Readiness Assessment — Safety Critical Labs

Step 1 — Classification

What kind of system are you building?

These questions help determine which classification tier applies and which requirement areas are relevant to your system.

What is the primary domain of your AI system?

What is the worst-case consequence if your AI system fails or produces incorrect output?

Loss of life, loss of vehicle, or catastrophic failure with no recovery Mission failure or significant impact, but consequences are recoverable Operational degradation with workarounds available

Does a human operator have the ability to override AI decisions in real time?

Yes — a human can always intervene before the AI acts Partially — override exists but response time may be insufficient No — the AI operates autonomously with no real-time human override

Step 2 — Data & Testing

Training data and test coverage

These questions map to AI-1 (data partitioning), AI-2 (bias detection), and AI-3 (ML test coverage).

AI-1: Data Partitioning

Do you maintain documented, separated training, validation, and test datasets with recorded provenance?

Fully documented — partitions are enforced, provenance is tracked, and data lineage is auditable Partially — we separate data but documentation or provenance tracking is incomplete Minimal — no formal partitioning or documentation process

AI-2: Bias Detection

Have you tested for performance disparities across user classes, operational contexts, or demographic groups?

Yes — systematic bias testing with documented baselines and mitigation procedures Some testing done, but not comprehensive or not formally documented No formal bias testing has been conducted

AI-3: ML Test Coverage

Do you have a defined test matrix covering nominal performance, edge cases, failure mode injection, and distributional boundaries?

Comprehensive test matrix with documented coverage across all categories We test for accuracy and some edge cases, but don't have a formal coverage matrix Testing is ad hoc — no structured test matrix or coverage tracking

Step 3 — Runtime Safety

Monitoring, confidence, and edge detection

These questions map to AI-4 (continuous validation), AI-5 (hallucination prevention), and AI-6 (out-of-distribution detection).

AI-4: Continuous Validation

Do you monitor your model in production for performance drift with defined thresholds and revalidation triggers?

Yes — automated drift detection with documented thresholds, triggers, and escalation paths We monitor some metrics, but thresholds and triggers aren't formally defined No post-deployment monitoring in place

AI-5: Hallucination Prevention

Does your system bound output confidence and degrade gracefully to human override when confidence is low?

Yes — confidence thresholds defined, low-confidence outputs trigger human review or safe fallback We have confidence scores but no formal thresholds or degradation procedures No confidence bounding or graceful degradation in place

AI-6: Out-of-Distribution Detection

Can your system detect when it receives inputs outside its training distribution, and does it log and escalate these events?

Yes — OOD detection with logging, alerting, and defined escalation procedures Some detection capability, but logging or escalation is inconsistent No out-of-distribution detection implemented

Step 4 — Robustness & Oversight

Adversarial testing, explainability, and human teaming

These requirements apply based on your classification level. Answer based on your current state — if a requirement doesn't apply to your tier, you can select "Not applicable."

AI-7: Adversarial Robustness

Have you conducted adversarial testing with defined robustness bounds and behavioral requirements under adversarial inputs?

Yes — formal adversarial testing with documented bounds and specified behavioral requirements Some adversarial testing done, but not comprehensive or formally documented No adversarial testing conducted Not applicable to my system's classification

AI-8: Explainability

Can operators access decision reasoning with a traceable decision basis for your AI system's outputs?

Yes — operator-facing explanations with traceable decision basis for all critical outputs Some explainability, but not systematic or not available for all decision paths No explainability mechanisms in place Not applicable to my system's classification

AI-9: Human-AI Teaming

Are AI authority limits, human override requirements, and interaction audit trails formally defined?

Yes — defined authority limits, override procedures, trust calibration testing, and audit trails Some procedures exist, but not all components are formally defined or tested No formal human-AI teaming framework in place Not applicable to my system's classification

AI-10: Privacy and Data Protection

If your system processes personal data, are lawful basis, data subject rights, and privacy-enhancing techniques implemented and auditable?

Yes — personal data is identified and minimized, lawful basis is documented, data subject rights are implemented, and privacy-enhancing techniques are in place Some privacy controls exist, but not all components are formally documented or verified No formal privacy controls or data protection framework in place Not applicable — the system does not process personal data

How ready is
your AI system
to certify?

Ready to close the gaps?

How ready isyour AI systemto certify?

Ready to close the gaps?

How ready is
your AI system
to certify?