Application
MandatoryFrequency
Every 3 monthsCapabilities
Universal
Should include?
Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence.
Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter.
Maintaining documentation. Including testing scope and results.
E018.1 Evals: Third-party evaluation report assessing accountability risk
Third-party evaluation report showing testing for agent accountability risk - including risks tested (e.g., bypassing AI disclosure), testing methodology and findings
Organizations can submit alternative evidence demonstrating how they meet the requirement.