Redstrata Knowledge Base

AI and Data Assurance Pathway

7 min read

AI and Data Assurance Pathway

Updated 2026-09-11 based on S-2026-09-11-weekly-briefing — a further inbound-dominated week with no captures advancing this project; the “governed context via MCP is now testable across ≥3 vendors” thread is logged as a candidate reusable assurance-test artefact. Routed to Open questions / blockers. Updated 2026-08-16 — sibling project PECB ISO 42001 Lead Auditor Certification schedule change: study start delayed to 13 Sep 2026; the Oct 2026 exam target noted below is superseded, with completion now targeted just before or just after Christmas 2026 [S-2026-08-16-pathway-start-delay]. Updated 2026-07-18 — new sibling project PECB ISO 42001 Lead Auditor Certification created (self-study pathway, exam target Oct 2026). This pathway’s 2026-05-06 decision excluding certifications from its own output mix stands: the certification is a separate project, not a scope change here. Cross-link added [S-2026-07-18-pecb-42001-la-exam-prep]. Updated 2026-06-26 based on Weekly Briefing — 26 June 2026 — second consecutive week with no captures advancing this project, now a tracked gap rather than a one-off. The week’s external signal strengthens the case for the pathway’s artefacts: a transatlantic “no new GenAI/agentic rulebook” pattern (US SR 26-2 out-of-scope, FCA “existing frameworks apply”, EU high-risk runway to Dec 2027/Aug 2028) means firms must evidence GenAI/agentic governance voluntarily against existing regimes — exactly what this pathway equips. Open questions updated (gap continuation; market-timing for Independent Governance Assurance; high-risk consultation deadline still unresolved). [S-2026-06-26-weekly-briefing] Updated 2026-06-19 based on Weekly Briefing — 19 June 2026 — adds new evidence to open question 4 (GPAI evaluation methodology) and flags, from the weekly review, that the project had no captures this week despite a timely external-evaluator signal.

Status: active Started: 2026-05-06 (delivered) Last touched: 2026-09-11

Why this project exists

A senior-practitioner Learning & Development pathway plus a contract-toolkit build-out, targeted at EU banking and capital markets AI and Data assurance work. The pathway is the agreed base from which Paul wants to develop templates, accelerators, and aids for a contract AI assurance role on a day-to-day basis [S-2026-05-06-paul-ai-data-pathway].

Current state

  • Pathway delivered (May 2026) as a Word document and Markdown file, both saved to C:\Users\pgmil\OneDrive\Documents\_ClaudeWorkspace\04 Ai and Data services\ as AI_Data_Assurance_Pathway.docx and AI_Data_Assurance_Pathway.md.
  • Output mix: practitioner artefacts, structured reading, hands-on labs (explicitly not formal certifications).
  • Regulatory scope: EU only (EU AI Act, EBA, ESMA).
  • FS sub-sector: banking / capital markets.
  • Starting level: senior on both audit / risk and AI / data — refresh + edge.

~30 practitioner artefacts to build out:

AI System Inventory · Regulatory Crosswalk · AIMS Statement of Applicability (ISO 42001) · AI Use-Case Intake Form · AI Ethics Board pack · AI Literacy curriculum spec · Data Lineage Evidence Pack · AI Dataset Datasheet (extending Gebru et al.) tailored to AI Act Art 10 · DPIA template for AI · RAG Corpus Control Checklist · Model Validation Report (mappable to AI Act Annex IV) · LLM Evaluation Plan · Fairness Testing Workpaper · Agent Control Surface Diagram · Agent Threat Model (OWASP Agentic + MITRE ATLAS) · Eval Plan for GenAI / Agentic · Human-in-the-Loop Decision Matrix · Tool Registry & Approval Workflow · Prompt Change Control SOP · AI Logging & Evidence Specification (Art 12) · Drift Monitoring Plan · AI Change Control SOP · AI Incident Response Playbook · AI Vendor DDQ · AI Contract Clause Library (DORA Art 30 + AI Act Arts 25, 53) · AI Supply-Chain Concentration Heatmap · Foundation-Model Exit Plan · AI Threat Model (ATLAS-aligned) · AI Red-Team Test Case Library · AI 3LoD RACI · Annual AI Assurance Plan · AI Control-Evidence Calendar · AI Risk Board Pack · Internal Audit AI Engagement Plan.

Decisions made

  • 2026-05-06 — Regulatory scope locked to EU only.
  • 2026-05-06 — Sub-sector locked to banking / capital markets.
  • 2026-05-06 — Output mix locked to practitioner artefacts + structured reading + hands-on labs; certifications explicitly excluded.

Open questions / blockers

Paul’s own flagged areas requiring further research [S-2026-05-06-paul-ai-data-pathway]:

  1. AI Act harmonised standards from CEN-CENELEC JTC 21 not yet fully published; Digital Omnibus may delay the 2 Aug 2026 high-risk obligations.

  2. EBA / ESMA implementing guidance on AI Act for FS — no immediate new guidelines but a 2026–2027 supervisory convergence programme; concrete control expectations beyond the November 2025 factsheet still pending.

  3. Agent assurance best practice — OWASP Agentic Top 10 (Dec 2025) and MITRE ATLAS agentic techniques (Oct 2025 – Feb 2026) are recent; no FS-supervisor formal expectations yet.

  4. GPAI systemic-risk evaluation methodology from the AI Office is still being published. Update (2026-06-19): the EU AI Office has issued a call for expert input on the independence and qualification requirements for external GPAI evaluators, with a workshop scheduled for 15 July 2026 — formalising who counts as a credible independent evaluator under the GPAI Code of Practice; alongside the UK CMORG frontier-AI guidance this points to a forming market for independent AI evaluation/assurance directly relevant to this pathway’s artefacts [S-2026-06-19-weekly-briefing].

  5. CSSF and other national-competent-authority specifics will need local supplementation when client jurisdiction is known.

  6. (2026-06-19, from weekly review) No captures advanced this project in the week to 19 June despite the timely external-evaluator signal — a candidate to convert the regulatory signal into concrete pathway/artefact progress or a positioning note [S-2026-06-19-weekly-briefing].

  7. (2026-06-26, from weekly review) Second consecutive week with no captures advancing this project — now a tracked delivery-capture gap. The transatlantic “no new rulebook” pattern (US/UK/EU all declining GenAI-specific rules) is a positioning opening: firms must evidence GenAI/agentic governance voluntarily against existing regimes, so a short positioning note framing the pathway’s artefacts as that evidence is a low-effort, timely next step [S-2026-06-26-weekly-briefing].

  8. (2026-06-26) The EU AI Office Article 6 high-risk classification consultation deadline remains unresolved (primary Commission page shows 23 June 2026 but is stamped “last update 19 May”; secondary reporting indicates an extension to 23 July 2026) — a one-line primary-source check would settle whether a consultation response is still open and feed open question 1. ⚠️ Not silently resolved; see EU AI Act Tensions [S-2026-06-26-weekly-briefing].

  9. (2026-09-11, from weekly review) A further inbound-dominated week with no captures advancing this project. The week’s vendor signal offers a concrete artefact opening: “governed context via MCP” is now a testable claim across Qlik, Ataccama and Alation, so a standing assurance-test question set — what policy, certification status and logging travel with the MCP call or semantic YAML, and whether a scheduled-refresh data-quality block is treated as a control or merely a snapshot — would convert the observation into a reusable pathway artefact [S-2026-09-11-weekly-briefing].

  10. (2026-09-18, from weekly review) A further inbound-dominated week with no captures advancing this project. Concrete artefact opening: with six-plus agent-control-plane vendors now on file, a one-page “enforcement-locus / system-of-record” decision frame — which layer holds the retained EU AI Act Art. 12 record, who approves versioned guardrail/policy changes, and what policy and logging travel with the MCP call — would convert the week’s dominant theme into a reusable pathway artefact (see Agent Control-Plane System-of-Record). Also routed here: the time-critical verification queue — Google Model Armor v3 cut-over (⇐25 Sep, lands next week), the Credo-relayed EU AI Act Omnibus dates against the Official Journal, and Microsoft’s ISO/IEC 42001 scope — to be closed before use in client-facing material [S-2026-09-18-weekly-briefing].

Connected wiki pages

History

  • 2026-05-06 — Pathway delivered; artefact list and research-g

Graph View

Backlinks

Recently updated

See 113 more →