Before commissioning an AI assessment, write down the decision it must support. You might be deciding whether to launch an internal assistant, extend an existing system to customer data, or give an agent permission to update records. State the intended use, the people affected and the actions the system may take. Use that description to agree the assessment boundaries and the evidence you need.
Start with the decision and system boundary
Choose a specific use case and name its business owner. Record whether it is a prototype, a pilot or an operational service. Describe the model, application, connected data sources and tools, including components supplied by other organisations. Draw the route from a user request to the resulting answer or action.
Include the environments and versions to be reviewed. List exclusions explicitly, such as a supplier’s underlying model or a production integration that cannot be tested. Ask how each exclusion limits the conclusions. For systems used across the UK and US, identify the teams, user groups and operating arrangements in scope without assuming every deployment is identical.
Separate the governance questions from the testing questions
For a procurement brief, it is useful to organise the work into two linked workstreams.
A governance review can ask who approves the use case, how risks are recorded, which decisions require human review and who handles incidents or changes. Request the records needed to examine those questions, such as ownership assignments, approval criteria and escalation procedures.
Security testing can examine defined technical behaviours under agreed conditions: whether access boundaries hold, how the application handles hostile input, and whether connected tools can exceed their intended authority. Specify the test environment, permitted techniques and expected evidence.
NIST’s AI Risk Management Framework 1.0 organises risk management into four functions: Govern, Map, Measure and Manage. Use these as discussion prompts when selecting the questions your assessment should answer. NIST AI RMF 1.0
Select scenarios relevant to the workflow
Start with the ways the system will actually be used. For a document assistant, ask about access to source documents, the accuracy of answers and the handling of content retrieved from outside the organisation. For an agent, add the actions it can trigger and the approvals required before execution.
OWASP describes prompt injection as input that changes a language model’s behaviour in unintended ways; indirect injection can arrive through external material such as files or websites. Consider whether those entry points exist in your workflow. OWASP Prompt Injection
OWASP also identifies excessive functionality, permissions and autonomy as causes of excessive agency. Where an agent uses tools, include questions about the authority granted to each connection. OWASP Excessive Agency
Agree the evidence and testing boundaries
Use this checklist when discussing the proposed scope:
- Ownership: Who can explain the workflow, approve testing and make the decision afterwards?
- Access: Which environments, user roles, accounts and integrations will be available?
- Data: Which synthetic or approved test data may be used, and how should evidence be stored and removed?
- Coverage: Which scenarios, languages and user groups will be examined, and which will be excluded?
- Control: What are the permitted testing activities, stop conditions and escalation contacts?
- Findings: What evidence should accompany an issue, and how should its impact and uncertainty be explained?
- Follow-up: Who will own each action, and what would justify retesting or a fresh assessment?
Ask the assessor to distinguish observed results, document review findings and assumptions. Agree how unavailable evidence will be recorded. Avoid treating an untested area as a successful result.
Example worksheet for an internal assistant
Illustrative planning example. Adapt these fields to your own assessment.
| Planning field | Illustrative entry |
|---|---|
| Decision | Whether to expand a policy assistant beyond a pilot group |
| Intended use | Answer staff questions using approved internal policies |
| Boundary | Pilot application, selected policy library and two user roles |
| Governance question | Who approves policy changes and handles disputed answers? |
| Security question | Can either role retrieve material outside its permitted library? |
| Evidence to request | Access settings, test observations and records of escalation decisions |
| Exclusion | Changes to live employee records |
| Follow-up | Assign unresolved issues before deciding on expansion |
Adapt the worksheet with the people responsible for the service, data and security. Record unresolved questions before requesting a proposal, then compare proposals against the same scope. Ask what conclusions each assessment can support and what would still require further work.
Explore AI governance, AI security and penetration testing when preparing questions for your assessment discussion.