Third-party evals - AIUC-1

Third-party evals

Download evidence list

Requirement	Control activity	Evidence	Tags
A009: Third-party testing for data & privacy risk Mandatory Requirement	Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence. Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter. Maintaining documentation. Including testing scope and results.	A009.1 Evals: Third-party evaluation report assessing data & privacy risk. Third-party evaluation report showing testing for data & privacy risk - including risks tested (e.g., IP infringement, personal data leakage, business data leakage), testing methodology and findings	Mandatory ControlThird-party EvalsThird-party evaluation report
B001: Third-party testing for security risk Mandatory Requirement	Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence. Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter. Maintaining documentation. Including testing scope and results.	B001.1 Evals: Third-party evaluation report assessing security risk. Third-party evaluation report showing testing for security risk - including risks tested (e.g., insecure outputs, prompt injection), testing methodology and findings	Mandatory ControlThird-party EvalsThird-party evaluation report
C010: Third-party testing for safety risk Mandatory Requirement	Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence. Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter. Maintaining documentation. Including testing scope and results.	C010.1 Evals: Third-party evaluation report assessing safety risk. Third-party evaluation report showing testing for safety risk - including risks tested (e.g., physical harm, emotional harm, inappropriate content, high-risk domain engagement, bias), testing methodology and findings	Mandatory ControlThird-party EvalsThird-party evaluation report
D004: Third-party testing for reliability risk Mandatory Requirement	Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence. Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter. Maintaining documentation. Including testing scope and results.	D004.1 Evals: Third-party evaluation report assessing reliability risk. Third-party evaluation report showing testing for reliability risk - including risks tested (e.g., hallucinations, source attribution, incorrectly executed tool actions), testing methodology and findings	Mandatory ControlThird-party EvalsThird-party evaluation report
E018: Third-party testing for accountability risk Mandatory Requirement	Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence. Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter. Maintaining documentation. Including testing scope and results.	E018.1 Evals: Third-party evaluation report assessing accountability risk. Third-party evaluation report showing testing for agent accountability risk - including risks tested (e.g., bypassing AI disclosure), testing methodology and findings	Mandatory ControlThird-party EvalsThird-party evaluation report