Turn broad assurances into a list of evidence to request. Use these twelve questions for a hosted service, local model or connected AI application. No email required.
This worksheet organizes your own review. It is not a security score, a technical test, a compliance assessment or a recommendation to approve a deployment. A “documented” answer records your assessment; it does not verify the evidence.
Answers are kept in your browser and are not submitted to this site. Use Reset answers to clear the worksheet. Export if you want to retain them. Ordinary site analytics are described in the privacy notice; worksheet selections are not sent to analytics.
How to use the result
Ask the system owner to identify the evidence behind each answer.
Assign an owner and a review date to the material gaps.
Agree which claims need authorized technical testing rather than another written assurance.
Revisit the record when the model, tools, permissions or data use changes.
Sources and limits
These original review questions draw on the risk-management approach in the NIST AI RMF and the application-security issues described by OWASP. They are not an official NIST or OWASP assessment and do not imply endorsement. They address part of an AI review, not every risk.
