Practical guide · B2B AI product and assurance teams
AI Evidence Passport checklist
An AI Evidence Passport is a concise, reviewable pack for one product and one intended use. It helps a buyer understand what is known, what supports each answer, and what still needs review. It is not a certificate or a legal opinion.
1. Fix the product boundary
Name the product, version, intended users, deployment model, and uses that are out of scope. Distinguish your own models from third-party services and list any fallback providers. A buyer cannot interpret an assurance answer if the product boundary is unclear.
Working record: A one-page system profile with owner, version, use case, model suppliers, and data flows.
2. Record claims with their evidence
For each buyer question, write a narrow answer and link the current source: policy, technical setting, test result, contract term, or procedure. Record who approved the answer and when it should be reviewed. Mark an answer unsupported when evidence is missing.
Working record: An answer register with claim, evidence reference, owner, approval state, and review date.
3. Explain data and human control
Document what enters the system, retention and deletion choices, sub-processors, training use of customer content, and human review points. Separate product behavior from a customer’s own operating choices; the same product can be used in different contexts.
Working record: A data-flow summary and a list of controls the customer must configure or operate.
4. Keep gaps visible
List unresolved legal classification, missing supplier terms, untested controls, and decisions awaiting counsel. Assign an owner and next review date to each gap. Do not turn an unknown into an implied pass just to complete the pack.
Working record: A gap log with decision owner, next action, and due date.
5. Publish only a safe view
Prepare a buyer-facing copy from approved statements. Remove credentials, personal data, internal findings, and confidential attachments unless disclosure is specifically approved. Version the pack so recipients can tell which evidence and product release it covers.
Working record: A dated, approved buyer copy and a separate internal evidence register.