AIAC-08 · Assurance endorsement
For vendor risk, procurement, and outsourcing functions. Most AI risk enters an organisation through a purchase order, not a project, and changes without a release note.
§ 1 — Intended candidates
Third-party risk, procurement, outsourcing, and vendor management functions, and the risk teams who inherit what they buy.
§ 2 — Examination domains
Domain weightings are published with the full syllabus ahead of the first cohort.
Identifying AI that arrived inside software already owned, including features enabled after purchase.
Techniques for assessing a vendor model you cannot inspect, and what to ask when you cannot test.
Notification of material model change, evidence rights, audit rights, and exit — and which of these are obtainable.
Concentration risk where many vendors sit on the same small number of underlying models.
Detecting that a third-party model changed underneath you, when nobody told you.
§ 3 — How to certify
Preparation is optional. Choose whichever route suits how you already work — the examination, the fee, and the marking standard are the same either way.
Register and sit the examination. Suitable for practitioners already working in assurance who want the credential without preparation.
The same examination, bundled with self-paced preparation mapped to the syllabus. Taking it confers no advantage in marking and is never required.
Preparation is optional. The examination is available at the same fee and marked to the same standard whether or not preparation was purchased, and assessors are not told which route a candidate took. How we manage this conflict.
§ 4 — Assessment
Scenario-based examination requiring a vendor AI risk assessment under limited visibility, and the contractual controls that are actually obtainable.
Successful candidates receive a credential with a unique identifier that any employer can check against the public record. See credential verification.
Curriculum mapping indicates alignment of learning content with published frameworks. It does not constitute endorsement by, or certification under, any standards organization or regulator.
§ 5 — Further reading
Producing credible, independently reviewable evidence that an AI system works as intended — and how that differs from governance and compliance.
Three terms used interchangeably that mean different things, have different outputs, and require different independence. A practitioner-level distinction.