS 8800:2024 and UL 4600 catalog pages.
- [Medical-device AI: vendor questions](https://aiassurancedirectory.com/kits/medical-ai-devices/): Vendor questions from FDA PCCP guidance, IEC 62304:2006 and AI Act Annex I item 11 (MDR).
- [Industrial machinery and robotics AI: vendor questions](https://aiassurancedirectory.com/kits/industrial-machinery-ai/): Vendor questions from Regulation 2023/1230, ISO 10218-1:2025 and IEC 61508-1:2010.
- [Process-industry SIS and AI: vendor questions](https://aiassurancedirectory.com/kits/process-sis-ai/): Vendor questions from IEC 61511-1:2016 and the parent IEC 61508:2010 publication.
- [Automotive AI and the AI Act: vendor questions](https://aiassurancedirectory.com/kits/automotive-ai-act-interplay/): Vendor questions from the AI Act Service Desk Annex I, Article 2 and Article 6 pages and the ISO/PAS 8800:2024 catalog page.
- [Medical-device AI: GMLP, FDA list and IEC 62304 amendment](https://aiassurancedirectory.com/kits/medical-ai-gmlp-and-list/): Vendor questions from FDA’s GMLP page, FDA’s AI-enabled device list and the IEC 62304 consolidated catalog page.
- [Machinery and robotics: AI Act boundary and software evidence](https://aiassurancedirectory.com/kits/machinery-ai-act-boundary/): Vendor questions from the AI Act Service Desk Annex I and Article 2, IEC 61508-3, ISO/IEC TR 5469 and ISO 10218-1:2025 pages.
- [Process-industry SIS life cycle and AI: vendor questions](https://aiassurancedirectory.com/kits/process-sis-lifecycle-ai/): Vendor questions from the IEC 61511-1:2016 catalog pages, IEC 61508-3:2010 and ISO/IEC TR 5469:2024.
- [ISO/IEC 42001 ↔ NIST AI RMF crosswalk](https://aiassurancedirectory.com/kits/iso-42001-nist-ai-rmf-crosswalk/): Cross-industry evidence requests from rows in NIST’s published AI RMF to ISO/IEC 42001 crosswalk.
- [EU AI Act high-risk obligations by manufacturing industry](https://aiassurancedirectory.com/kits/eu-ai-act-high-risk-manufacturing/): Automotive, medical devices, machinery and robotics, and process industries mapped to AI Act high-risk articles and Annex I.

## Glossary terms
- [Glossary](https://aiassurancedirectory.com/glossary/): 40 official terms with DefinedTerm markup. Each definition cites the official page used in the glossary article.
- AI safety assurance: The FAA roadmap's primary purpose is a path to assuring the safety of AI in aircraft and related systems for inflight operations. The same document says AI must demonstrate its safety before use in aviation.
- Learned versus learning AI: The FAA distinguishes static (learned) from dynamic (learning) implementations. Learned AI is frozen after training; learning AI continues to change in operation and is treated as an ongoing research topic.
- Learning assurance: EASA proposes a new concept of learning assurance to extend the traditional development assurance, aimed at confidence that trained models generalize on unseen operational data and are robust in foreseeable conditions.
- W-shaped process: EASA illustrates learning assurance as a W-shaped cycle that adapts the typical development assurance V-cycle to ML concepts, running with the traditional V-cycle for non-ML constituents.
- Operational design domain (ODD): EASA ties data quality to the ODD: a correct and complete definition of the ODD is a prerequisite to an adequate level of quality of the data sets.
- Human-AI teaming (HAT): EASA's Issue 2 introduces the concept of human-AI teaming (HAT) for Level 2 systems that automatically take decisions under human oversight.
- DO-178C: RTCA describes DO-178() as the software standards documents used with EUROCAE ED-12 for airborne software development assurance.
- Development assurance: EASA treats learning assurance as an extension of traditional development assurance, not a replacement of it.
- NIST AI RMF functions: The Core is composed of four functions: Govern, Map, Measure and Manage. NIST says the actions do not constitute a checklist.
- TEVV: NIST AI RMF 1.0 discusses test, evaluation, verification, and validation (TEVV) as part of measuring AI risk. The framework does not turn those words into an aviation qualification method.
- AI management system: ISO/IEC 42001 specifies requirements for an Artificial Intelligence Management System. ISO describes it as managing AI-related risks across an organization rather than looking at details of specific AI applications.
- DoD AI ethical principles: The Department adopted five ethical principles for the use of AI in February 2020: Responsible, Equitable, Traceable, Reliable and Governable.
- High-risk AI system: In the EU AI Act, high-risk systems are those that meet the conditions in Article 6 and the Annex III use-case list, subject to the military, national-security and other scope rules in Article 2.
- Controlled Unclassified Information (CUI): NIST SP 800-171 Rev. 3 is the set of security requirements for protecting the confidentiality of CUI when that information is processed, stored or transmitted by nonfederal organizations.
- CMMC: The CMMC Program in 32 CFR Part 170 is the Department of Defense assessment mechanism for contractor implementation of those CUI protections. It is not an AI product-assurance standard.
- Super Intelligence (SI): Executive Order 14434 (signed 29 September 2026; Federal Register 2 October 2026, document 2026-20321) is the policy that, to the maximum extent permitted by law, the executive branch shall use Super Intelligence and SI — formerly called Artificial Intelligence and AI in those settings — in official correspondence, public communications, websites, reports, policy documents, and other non-statutory documents. The official published title is Inaugurating the Era of Super Intelligence. For purposes of the order, SI means the technologies and systems encompassed by artificial intelligence as defined in 15 U.S.C. 9401(3). The Order does not require alteration of previously issued regulations, Presidential actions, contracts, grants, or other historical documents.
- Responsible (DoD AI principle): Department personnel will exercise appropriate levels of judgment and care while remaining responsible for the development, deployment, and use of AI capabilities.
- Equitable (DoD AI principle): The Department will take deliberate steps to minimize unintended bias.
- Traceable (DoD AI principle): Capabilities are developed and deployed so that personnel understand the technology, including transparent and auditable methodologies, data sources, and design procedures and documentation.
- Reliable (DoD AI principle): Capabilities have explicit, well-defined uses, with safety, security and effectiveness subject to testing and assurance within those uses across their entire life-cycles.
- Governable (DoD AI principle): Capabilities have the ability to detect and avoid unintended consequences, and to disengage or deactivate deployed systems that demonstrate unintended behavior.
- RAI Strategy and Implementation Pathway: CDAO’s toolkit release says the June 2022 pathway spells out 64 lines of effort for operationalizing the Department of Defense’s AI Ethical Principles, including developing technical tools and guidance.
- AIA Toolkit: The live Tradewinds page titles the public CDAO self-evaluation resource the AI Assurance (AIA) Toolkit. It is a self-evaluation resource that helps teams assess their AI projects at any stage of development.
- Model card: The December 2024 CDAO Generative AI Responsible AI Toolkit lists a Hugging Face model-card template as a documentation tool for traceability (transparent and auditable documentation).
- Govern (NIST AI RMF): One of the four AI RMF Core functions: Govern, Map, Measure and Manage. NIST says the actions do not constitute a checklist.
- Map (NIST AI RMF): One of the four AI RMF Core functions: Govern, Map, Measure and Manage. NIST says the actions do not constitute a checklist.
- Measure (NIST AI RMF): One of the four AI RMF Core functions: Govern, Map, Measure and Manage. NIST says the actions do not constitute a checklist.
- Manage (NIST AI RMF): One of the four AI RMF Core functions: Govern, Map, Measure and Manage. NIST says the actions do not constitute a checklist.
- SSDF Community Profile (SP 800-218A): NIST augments the secure software development practices and tasks defined in SSDF version 1.1 with practices specific to AI model development. The additions are documented in the form of an SSDF Community Profile.
- Dual-use foundation model: SP 800-218A is a companion resource to the SSDF to incorporate secure development practices for generative AI and for dual-use foundation models.
- Adversarial machine learning (AML): NIST AI 100-2e2025 provides a taxonomy of concepts and defines terminology in the field of adversarial machine learning (AML).
- FDAL and IDAL: FAA AC 20-174 says applicants should propose and document in the certification plan the functional development assurance level (FDAL), item development assurance level (IDAL) and justification for the levels.
- IDAL A/B ML ceiling (EASA Issue 2): EASA will initially accept only applications where AI/ML constituents do not include IDAL A or B items for supervised learning.
- Level 1 and Level 2 (EASA): Issue 2 is guidance for Level 1 and Level 2 machine-learning applications. Level 2 is the human-AI teaming case on the EASA news item.
- Aeronautical data: AC 20-153B defines aeronautical data as data used for aeronautical applications such as navigation, flight planning, flight simulators, terrain awareness, and other purposes.
- Letter of Acceptance (LOA): An LOA confirms compliance with RTCA/DO-200B.
- Runtime assurance (RTA): NASA/TM–20220015734 defines RTA as the combination of RTM and one or more functions triggered by RTM, such as recovery, failover, warning alarm, or shutdown.
- Annex III (EU AI Act): In the EU AI Act, high-risk systems include those that meet Article 6 and the Annex III use-case list, subject to the military, national-security and other scope rules in Article 2.
- DO-330: The FAA AI roadmap says the FAA is supporting application and possible extension of existing standards including DO-178C, DO-330 and related documents. DO-330 is the tool-qualification consideration document used with airborne software.
- Article 2 scope (EU AI Act): High-risk classification under Article 6 and Annex III is subject to the military, national-security and other scope rules in Article 2 of Regulation (EU) 2024/1689.

## More public pages
- [Checklists](https://aiassurancedirectory.com/checklists/): Printable cited AI audit evidence, CMMC + AI, and one-page Path checkbox lists.
- [Checklist: DoD contractor AI + CUI](https://aiassurancedirectory.com/checklists/dod-contractor-ai-cui/): One-page CMMC Program scoping checklist for the DoD contractor CUI path.
- [Checklist: Certifying ML in an aircraft system](https://aiassurancedirectory.com/checklists/certifying-ml-aircraft/): One-page FAA, EASA, DO-178C and SAE G-34 checklist.
- [Checklist: ISO/IEC 42001 certification](https://aiassurancedirectory.com/checklists/iso-42001-certification/): One-page organizational AIMS certification checklist.
- [Checklist: Selling AI into EU aerospace](https://aiassurancedirectory.com/checklists/selling-ai-eu-aerospace/): One-page EU AI Act extra-territorial and aviation checklist.
- [Search](https://aiassurancedirectory.com/search/): Client-side search of tools, frameworks, articles and the glossary. Static Pagefind index; no external service.
- [Paths](https://aiassurancedirectory.com/paths/): Intent-driven starting points that link existing cited content.
- [Path: DoD contractor using AI with CUI](https://aiassurancedirectory.com/paths/dod-contractor-ai-cui/): Cited starting points for CMMC, NIST SP 800-171 and DoD Responsible AI.
- [Path: Certifying ML in an aircraft system](https://aiassurancedirectory.com/paths/certifying-ml-aircraft/): Cited starting points for FAA, EASA, DO-178C/DO-330 and SAE G-34.
- [Path: ISO/IEC 42001 certification](https://aiassurancedirectory.com/paths/iso-42001-certification/): Cited starting points for an organizational AIMS certificate.
- [Path: Selling AI into EU aerospace](https://aiassurancedirectory.com/paths/selling-ai-eu-aerospace/): Cited starting points for the EU AI Act, Annex I aviation law and EASA.
- [Disclaimer](https://aiassurancedirectory.com/disclaimer/): Informational only; not professional or legal advice.
- [Terms of Service](https://aiassurancedirectory.com/terms/): Operator Sparky Group LLC. Accounts, acceptable use and limitation of liability.
- [Privacy Policy](https://aiassurancedirectory.com/privacy/): Account email, Stripe identifiers, Resend transactional mail. No sale of personal information.
- [Refund and cancellation](https://aiassurancedirectory.com/refunds/): Cancel anytime in the Stripe Customer Portal. Refund requests to contact@sparkygroup.net.
- [Support](https://aiassurancedirectory.com/support/): Contact contact@sparkygroup.net, billing via the Stripe Customer Portal, refund policy link. We aim to reply within 2 business days.
- [Subscription terms](https://aiassurancedirectory.com/subscription-terms/): Pro $49/$490, Team $149/$1,490. Renewal, seats and past-due rules.

## Optional
- [Full text of explainers, articles and listings](https://aiassurancedirectory.com/llms-full.txt): Public-only full text. Gated quotes and kit questions are omitted.