CIRCUIT Standard Assessment

Section 1 of 8

Identity

Establish what model is deployed, by whom, at what risk level, and with what consequence weight.

Model ID (unique slug)

System Name

Vendor / Source

Owner (name or role)

Maturity

Document the IMS level and the evidence artifacts that substantiate it. IMS is evidence, not assertion — Rule 2.

IMS Level — 0 — Opaque

0 — Opaque 5 — Continuous

Evidence Artifacts (list artifacts that substantiate the IMS claim)

Section 3 of 8

Circuit Inventory

Describe what the model does, what it takes as input, and what decisions it produces. This section informs red team scoping (Section 6) and compensating controls (Section 7).

System Description

Key Inputs

Key Outputs / Decisions

Named Circuits of Concern (for red team targeting)

If IMS ≤ 1, circuits may not be nameable yet — describe the functional areas the red team should probe.

Section 4 of 8

KPI Baseline

Six KPIs must be baselined before production (Rule 4). ACFR is Rule 7-linked — ACFR ≥ 1 in any model-quarter forces Red band independently of CRS. ACFR is a count of P1 safety-circuit bypasses, not a ratio.

ⓘ ACFR (KPI 1) is required. Name the remaining five KPIs to match your deployment context — common choices include accuracy/precision/recall, fairness disparity index, stability (drift rate), data quality score, and latency.

Section 5 of 8

Vendor Transparency

The Vendor Transparency section is not optional (Rule 8). For Category A models, complete this as an internal engineering attestation signed off by your ML lead.

Questionnaire Status

First Outreach Date

Second Outreach Date (if applicable)

Section 6 of 8

Red Team Record

Rule 6 requires circuit-aware (not behavioural-only) red team exercises. Cadence: semi-annually for High/Critical-tier, annually for Moderate-tier, not required for Low-tier.

Last Exercise Date

Next Required By (auto-computed)

Circuit-Aware Exercise?

Yes — circuit-aware (named circuits targeted)

No — behavioural-only (Rule 6 violation)

Exercise Scope / Methodology (brief summary)

Key Findings (brief summary)

Section 7 of 8

Compensating Controls

Required for Red and Purple band systems, and for any system below its IMS floor. Document the controls that bound the risk while interpretability evidence is being gathered.

Compensating Controls Document

Controls Sign-off Date (CISO / AIGC)

Remediation Plan Target Date

Red band: 180 days from sign-off date. Target: Amber band or decommission.

Section 8 of 8

Lifecycle

Registry entries must be retained for a minimum of three years from deployment (Rule 10). Document the retention expiry date.

Deployment Date (from Section 1)

Registry Retention Expires

Must be ≥ 3 years from deployment date. Rule 10.

Approved-At Band (band under which deployment was approved)

✓ Assessment complete. Use the YAML button above to export your registry entry, or click View Result to see a full compliance summary.