Our previous posts in this series examined what gets assured in the process of AI assurance and who plays a role in the assurance ecosystem. But we have not yet looked closely at how AI assurance is actually done and what it takes to implement it in practice. After all, the key purpose of assurance is to create trust in the AI market. So how does this trust get built?
Resaro's Functional Mapping answers this question through the lens of assurance functions, the distinct activities, processes, and interactions that together make up the assurance lifecycle. Similar to how the AI lifecycle doesn’t start with model development, assurance does not begin only when an AI system gets evaluated. Foundational knowledge and infrastructure, together with direction-setting and governance activities set the basis for operational assurance functions. Resaro’s functional mapping organises these functions into three logical zones of layered, interdependent activities that together transform abstract science into verifiable trust.
The Three-Zone Architecture
The first zone, Core Concepts, forms the foundation of the ecosystem. It is where scientific knowledge and stakeholder needs are synthesised into the shared standards, metrics, and criteria that all other assurance activity depends on. The second zone, the Core Lifecycle, is the dynamic operational engine where an AI system is built, tested, and managed. The third zone, Ecosystem & Oversight, forms the surrounding framework of knowledge creation, rule-setting, and independent verification that keeps the whole system current, rigorous, and aligned. The assurance functions in these zones don’t follow a linear, sequential process, but rather function as continuously interacting layers of activities that connect across zones.
From Science to Standards: Building the Rulebook
The fundamentals of AI assurance come from the Ecosystem & Oversight zone, where scientific research conducted by universities, national metrology institutes, and commercial labs generates the foundational knowledge that the rest of the ecosystem depends on. This research feeds directly into metrology, the science of measurement, which establishes the reproducible methods needed to make AI testing valid, consistent and comparable. Metrology in turn enables the development of concrete metrics, benchmarks, and thresholds, the specific, quantifiable tools that translate abstract goals like "fairness" or "robustness" into measurable, certifiable requirements.
These inputs are formalised through standardisation: the consensus-building process by which diverse stakeholders including industry, government, regulators, and civil society agree on common technical specifications. This process is shaped directly by the assurance mandate, meaning the regulations, guidelines, operational domain and other constraints that dictate the scope and rigour of assurance for a given context. The resulting standards form the shared rulebook of the ecosystem: a reference point against which assurance activities, from testing to certification, are ultimately performed. Crucially, this is not a one-way flow. Standards bodies identify gaps that drive new research, and research provides the scientific basis for new standards, resulting in a continuous, pre-normative innovation loop.
Operationalizing AI Assurance: The Core Lifecycle
With the rulebook in place, the Core Lifecycle can begin. At its heart is the AI TEVV cycle — AI testing, evaluation, verification, and validation — which is the operational process through which assurance evidence is generated, judged, and shared.
It starts with measurement: the rigorous technical application of testing methodologies to generate verifiable evidence about an AI system's performance, robustness, and adherence to requirements. That raw evidence is then carried into evaluation, the critical judgment phase where it is assessed against the benchmarks and thresholds defined in Core Concepts to determine whether a system is safe, compliant, and fit for its intended purpose. This is where technical results meet operational, legal, and ethical considerations and inform risk management, system improvement, and deployment protocols.
The final step in the core cycle is communication: documenting and disseminating evaluation outcomes in accessible formats such as model cards, results reports and technical files. This is an often underestimated challenge for many organizations who treat this step as a reporting formality. If done right, effective communication of test results ensures the right information reaches the right actors, empowering downstream stakeholders to act on the evidence: It enables accountability across complex supply chains, it informs decision makers’ judgment of system readiness, and it builds operator trust and acceptance. If treated as a pure documentation exercise, however, it can undermine stakeholder alignment and collaboration.
The External Check: Ecosystem & Oversight
While the TEVV cycle runs, the Ecosystem & Oversight zone performs the structural governance functions that maintain trust in the system as a whole. Conformity assessment bodies independently audit AI systems and organisations against standards, turning internal claims into verifiable evidence. Their legitimacy, in turn, depends on accreditation, the meta-assurance function that verifies the competence and impartiality of the auditors themselves. Once systems are deployed, market surveillance ensures ongoing compliance by monitoring real-world performance, investigating complaints, and feeding findings back into the standards and research that underpin the whole ecosystem.
Established and Emerging Assurance Functions
As this blog post shows, AI assurance is a system of interdependent functions. Many of these, such as fundamental research, standardization, and conformity assessments, are well-established activities that have served the assurance ecosystem for other products for decades. Others, including the foundational metrics, benchmarks, and standards for AI are only emerging. In the next post in this series, we will zoom into the operational heart of this system and take a closer look at how the TEVV cycle works in practice.