AI assurance and governance

Trust you can show the regulator, not only tell the board.

We test, guard and evidence every AI system you run: evaluation suites built from your real work, guardrails and security testing against misuse, safe migration when models change, and the compliance evidence your auditors ask for.

Get an AI assurance baselineDownload the AI risk checklist
The problem

Can our AI be trusted, and can we prove it?

“Risk wants test results. We have a spreadsheet of fifty prompts someone tried in March.”

  1. Manual spot checks before launch.

  2. AI policies that live in documents, not in systems.

  3. Model upgrades feared, delayed or skipped.

  4. Audit evidence assembled by hand before each review.

Why a platform

You are right to want proof before you scale. Assurance is what lets you say yes faster.

Your teams’ time Run by devx
Product development

TodayManual spot checks before launch

With devxVersioned eval suites built from real cases and run on every change

TodayAI policies that live in documents, not in systems

With devxRuntime guardrails: input and output filters, PII controls, tool permissions and limits

TodayModel upgrades feared, delayed or skipped

With devxSide-by-side benchmarks and regression reports before every migration

TodayAudit evidence assembled by hand before each review

With devxEvidence produced continuously: model cards, eval history, logs and a risk register mapped to frameworks

What we build

Six pieces, across every layer.

Evals and Benchmarks

Know how good your AI is, in numbers.

Tests that reflect your work, not public leaderboards.

  • Golden datasets drawn from your historical cases
  • Model-graded evaluation calibrated against human reviewers
  • RAG metrics such as groundedness and retrieval precision, and agent metrics such as task success and tool-call accuracy
  • Continuous eval dashboards wired into CI/CD
Guardrails and AI Security

Hard to misuse, quick to contain.

Defences for the new attack surface that language models open.

  • Red teaming against the OWASP Top 10 for LLM applications, including prompt injection, data leakage and excessive agency
  • Input and output guardrails with Model Armor, Bedrock Guardrails or custom classifiers
  • Tool and data access controls for agents
  • Abuse monitoring and AI incident response
Model Migration and Lifecycle

Adopt better models without fear.

Switch models on evidence, not on announcements.

  • Candidate models benchmarked on your evals
  • Prompt and pipeline adaptation for the new model
  • Staged cutover with shadow traffic
  • Planning for provider deprecation dates
Compliance Evidence and Governance

Ready for the auditor on any given day.

Governance that produces its own paper trail.

  • AI inventory and risk tiering
  • Control mapping to ISO/IEC 42001, NIST AI RMF, the EU AI Act, Singapore’s Model AI Governance Framework, the RBI FREE-AI framework and India’s DPDP Act
  • Model cards, decision logs and human oversight records
  • An operating rhythm for your AI governance council
Responsible AI and Fairness

Fair outcomes you can explain.

Checks for the decisions that affect people’s money, health and access.

  • Bias testing on predictive and generative systems
  • Explanations suited to customers, staff and regulators
  • Disclosure and consent patterns
  • AI impact assessments
Managed AI Assurance

Assurance that keeps running after launch.

A standing service for systems already in production.

  • Monthly assurance report per system
  • Re-evaluation on every model or provider change
  • Regulatory watch for India, Singapore and your other markets
  • Assessment of third-party AI tools before you buy them
How we work

A deliverable at the end of every phase.

  1. Baseline · Weeks 1–3

    You get Assurance baseline and risk register

    Inventory and tiering; evals and red teaming on your most important systems.

  2. Build the harness · Weeks 3–6

    You get Working eval and guardrail stack

    Eval suites, guardrails and logging wired into your pipelines.

  3. Evidence · Weeks 6–10

    You get Audit-ready evidence pack

    Control mapping, governance rhythm, first assurance report.

  4. Continuous · Ongoing

    You get Monthly assurance report

    Re-evaluation, migrations, regulatory watch.

Use cases

Use cases and the outcomes they change.

01 / 10

AI inventory and risk tiering

Enterprises with many pilots across teams
What changesEvery AI system found, owned and tiered by risk
Outcome it moves
Share of AI systems inventoried and tiered
02 / 10

Eval suite for a customer assistant

Banks and insurers
What changesRelease decisions based on measured accuracy
Outcome it moves
Answer accuracypolicy-violation rate
03 / 10

Pre-launch red team

Any public-facing assistant or agent
What changesAttacks tried and fixed before customers find them
Outcome it moves
Critical findings closed before launch
04 / 10

Model upgrade

Any live GenAI system moving to a new model generation
What changesBenchmarked, staged cutover
Outcome it moves
Regressions after cutovercost per task
05 / 10

Regulator and auditor readiness

Financial services in India and Singapore
What changesEvidence pack mapped to the applicable framework
Outcome it moves
Audit findingstime to produce evidence
06 / 10

Guardrails for agents with write access

Agents acting in ERP or core systems
What changesPermissions, limits and approvals enforced at run time
Outcome it moves
Unauthorised actions blockedoverride rate
07 / 10

PII and data leakage controls

Healthcare and financial services
What changesRedaction and leakage tests on every release
Outcome it moves
PII exposure incidents
08 / 10

Fairness testing for credit and claims models

Lenders and insurers
What changesBias measured and monitored across groups
Outcome it moves
Disparity metrics within agreed thresholds
09 / 10

ISO/IEC 42001 readiness

Organisations seeking AI management certification
What changesGap assessment and remediation plan
Outcome it moves
Gaps closedreadiness for external audit
10 / 10

Third-party AI due diligence

Procurement teams buying AI tools
What changesA standard assessment before purchase
Outcome it moves
Time to assess a vendorrisks found before contract

Our fees move with these numbers.

Your devx Outcome Manager reports assurance alongside business results, so speed and safety are discussed in the same meeting.

Questions

Ask us anything.

Ask devx › Questions buyers ask
Enter ↵
h1 · cooper light

Pick the AI system that matters most to you.

In three weeks we will tell you, with evidence, how far you can trust it and what it takes to trust it further.

Get an AI assurance baselineDownload the AI risk checklist