The Assurance Layer.

Executive summary

The last three years produced an extraordinary volume of AI governance writing and almost no operational assurance. Institutions adopted frameworks — the EU AI Act mapped onto a policy, NIST AI RMF onto a maturity grid, ISO/IEC 42001 onto a management-system project — and then discovered the same thing each time: the framework told them what good looked like, and nothing in the estate produced the artefacts that would prove it. When an examiner arrived, the answer was assembled by hand, out of tickets, screenshots and recollection.

That is the gap this article is about. A framework is a description. An operating system is a running process with state, and the difference matters most at the two points where regulated institutions are now failing: producing consistent evidence for a single AI system across several supervisors, and holding a genuine AI control library rather than an AI policy. Both are solvable. Neither is solved by another framework.

Why frameworks stopped working

Frameworks work when the underlying activity is slow enough for a periodic assessment to remain true between assessments. Model risk management under SR 11-7 was built in that world: a model was validated, entered production, and behaved more or less the same way until the next review cycle. Generative and agentic systems break that assumption. The model version changes under the institution. The retrieval corpus changes weekly. The prompt is edited by a product manager on a Tuesday. The agent gains a new tool permission because an integration shipped. An annual assessment of a system that changes weekly is a photograph of a river.

Institutions have responded by writing more policy. Policy is not the binding constraint. The binding constraint is that nothing in the estate emits a signed, retained artefact each time a control operates — so there is no state to inspect, only intent to describe. That is why boards receive AI updates that read like strategy papers rather than control reports, and why internal audit teams keep issuing the same finding: framework adopted, evidence absent.

The operating chain

Assurance is a chain, and it is only as strong as its weakest link. Sixteen links sit between a board's accountability and a supervisor's question, and each one has to hand a defensible artefact to the next.

Most institutions can evidence links one to six. Most cannot evidence seven to thirteen. Almost none can demonstrate that fourteen through sixteen close the loop back to the board with anything other than a slide. The chain is where the work is.

The cross-jurisdiction gap

Consider a group whose parent sits in one jurisdiction and whose regulated subsidiaries sit in several others — a broker-dealer, an asset manager, an advisory business, each with its own supervisor, plus a state regulator and a sectoral cyber rule on top. The group deploys one AI system. It is then asked five differently-shaped questions about that single system: conformity and risk-management documentation in one place, independent validation and effective challenge in another, supervision and recordkeeping obligations in a third, cybersecurity governance certification in a fourth, and a parent-level attestation that group-wide controls are operating in the fifth.

Answered separately — which is how it is almost always answered — the group produces five inconsistent accounts of one system. That inconsistency is itself a finding. Answered from one evidence set with mapped deltas, the same artefacts serve all five, and the only jurisdiction-specific work is the additional evidence a particular supervisor genuinely requires. The difference is not effort; it is architecture.

The AI control-library gap

The market has produced an abundance of AI policy templates and a striking scarcity of AI control libraries. The distinction is not academic. A policy says the institution will manage model provenance. A control says who approves a model into the registry, what the approval record must contain, how an examiner tests that the record exists for every production model, what evidence artefact the test produces, and how the effectiveness of that control is graded. Auditors examine controls. Supervisors examine controls. An institution with a strong AI policy and no AI control library has an intention, not a defence.

Cabier's approach was to extend the existing institutional control library along an AI axis rather than fork a separate one: AI governance and accountability, model lifecycle, data and provenance, agentic systems, generative and prompt controls, AI cyber and adversarial testing, AI third-party and supply chain, AI resilience and continuity, and AI disclosure and evidence. Each control carries an objective, a control statement, a test procedure expressed as examine, interview and test, an evidence artefact, and a jurisdiction map recording the delta each regime adds. A representative sample is published; the full set stays within engagement.

The jurisdiction map is the part nobody else has built properly. It is the difference between telling an institution that the EU AI Act and SR 11-7 both require independent validation, and telling it that a single validation artefact satisfies both provided it carries two additional fields — and that a third supervisor will want the same artefact retained for a different period.

Why point solutions cannot close it

The AI governance tooling market has organised itself around single links in the chain. There are excellent model registries, credible evaluation harnesses, capable prompt-management platforms and serious red-teaming vendors. Each solves a real problem. None of them holds the chain, because a chain is not a set of links purchased separately — it is the joins between them.

An institution that buys six tools acquires six evidence formats, six retention regimes and six versions of the truth about which models are in production. The reconciliation work that follows is larger than the problem the tools were bought to solve, and it is precisely the work a supervisor will probe. Independence compounds the difficulty: a vendor that supplies the model, the evaluation and the attestation is grading its own homework, and every major regime — the EU AI Act's obligations, SR 11-7's effective-challenge requirement, OSFI E-23's independent review expectation — was drafted specifically to prevent that.

Why traditional firms cannot either

The large advisory firms have deep regulatory expertise and a delivery model built for periodic engagements. They will map an institution's obligations superbly, and the map will be accurate on the day it is delivered. What they do not leave behind is a running system. The engagement ends, the estate keeps changing, and the institution is back to assembling evidence by hand for the next examination — often by re-engaging the same firm.

There is also a structural conflict worth naming plainly. A firm that implements the institution's AI systems, writes the policy governing them and then opines on their control effectiveness occupies three positions that supervisors have spent two decades separating. Cabier's position is deliberately narrower: it does not build, host or resell models, and it does not write an institution's policy and then grade it. Independence is the product.

What an assurance operating system is

An operating system has state, scheduling, permissions and a system of record. An assurance operating system has the same four properties applied to governance. The state is the registry of every model, dataset, agent and control in the estate. The scheduling is continuous control monitoring rather than an annual cycle. The permissions are Trust Gates and tool governance, deciding what may run where and under whose accountability. The system of record is an evidence vault where every control operation leaves a signed, lineage-bearing artefact.

On that base sit the surfaces an institution actually uses: a cross-jurisdiction AI control library, a harmonisation engine that maps a home-jurisdiction control onto host obligations with the delta made explicit, a supervisory readiness score in examiner language, and a control plane that keeps a multi-model estate governable without pretending it is autonomous. Human accountability is named at every gate. Cabier makes no autonomous-execution claim, and no board should accept one.

One evidence set, many supervisors

The economic argument for the assurance layer is simple. The marginal cost of the second supervisor should be small. In most groups it is nearly as large as the first, because the second examination is answered from scratch. When the base artefact is shared and only the delta is jurisdiction-specific, adding a jurisdiction becomes a mapping exercise rather than a programme.

The governance argument is stronger. Five consistent answers about one system are evidence of control. Five inconsistent answers are evidence of its absence, regardless of how good each individual answer is.

Supervisory readiness, continuously

Readiness is measured across twelve dimensions in the language an examiner uses — board, regulator, audit, cyber, operational, legal, compliance, model, agent, data, resilience and third party — each linked to the evidence that supports it, and each rolling into the institution's Operational Resilience Score. The dimension map is published; the weights and grading rubric are not, because a published rubric is a rubric that gets optimised against rather than met.

The important property is that readiness is current rather than annual. An institution should be able to answer the question "could we survive an examination this week" without commissioning work to find out.

What the board should ask

Four questions separate an AI governance programme from AI governance theatre. Can we produce, today, a complete list of models, datasets and agents in production, including those inside vendor stacks? Do we hold AI controls with test procedures and evidence artefacts, or only AI policies? If three supervisors asked about the same system this month, would they receive the same account? And who, by name, is accountable when an agent acts and the outcome is wrong? If any answer is uncertain, the institution has AI usage and an AI framework. It does not yet have assurance.

FAQs

Glossary

AIEAF

AI Enterprise Assurance Framework — Cabier's named framework for enterprise AI assurance.

Assurance operating system

The running system that produces governance evidence continuously rather than periodically.

Assurance Kernel

The shared control, evidence and scoring engine underneath every Cabier module.

Agent

A process permitted to take action on systems using a model's output.

Blast radius

The maximum scope of systems and records an agent can affect before escalation.

CCM

Continuous control monitoring — control effectiveness measured on an ongoing basis.

Control library

A structured set of testable controls with objectives, procedures and evidence artefacts.

Control statement

The testable assertion a control makes about how a system behaves.

Delta

The additional evidence or treatment a second jurisdiction requires beyond a base control.

DORA

EU Digital Operational Resilience Act — ICT and third-party resilience obligations.

Drift

Statistical movement in model inputs or outputs away from validated behaviour.

Evidence artefact

The signed record a control produces, retained for audit and examination.

Evidence vault

The retention and lineage store for evidence artefacts.

Harmonisation

Mapping one home-jurisdiction control onto host-jurisdiction obligations.

Home jurisdiction

The jurisdiction of the group parent or primary supervisor.

Host jurisdiction

A jurisdiction where a subsidiary or branch is separately supervised.

ISO/IEC 42001

The AI management-system standard used as a management-loop reference.

Model registry

The authoritative record of every deployed and observed model in the estate.

NIST AI RMF

The US voluntary AI risk management framework and its generative-AI profile.

ORS

Operational Resilience Score — the institution-level roll-up score.

Provenance

The documented origin of a model, dataset or prompt instruction.

Residency

The jurisdictional constraint on where data and inference may occur.

SR 11-7

US supervisory guidance on model risk management, including independent validation.

Supervisory readiness

How well an institution could answer an examination today, by dimension.

Trust Gate

A pre-production control checkpoint an AI system must clear before use.