Safety Critical Labs / The Framework

Thirteen requirement
areas. Every AI
failure mode covered.

The SCL AI Requirements Framework establishes verifiable, pass/fail requirements for each AI specific failure mode not addressed by existing safety critical software standards. Requirements are defined by the failures they prevent, not the capabilities they enable. Algorithm agnostic. Domain applicable. Openly published under a citable DOI.

13
Requirement areas
93
Requirements
3
Classification tiers
2
Outcomes
v3.7
Current version
CC BY-SA 4.0
License
[ Framework v3.7 ]

AI-1 through AI-13

Operational and data foundations

The failure it prevents

A system evaluated on data it effectively trained on, reporting skill it does not have outside its declared operating domain.

A declared Operational Design Domain (ODD) bounding the certification claim, training/validation/test separation with documented provenance, and CUI and ITAR classification inheritance through AI output channels.

Addressing AI bias

The failure it prevents

Outcomes that are systematically worse for some users because the training data encoded a historical bias.

Bias risk assessment across user classes and operational contexts, training data bias evaluation, continuous bias monitoring, and bias threshold alerting and response.

ML test coverage

The failure it prevents

Strong average performance that hides untested edge cases, boundary conditions, and injected failure modes.

A defined test matrix serving as the ML equivalent of code coverage. Covers nominal performance, edge cases, failure mode injection, and distributional boundary testing.

Continuous validation

The failure it prevents

A model accurate at deployment quietly drifting wrong as the world changes around it.

Post deployment data drift monitoring, performance threshold maintenance, model maintenance criteria, and periodic model validation. Addresses a gap not covered by existing safety critical software standards.

Hallucination prevention

The failure it prevents

An AI stating fabricated facts, policies, or values with the same confidence as correct ones.

Hallucination criteria definition, detection, response, and logging, with independent output validation for safety critical decisions. Graceful degradation to human override below threshold.

Out-of-distribution detection

The failure it prevents

The model meeting an input unlike anything it was trained on and responding as if it were routine.

Training distribution characterization, runtime OOD detection, defined OOD response, and event logging. This is the condition under which AI behavior is least predictable.

Adversarial robustness

The failure it prevents

Inputs, training data, or the model itself manipulated by an adversary to force a chosen failure.

Data poisoning protection, adversarial input protection, model inversion and extraction protection, model integrity, adversarial event logging, AI supply chain security, and artifact load safety.

Explainability

The failure it prevents

A safety-critical decision that cannot be inspected, questioned, or justified after the fact.

Operator accessible decision reasoning with traceable decision basis, confidence indication, reasoning inspection capability, and public disclosure support. Required for any AI system where a traditional safety case would demand logical inspection.

Human-AI teaming

The failure it prevents

Operators who over-trust, under-trust, or lose the authority to override the AI when it matters.

Human decision authority, operational situational awareness, trust calibration, graceful degradation, interaction logging, operator qualification, workload management, and training program requirements.

Privacy and data protection

The failure it prevents

Personal or protected data exposed, retained, or transferred without lawful basis or control.

Personal data identification and minimization, lawful basis and consent management, data subject rights, privacy enhancing techniques, and cross border transfer controls. Applies where the system processes personal data; otherwise documented Not Applicable with rationale.

Multi-model systems

The failure it prevents

One model’s error cascading through a chain of models into a system-level failure.

Multi-model architecture documentation, cascading failure mitigation, ensemble coordination, combined confidence representation, and multi-model audit trail. Applies when the system coordinates multiple AI models.
Conditional

Neural networks

The failure it prevents

Network-specific failures: miscalibrated confidence, brittle features, and unverified deployment transforms.

Architecture documentation, confidence calibration, neural network explainability methods, training integrity, OOD detection extensions, adversarial vulnerability mitigation, generative model hallucination constraints, and deployment transformation validation.
Conditional

Continuous learning and adaptation

The failure it prevents

A model that keeps learning after deployment teaching itself the wrong thing, unnoticed.

Continuous learning permission criteria, runtime learning controls, learning data validation, catastrophic forgetting mitigation, learning validation, rollback procedures, ODD evolvability declaration, and continuous learning audit trail.
Conditional
[ Classification Levels ]

Three tiers. Scaled to consequence.

The framework applies all thirteen requirement areas at different depths depending on the classification of your AI system. Core requirements (AI-1 through AI-10) apply based on classification tier. Architecture and paradigm requirements (AI-11 through AI-13) apply conditionally based on system design. Classification is determined during Phase 1 of the assessment.

Tier 1
Safety-Critical AI
AI outputs directly affect human safety or system survivability. All AI-1 through AI-10 apply. No tailoring without Project Safety Review Board approval. AI-11, AI-12, AI-13 apply conditionally per system design.
Tier 2
Mission-Critical AI
AI outputs affect operational success but not human safety. AI-1 through AI-6, AI-8, AI-9, and AI-10 apply; AI-7 is tailored with Chief Engineer approval and documented rationale. AI-11, AI-12, AI-13 apply conditionally per system design.
Tier 3
Operational Support AI
AI supports operations but does not drive critical decisions. AI-1 through AI-6 and AI-10 apply at minimum. AI-7, AI-8, AI-9 as tailored. Tailoring permitted with Software Assurance authority approval. AI-11, AI-12, AI-13 apply conditionally per system design.
[ What Assessment Produces ]

A binary determination.
A documented risk score.

Assessment against this framework produces one of two outcomes, accompanied by a quantified risk score. Each determination is documented against a specific version of the framework, at a defined classification level, with every finding on record. There is no maturity index and no subjective rating.

Certified All applicable requirements met. Certificate issued with a validity period and a scheduled surveillance audit.
Not Certified One or more requirements not met. Findings documented. Remediation and re-assessment required. A Determination Document is issued regardless of outcome.
[ Published Standard ]

Read every requirement
before you engage.

The framework is openly published under a citable DOI. Every requirement, verification method, and evidence standard is available for review before any assessment begins. Verification is co-located: every requirement carries its verification, and every verification traces to a requirement.

If you believe a requirement is technically incorrect, insufficiently grounded, or missing coverage for a known AI failure mode, SCL welcomes that challenge. The standard improves through scrutiny.

Document Requirements and Verification Standards for Artificial Intelligence in Safety-Critical Applications. Version 3.7
DOI 10.5281/zenodo.22775993 (this version, v3.7)
All versions 10.5281/zenodo.19024420 (cite this)
Version history Thirteen versions published on Zenodo since 14 March 2026: v1.0 (March 2026), v2.0 (April 2026), v3.0 (May 2026, thirteen requirement areas established), v3.6 (13 August 2026), v3.7 (15 September 2026, current). Development began February 2025. See the full release history.
License CC BY-SA 4.0. Free to read, cite, and reproduce with attribution
Full text Every requirement in full, all thirteen areas and ninety-three requirements with rationale, verification method and success criteria, generated from the same source the assistant is grounded in.
Local copies Framework v3.7 (PDF, 1.5 MB), a copy of the Zenodo deposit, and white paper v3.7 (PDF, 1.1 MB), the same paper posted on SSRN. Cite the framework at the concept DOI above, not at these files.
Download the framework Read the white paper on SSRN

Every determination follows the same four phase process.

See the process