Reference
Frameworks
The instruments AI assurance work is measured against, taken one obligation at a time. Each page states what the provision requires, who it binds, when it applies, and — the part published nowhere else — what an assessor asks to see before accepting that it has been met.
§ 1 — Collections
Collections
EU AI Act
Regulation (EU) 2024/1689
The Union law on artificial intelligence: risk tiers, roles, and the obligations that follow from them. Each page sets out what a provision requires, who it binds, when it applies, and what evidence discharges it.
Auditing AI systems
IIA Global Internal Audit Standards · ISO 19011:2026 · ISO/IEC 42006:2025 · EU AI Act Annex VII
What an audit of an AI system actually requires: how the engagement is scoped, what it is measured against, what counts as sufficient evidence, and how a finding is written when the thing that failed is probabilistic. Anchored in the audit standards, not improvised.
Agentic AI oversight
IMDA Model AI Governance Framework for Agentic AI v1.5 · MAS Consultation Paper P017-2025 · EU AI Act (general provisions)
What actually governs an AI system that plans and acts on its own — which is far less than the volume of writing about it suggests. One non-binding framework, one unfinalised supervisory draft, and a body of general law written before agents existed.
NIST AI RMF
NIST AI Risk Management Framework 1.0
The US reference for managing AI risk, organised into four functions. Voluntary, not certifiable, and the most widely used common vocabulary for what good AI risk management looks like in practice.
ISO/IEC 42001
ISO/IEC 42001:2023 — Information technology · Artificial intelligence · Management system
The AI management system standard: what an organisation must establish, document and evidence to certify against it. Each page sets out a clause, the duty it creates, who it binds, and the artefacts an auditor asks to see — described in our own words, because the text is copyrighted.
MAS and AI in financial institutions
MAS Technology Risk Management · Notices FSM-N05 and 658 · FEAT Principles · AI Model Risk Management (2024) · SAFR (2026)
What a Singapore-regulated financial institution already owes when it deploys AI — under instruments that are in force today, not the guidelines MAS has consulted on and not yet issued. Each page states which is which, because almost nothing written on this subject does.
AI in finance and accounting
IESBA Code of Ethics · US issuer regime · COSO · Circular 230 · UK Corporate Governance Code
What a professional accountant owes when the numbers came out of a model. The duties are real and mandatory, and they are mostly not in the auditing standards — they are in the ethics code, and they bind the finance function rather than its auditor.
Curriculum mapping indicates alignment of learning content with published frameworks. It does not constitute endorsement by, or certification under, any standards organisation or regulator.
§ 2 — By role
The same obligations, by role
Every provision above binds somebody in a named capacity. The role pages join the collections the other way round, gathering what falls on one role across all of them.