Building an AI Assurance Dossier

What procurement actually asks

Across security questionnaires, AI-specific addenda and legal review, enterprise buyers ask a consistent set of questions about an AI system:

What is the system for, and what is it not for? Who are the intended users?
What data was it trained or fine-tuned on, and what data does it process in operation? Is customer data used for training?
Which model providers are involved, under what terms, and where is inference run?
How was it evaluated: accuracy, robustness, bias, safety; by whom; when; on what data?
Where is the human in the loop, and what can a human override?
How are incidents detected, handled and reported to customers?
What are the known limitations and failure modes?
What logs exist, who can access them, and for how long?

An AI Assurance Dossier is the evidence file that answers these. It is built by the company in the Trust Workspace, each answer linked to a document, a test result or a policy with a date and an owner, and it can be shared with a buyer under NDA or published in part. It is not a certification and it is not a legal opinion; it is the material a buyer's reviewers, auditors and lawyers need.

Structure of the dossier

OpenDossier organises the AI Assurance Dossier into nine parts, each a set of claims with evidence chains, like the counterparty file.

Part	Contents	Typical evidence
1. System description	Purpose, users, deployment context, versions	System card, architecture summary
2. Data	Training, fine-tuning and operational data; provenance; rights; retention	Data inventory, DPA, licences
3. Models and providers	Models used, provider terms, hosting locations	Provider contracts, sub-processor list
4. Evaluation	Metrics, benchmarks, bias and robustness tests, red-teaming	Evaluation reports with dates and methods
5. Human oversight	Review points, override, escalation	Procedures, UI evidence, training records
6. Risk management	Impact assessment, risk register, mitigations	AI impact assessment, risk register extracts
7. Incidents	Detection, response, customer notification, history	Incident policy, post-incident reports
8. Governance	Roles, policy, change control, supplier management	AI policy, org chart, change log
9. Transparency	User notices, content marking, documentation for deployers	Notices, instructions for use

Each part carries a completeness indicator and a review date, so a buyer can see at once what is evidenced and what is still a statement.

Mapping to the EU AI Act

Regulation (EU) 2024/1689 applies in stages. Prohibited practices and AI-literacy duties applied from 2 February 2025; obligations for general-purpose AI model providers from 2 August 2025; most transparency obligations under Article 50 from 2 August 2026. The AI Omnibus amending regulation, published in the Official Journal on 24 July 2026, moved the high-risk obligations for Annex III systems to 2 December 2027 and for Annex I product-embedded systems to 2 August 2028, and gave a grace period to 2 December 2026 for the Article 50(2) marking requirement on systems already on the market. Check the current text before relying on a date.

For a high-risk system the dossier parts map directly: risk management (Article 9) to part 6; data governance (Article 10) to part 2; technical documentation (Article 11 and Annex IV) to parts 1, 3 and 4; record-keeping (Article 12) to part 7; transparency and instructions for use (Article 13) to part 9; human oversight (Article 14) to part 5; accuracy, robustness and cybersecurity (Article 15) to part 4. Deployers have their own duties, including human oversight arrangements and, in some cases, fundamental-rights impact assessments.

Whether a given system is high-risk is a legal classification the company and its advisers must make; the dossier records the classification, the reasoning and the date, as a company-stated claim.

Mapping to ISO/IEC 42001 and NIST AI RMF

ISO/IEC 42001:2023 is the management-system view. Its clauses on context, leadership, planning, support, operation, performance evaluation and improvement correspond to part 8 (governance) and the control-level evidence in Annex A: AI policy, roles, resources, impact assessment (control area on AI system impact assessment), lifecycle controls, data for AI systems, information for interested parties, use of AI systems and third-party relationships. A company preparing for 42001 certification can use the dossier as its evidence index; OpenDossier's readiness service does this and introduces an accredited certification body.

NIST AI RMF 1.0 (January 2023) is voluntary and organised into four functions: Govern, Map, Measure and Manage. Govern maps to part 8; Map to parts 1, 2 and 6; Measure to part 4; Manage to parts 6 and 7. The Generative AI Profile (NIST AI 600-1, July 2024) adds risks and actions specific to generative systems, such as confabulation, information integrity and intellectual-property exposure, which the evaluation and risk parts should address explicitly for generative products.

Buyers in different regions cite different frameworks; a single evidence set mapped to all three avoids rewriting the same answers.

Evidence quality: what makes an answer verifiable

A dossier is only as good as the evidence behind each claim. The following standards apply.

Dated and versioned. Evaluation results state the model version, the dataset version, the date and the method. A benchmark number without a date is not evidence.
Owned. Each part has a named owner inside the company who signs the claims.
Reproducible where possible. Evaluation code, prompts and test sets are referenced, even if shared only under NDA.
Third-party where it counts. Independent red-team reports, penetration tests and audits are recorded with the firm's name and scope.
Consistent with other sources. The sub-processor list in the dossier must match the public sub-processor page and the contract schedule; contradictions are flagged.
Honest about limits. Known failure modes and out-of-scope uses are listed. Buyers trust a dossier that says what the system cannot do.

OpenDossier reviews dossiers for these properties and shows the review status, but the claims remain the company's; the review is about evidence structure, not a certification of the system.

Keeping it current

AI systems change faster than security programmes. A model provider update, a new fine-tuning run, a change of hosting region or a new sub-processor can invalidate several parts of the dossier at once. The Trust Workspace therefore ties each part to a change trigger and an owner, and the dossier shows a freshness indicator in the same way as a counterparty file.

Practical cadence: review parts 3, 4 and 7 on every model or provider change and at least quarterly; parts 1, 2, 5 and 9 on every product release that changes scope; parts 6 and 8 at least annually and on any incident. Buyers who have been granted access receive a notice when a part they relied on changes, which removes the need for them to re-send the questionnaire.

For regulated deployments, keep the version history: the EU AI Act and ISO 42001 both expect documentation to reflect the system as placed on the market, and a dated history of the dossier is the simplest proof of that.

Sources

Reviewed 26 October 2026. Rules and fees change; confirm with the authority before relying on them.