Assurance is not the same as compliance
Compliance asks whether you meet a specific rule. Assurance asks whether there is good enough evidence that a system does what its owners say it does, safely and within agreed limits. In the UK, where there is no single AI law, assurance is how organisations are expected to show that their AI is trustworthy to customers, regulators and their own boards.
What the roadmap sets out
In September 2025 the Department for Science, Innovation and Technology published its trusted third-party AI assurance roadmap. It focuses on independent firms that check AI systems, rather than internal assurance teams. Its immediate actions are to convene a consortium to professionalise the market, develop a skills and competencies framework for assurance practitioners, map what information assurance providers need access to, and fund new assurance tools through an AI Assurance Innovation Fund. The roadmap also discusses three possible quality models for the market: professionalisation of individuals, certification of processes, and accreditation of firms.
The roadmap is candid that the market is immature. There is no agreed competency framework yet, no professional body setting standards, and existing AI assurance certifications are not accredited by the UK Accreditation Service.
What that means for a buyer
If you are commissioning an AI audit or assurance review today, you are buying from a market that is still deciding what good looks like. That is not a reason to wait. It is a reason to be specific about scope.
- Decide what claim you want assured. "The model is fair" is not testable. "Shortlisting rates do not differ by more than an agreed margin across sex and ethnicity on last quarter's applicants" is.
- Ask what access the provider needs: model, training data, logs, people, documentation. Information access is one of the roadmap's named problems, and it is where engagements stall.
- Ask how the provider's people are qualified and what standards their method draws on, such as ISO/IEC 42001, ISO/IEC 42005 or the NIST AI RMF.
- Be clear about what the report will not cover. A point-in-time review says little about a system that is retrained monthly.
The preparation is the same either way
Whether assurance is done by an external firm or an internal team, it runs on the same raw material: a clear system description, a risk and impact assessment, test evidence, monitoring records and decision logs. Teams that keep those as part of normal delivery find assurance relatively cheap. Teams that assemble them on request find it expensive and slow.
If you are preparing for an assurance review and are not sure your evidence would hold up, start with the AI Opportunity and Governance Sprint.