Assurance pack

The assurance pack is a point-in-time, exportable record of how a project governs the AI it runs — the document you hand your own auditor. It gathers your AI system inventory, risk register, model and subprocessor information, evaluation evidence, human oversight, change history, policy decisions, conformance results and control coverage into one JSON file, together with a plain-language list of gaps and a check of whether the record has been tampered with.

Open Governance → Assurance Pack.

Admins only

Because the pack aggregates everything sensitive the project holds, only project Admins (and organisation Owners and Admins) can view or export it. The menu item is hidden from everyone else.

What the page shows

When the page opens it generates a summary of the project's current position:

• Metadata — when the pack was generated and by whom, and a scope note: the pack covers this project's AI governance position only; FYAI is an AI system provider, and your own obligations as deployer are set out in the shared responsibility matrix.
• Gaps in this pack — what's missing, in plain terms (see below).
• Chain verification — The record verifies or The record does not verify. Both hash chains the pack draws on (signed attestations and policy decision records) are recomputed at generation time. A failure means the history was altered after the fact — a finding about the record, not about the controls it describes. Decision records that predate the hash chain are counted separately because they can't be verified.
• One card per section with its headline numbers.

Click Refresh to regenerate the summary.

Export the full pack

1. Optionally set As at to reconstruct the position on an earlier date, and Since to set the start of the window for oversight, audit trail, policy decisions and conformance.
2. Click Export Full Pack (JSON).

The file downloads as assurance-pack-PROJECT-YYYYMMDD.json, dated by the As at date if you set one, otherwise today. As at and Since apply to the export; the on-screen summary always shows the current position.

Every export is itself recorded in the project's change history, so generating a pack today shows up in the audit trail of the pack you generate tomorrow.

How "As at" works

The risk register is rebuilt from each object's recorded change history as it stood on that date. Objects with no recorded change at or before that date are left out rather than back-dated, and the section notes that it was reconstructed. Control coverage is also evaluated as at that date. Other sections reflect the current position.

Sections

Each section lists the framework controls it evidences.

Section	Card title	Contains
ai_systems	AI Systems	Every registered system's system card; counts of systems, live systems, retired systems and systems whose declared tier understates their constituents.
risk_register	Risk Register	Every agent, team and function with its classification; counts reviewed, unreviewed, unclassified and without an owner.
models	Models & Subprocessors	Every model your organisation's usage has reached, with hosting region, data retention, whether it trains on customer data, and lifecycle status — unknown for anything not yet assessed — and counts of fully assessed models and models with an unknown training stance.
evaluation	Evaluation	For each agent and team: whether it's gated (High, Critical or unclassified), whether it passes, its test case count, reasons it doesn't pass, and when it was last run.
oversight	Human Oversight	Agents and teams flagged to require a session justification, chat sessions examined, and justifications recorded.
audit_trail	Audit Trail	The number of recorded changes by object type, and whether each object's hash-chained history verifies.
control_operation	Control Operation	Policy decisions in the window by effect, reason code, enforcement point and action; how many were enforced rather than shadowed; how many approvals a person resolved; sampling; and whether the decision chain verifies.
conformance	Conformance	Conformance runs in the window, the latest run's results, the controls exercised, failed cases and coverage gaps.
control_coverage	Control Coverage	For each framework loaded in the Control Library, the counts of automatically evidenced, manual and not-covered controls.
chain_verification	(shown as the banner)	The result of recomputing both hash chains.

Gaps

The pack names its own holes, because an auditor finds them anyway. Gaps it can report include:

• objects whose risk classification has never been reviewed, objects with no classification, and objects with no risk owner;
• no AI systems registered, or systems declaring a risk tier lower than their constituents;
• models in use with an unknown training-on-customer-data stance;
• agents or teams with no evaluation test cases;
• change-history chains that fail verification;
• no conformance run in the window, failed conformance cases, or cases that couldn't run;
• no policy decisions in the window, every decision recorded in shadow with none enforced, or decision records that fail verification;
• attestation or decision chains that don't verify, or decision records that predate the chain;
• no control framework loaded, controls not covered by any evidence, or no decisions in the window to evidence any control.

Related

• Governance overview
• Control Library
• Governance API — the pack is also available from the API