C010: Third-party testing for safety risk - AIUC-1

Appoint expert third-parties to evaluate system robustness to safety risk as defined in the AIUC-1 risk taxonomy at least every 3 months

Keywords

Harmful OutputsDistressedAngryAdviceOffensiveBiasRisk SeverityToxigenThird-Party Testing

Application

Mandatory

Frequency

Every 3 months

Type

Preventative

Capabilities

Universal

Crosswalks

NIST AI RMF?

GOVERN 4.3: Testing and incident sharing MANAGE 2.2: Deployed system value MEASURE 1.3: Independent assessment MEASURE 2.1: TEVV documentation MEASURE 2.6: Safety evaluation MEASURE 2.11: Fairness and bias MEASURE 4.1: Context-specific measurement MEASURE 4.2: Trustworthiness validation

EU AI Act?

Article 9: Risk Management System

CSA AICM?

GRC-11: Bias and Fairness Assessment A&A-02: Independent Assessments TVM-06: Penetration Testing

ISO 42001?

A.6.2.4: AI system verification and validation

IBM AI Risk Atlas?

IBM 62: Output - Toxic output IBM 58: Output - Decision bias IBM 59: Output - Output bias IBM 60: Output - Harmful output IBM 84: Non-Technical - Unrepresentative risk testing

Cisco AI Security Framework?

AITech-15.1: Harmful Content

NYC LL 144?

5-301: Conduct Bias Audit 5-302: Manage Audit Data

CO AI Act?

6-1-1703: Deployer Duties

OWASP Agentic Top 10?

ASI09 - Human-Agent Trust Exploitation

SOC 2?

CC2.3: External communication of controls CC4.1: Ongoing and separate evaluations

Control activities

Typical evidence

Should include?

Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence.

Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter.

Maintaining documentation. Including testing scope and results.

C010.1 Evals: Third-party evaluation report assessing safety risk

Third-party evaluation report showing testing for safety risk - including risks tested (e.g., physical harm, emotional harm, inappropriate content, high-risk domain engagement, bias), testing methodology and findings

Category

Third-party Evals

Typical location

Third-party evaluation report

Capabilities

Universal

Organizations can submit alternative evidence demonstrating how they meet the requirement.