Define
01
Requirement
The obligation or question to be addressed.
02
Control
The operational condition or safeguard expected to meet it.
AI ASSURANCE & EVIDENCE INFRASTRUCTURE
From AI governance requirements to evidence of system behavior.
ODA3 Institute is building evidence structures that connect requirements, controls and consequential system claims to traceable records of what AI systems do. Each conclusion must remain within the evidence examined.
PublishedFour versioned frameworks and supporting publications
Commissioned workCommissioned research, standards development, applied research and defined assessments
In developmentMachine-readable evidence structures and tooling
Not yet operatingIndependent conformance testing and certification
Evidence may exist and still not support the claim.
Policies, evaluations, logs and control records may all be present. The consequential question is whether they establish a defensible claim about a defined system, version, environment and period.
ODA3 Institute provides independent AI assurance and evidence infrastructure. We keep the source, collection basis and material limits beside a finding, and record missing or conflicting evidence explicitly.
HOW THE MODEL WORKS
One chain. Three working phases. From requirement to bounded conclusion.
Seven elements form three working phases. At each transition, the record should state the basis for moving from one element to the next.
Substantiate
03
Evidence
The records offered for examination.
04
Provenance
The origin, collection context, system state and time of each record.
05
Verification
Evidence verified against defined criteria for relevance, integrity and sufficiency.
Conclude
06
Finding
What the examined record supports, contradicts or leaves unresolved.
07
Bounded Assurance
A conclusion confined to the stated scope, evidence and limitations.
Framework Architecture
Four instruments with distinct jobs.
GAISSF™
Connect AI safety and security requirements to defined control questions.
Explore framework →UAIF™
A taxonomy and schema for describing AI incidents consistently.
Explore framework →AI-IRF™
A lifecycle for AI incident investigation, response and learning.
Explore framework →PAI-SF™
Security controls for systems with physical and kinetic effects.
Explore framework →Publication or adoption of a framework does not by itself establish an assurance conclusion.
Services
Start with the question you need answered.
Threat Intelligence & Research
Understand a threat, incident or emerging security question before making a decision.
Explore service →Standards Development
Translate a technical or governance need into clear requirements, controls and evidence expectations.
Explore service →Applied Research
Investigate a defined question about AI security, system behaviour or the evidence needed to examine it.
Explore service →Compliance Advisory
Connect applicable obligations to practical control and evidence questions.
Explore service →Training & Professional Development
Build professional understanding through ODA3 Academy.
Assessment & Certification
Examine defined evidence questions and understand the limits of the resulting conclusion.
Explore service →A PRACTICAL NEXT STEP
One system. One bounded question. One defined evidence base.
The Evidence Readiness Assessment examines whether available records support a specific claim in a defined operating context. Its report identifies the support, gaps and limits. It is not a certification or maturity score.
About the Assessment →A finding in context
See what a bounded finding looks like.
Synthetic illustration — not an examined client system.
| Element | Illustrative record |
|---|---|
| Claim | A designated agent action requires approval in configuration A during the stated test window. |
| Evidence | An approval-rule configuration and one successful approved-action trace. |
| Provenance | Controlled simulation / academic proxy (T3 sourcing); configuration and test window recorded. |
| Verification | The artifacts demonstrate the configured path; no attempted unapproved-action test or complete execution record is available. |
| Finding | Partial: the approved path is evidenced; enforcement across the claimed action set remains unresolved. |
| Notably Absent | No production records, complete action population, bypass testing, independent reproduction or certification. |
Research
Latest Insights
Banks Should Test Whether Corrected Customer Data Reaches AI Decisions
A corrected customer record does not establish which version an AI-assisted bank decision consumed. Examine source-to-decision lineage, interim rules and bounded outcomes.
Read publication →
AI Incidents Were Already Reportable: What CERT-In’s 2026 Audit Guidance Adds
India’s 2022 CERT-In Directions already covered specified AI/ML incidents. The 2026 AI auditing guidelines shift attention to risk-tier decisions, reporting evidence and tested controls.
Read publication →
A Robot Handoff Needs Evidence of Who Held Motion Authority
What proves motion authority during robot handoffs? Examine controller decisions, lost-link safety, EU machinery duties and bounded operational evidence.
Read publication →SELECTED PUBLICATIONS
Three starting points for deeper reading.
SELECTED READING
When Technical Evidence Becomes an Assurance Claim
A test can pass. A result can be reproduced. A control can be present. None of those facts, by themselves, tell us how broad an assurance conclusion should be.
Read publication →
SELECTED READING
The Next Evolution of AI Governance Platforms
Why Operational Assurance Is Emerging as the Next Enterprise Differentiator
Read publication →
SELECTED READING
The Kinetic Gap: Why Physical AI Requires a New Assurance Discipline
The assurance question changes when AI decisions terminate in movement, force or physical state change.
Read publication →ODA3 Academy
Professional learning, with clear boundaries.
OC-AISF
A selected ODA3 Academy programme. Full course title, syllabus and enrolment details will be shown when the course destination is approved.
Course details coming soonOC-AIRT
A selected ODA3 Academy programme. Course-specific learning outcomes and assessment details will be confirmed on the Academy.
Course details coming soonOC-AISPB
AI Security Playbook Course
Course details coming soonStart With Your Decision Context
Find a useful route.
A decision about an AI claim
Understand the basis and limits behind the conclusion.
Explore Assurance →A control or evidence question
Identify a suitable assessment or commissioned research route.
Explore services →An underwriting or claims evidence question
Explore traceable system records, intervention, fallback and evidence limits for insurance-related decisions.
Discuss an insurance research question →A method or standards question
Read published work or discuss a funded project.
Explore Research →Participate in the Institute’s work.
Explore membership under the published Charter and find the participation category relevant to you.
Explore membership →Explore a funded collaboration.
Discuss a defined research, standards or evidence project, with scope, independence, funding and permissions agreed before technical work.
Explore partnerships →Bring one system and the claim you need to examine.
Describe the question, operating context and records available. Introductory discussions establish fit; technical work requires an agreed paid scope, independence and data-handling checks, written terms and payment before work begins. Please do not send confidential evidence with an initial enquiry.
Discuss an engagement →