Direct answer: a citation does not mean the answer is right, and high accuracy does not mean nothing is missed. A knowledge assistant needs two kinds of failure checked separately: retrieval failure (wrong document or an old version) and generation failure (right data, wrong answer, or a conclusion with no evidence). A classifier needs performance by group, because error rates in minority languages and new customer groups are hidden by the overall average; if test data overlaps training data, the numbers are inflated. What ISO/IEC 42001 requires is that the method, data sources, versions and results of these tests can be traced and connected to risk treatment and go-live approval.
What the test evidence must cover
| Problem | What must be demonstrable |
|---|---|
| Citing the wrong version | The cited document and version can be traced; withdrawn versions are no longer cited |
| Right data, wrong answer | Retrieval and generation failures are counted separately, each with improvement records |
| Conclusions without evidence | Refusal rules and hand-over to a person exist and have been tested |
| Accurate overall, misses in a minority group | Performance by group, cost of errors and go-live thresholds |
| Test data overlapping training data | Data split method and check records |
| Mixed data sources and licences | A register of source, licensed purpose, personal data, labelling and version; data outside its purpose is re-evidenced, withdrawn or restricted |
What a consultant should deliver
- A data governance procedure: record requirements for source, licence, quality, labelling and version
- A test and acceptance procedure: what is tested, on which data, who decides, the thresholds and how results are kept
- Refusal and hand-over rules, and the flow that connects test results to risk treatment and go-live approval
- The tests themselves are run by your engineering team or a third-party test lab; the consultant designs the acceptance requirements and reviews whether the evidence supports the conclusion
How to accept the work
For any release, you can find the test data version, results by group, refusal tests and approval record; for any dataset, you can state its source, licensed purpose and whether it contains personal data.
What cannot be guaranteed
Testing reduces and exposes errors; it cannot guarantee zero hallucination or zero misses. Whether data licensing is lawful is ultimately for legal counsel.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
Related questions
- Does ISO 42001 require model testing? ISO/IEC 42001 requires management of the AI system life cycle and data, including verification and validation requirements and records; how to test and which thresholds to use are set by the organisation according to risk, with evidence kept. ISO 42001 implementation
- Is a vendor's overall accuracy slide enough? Not as an acceptance basis. You need at least a description of the test data, performance by group and the cost of errors; otherwise the go-live approval has no basis. How to choose an ISO 42001 consultant in Taiwan
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.