This is what an organisation receives after an AQE assessment: a certificate with a verdict, and an evidence book showing every answer and finding behind it. The example is a US financial services firm planning to use AI in back-office process automation.
The deployment may go ahead within its assessed scope. Fourteen required actions must be completed before it can be fully qualified.
Reference AQE-63528BB9 · US jurisdiction · Framework 2.0.4 · Gap library 2026-02-US
Exposure: low. The AI recommends and a person decides, and it is used by a single team.
Control: strong. A named owner can stop the system, but senior leadership has not yet been told about it.
Named accountable owner: Jason Butler, Chief Product Officer (fictional).
The verdict comes from six answers. The same answers, assessed under the same framework version, always produce the same verdict.
| Question | Answer |
|---|---|
| Is someone officially in charge of this AI system? | Yes |
| Can that person stop or pause it if something goes wrong? | Yes |
| Does senior leadership or the board know about it? | No |
| How much does the AI decide on its own? | Recommends, human decides |
| How widely will it be used? | Single team |
| Deployment-blocking governance signals found | None |
24 questions across five areas, each scored out of 10. An area passes without conditions at an average of 7 or above. All five fall short, and each comes with required actions in the evidence book.
The dark line on each bar marks the pass level of 7.
Findings point to the obligations they relate to. They are not legal advice and are not a finding that the organisation is in breach of anything.
| Framework | What it covers | Status |
|---|---|---|
| NIST AI RMF: Govern | Accountability, risk tolerance and AI governance policy | Review |
| NIST AI RMF: Manage | Ongoing risk response, monitoring and incident handling | Review |
| State AI laws (Colorado, California, Texas) | Automated decisions affecting individuals, and transparency | Review |
| Sector regulators (SEC, FINRA, OCC, HHS) | Model risk management, explainability and audit trails | Not assessed |
| ISO/IEC 42001:2023 | AI management system standard | Not assessed |
AQE uses fixed, version-controlled rules. There is no AI model and no assessor judgement in the decision, so the same inputs always give the same verdict.
Each report carries two fingerprints. The first identifies the exact ruleset used, and the second the decision it produced. Recomputing them from the inputs confirms nothing was changed.
Ruleset 68f1741f0e8b622f…
Decision 820b2f4553c2e190…
Both documents are marked as samples on every page.