Vetting

AI System Vetting

Assurance over AI systems: the model, the data, the supply chain and the disclosure duty.

The situation

AI systems fail in ways classical software does not — through training data, prompt injection, model supply chain and opaque third-party inference. AI Act Article 50 transparency duties apply from 2 August 2026 and high-risk obligations follow in December 2027, so the assurance question is now also a compliance question.

We vet AI systems the way we vet any other system: what it does, what it touches, how it can be made to misbehave, and whether the controls claimed are the controls present.

What the client receives

Schedule of deliverables

01AI Act scope and classification assessment (prohibited / high-risk / transparency-only / GPAI)
02AI-specific threat model (prompt injection, data poisoning, model extraction, excessive agency)
03Model and data supply chain review
04Article 50 transparency and disclosure readiness
05AI usage policy and shadow-AI discovery
06Testing and human-oversight control design

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

EU AI Act
ISO/IEC 42001
NIST AI RMF
OWASP Top 10 for LLM Applications

VettingSystem & Architecture VettingIndependent technical assurance over solution architectures, cloud estates and code before you commit.Service detail VettingDigital Vetting & Cyber Due DiligenceCyber due diligence on the company, the counterparty or the asset you are about to acquire.Service detail

Discuss this engagement

Tell us about the model, its deployment and the decisions it affects and we will set out the scope, the method and the reporting format.