01CLAIM / EVIDENCE
A governed answer library
Every answer is paired with an owner, source artifact, approval state, and an explicit unknown when evidence is missing.
AI-CAIQ V1.1 EVIDENCE FACTORY FOR ENTERPRISE AI VENDORS
Turn AI due diligence into a deal asset.
AssureDeck turns scattered policies, model notes, eval results, and engineering facts into buyer-ready answers with evidence behind every claim—without pretending a template is proof.
FRAMEWORK SIGNAL
CSA released AI-CAIQ v1.1 on June 23, 2026. Its companion AICM v1.1 contains 247 controls across 18 domains.
Read the CSA sourceDEAL ROOM / ILLUSTRATIVEREVIEW MODE
AI PROCUREMENT PACKET
Enterprise review
PROVEN147
PARTIAL61
OPEN112
READY
Model & provider inventory
OWNEREDREADY
Customer data-use statement
APPROVEDPARTIAL
Evaluation thresholds & results
2 GAPSOPEN
AI incident response exercise
UNPROVENFREE / LOCAL / FOUR MINUTES
Can your AI claims survive a buyer review?
Runs in this browser. Nothing is uploaded, stored, or sent to AssureDeck.
GOVERNANCECHOOSE THE CURRENT EVIDENCE STATE
This original 20-signal check is an informational pre-assessment. It does not reproduce or replace the official AI-CAIQ, and it is not an audit, certification, assurance opinion, or legal assessment.
WHAT THE BUYER CAN ACTUALLY REVIEW
A packet made of facts, not confidence theater.
The deliverable is designed to survive security, procurement, product, and legal review because every answer exposes its source and approval boundary.
02SYSTEM / MODEL
A buyer-readable AI inventory
Models, providers, data flows, intended uses, limitations, and human checkpoints become one reviewable system record.
03GAP / ACTION
A buildable control backlog
Missing proof becomes a ranked engineering, policy, or operating task—not a vague red cell in a spreadsheet.
04DEAL / HANDOFF
A reusable evidence room
Approved material is packaged for your trust center, GRC workspace, buyer questionnaire, and STAR for AI pathway.
THE EVIDENCE FACTORY SPRINT
Fifteen business days from scattered proof to governed answers.
Built for AI-native SaaS teams already selling into enterprise accounts. One system boundary, one accountable client team, one reusable response library.
BEST FIT
- 20–200 person AI SaaS vendor
- Enterprise ACV above $50K
- Active buyer security review
- Existing SOC 2 / security program
DAYS 01–0301
Bound the claims
Inventory systems, providers, enterprise promises, buyer questions, and the evidence you already have.
DAYS 04–0702
Build the proof map
Map evidence to the AI-CAIQ response set, mark unsupported claims, and assign owners to every material gap.
DAYS 08–1203
Close priority gaps
Draft missing artifacts, improve technical controls where scoped, and produce source-linked response language.
DAYS 13–1504
Ship the deal room
Run executive review, freeze approved answers, hand off imports, and rehearse the next buyer review.
FIXED-SCOPE ENGAGEMENTS
Start with the live deal, then build the reusable system.
Fixed prices cover one defined AI system. Work starts after the agreed kickoff inputs are complete. Scope changes are priced before work, and no payment is taken on this site.
ENTRY
Evidence Gap Scan
$5,000 / fixed
- 5 business days
- One AI system boundary
- Evidence inventory & claim register
- Priority gap roadmap
BUILD
Evidence Factory Sprint
$25,000 / fixed
- 15 business days
- AI-CAIQ response library
- Evidence index & control backlog
- Trust center / GRC handoff
- One live buyer-review support session
OPERATE
AI Questionnaire Desk
$3,000 / month
- For sprint alumni
- Approved-answer maintenance
- Model & vendor change updates
- Buyer follow-up support
DIRECT / CONFIDENTIALITY-AWARE
Put one live deal in scope.
Send only the business context needed to assess fit. We review every request manually and confirm scope, exclusions, timeline, and fixed price before any work or payment begins.
OPEN METHODS / PRIMARY SOURCES
Inspect the method before you put a deal in scope.
Practical guides explain how scope, claims, evidence, owners, and gaps fit together. Every framework fact links to its official source. The working inventory is free with no email gate.
CLAIMCustomer prompts are excluded from model training by default.
EVIDENCEApproved data-use statement plus provider terms and configuration record.
BOUNDARYNamed production service, current provider version, reviewed date, and accountable owner.
Illustrative method only. The claim is not about AssureDeck or a customer and is not evidence until a client validates its own sources.
00 / FREE TOOL
Score 20 buyer-review evidence signals.
Run the no-signup check locally in your browser and export a Markdown gap report.
Run the free check ->01 / AI-CAIQ V1.1Complete the questionnaire with evidence.
Scope one system, map answers to owners and sources, and keep partial or missing support visible.
Read the guide ->02 / BUYER REVIEWUse the AI security evidence checklist.
Convert a live buyer spreadsheet into a reusable answer library and evidence index.
Open the checklist ->03 / STAR FOR AIPrepare before the self-assessment submission.
Understand CSA's current level path and separate preparation support from program decisions.
Check readiness ->04 / FIXED SPRINTSee the evidence pack and definition of done.
Review the system card, claim register, evidence index, gap backlog, scope, and exclusions.
See the deliverables ->FREE / NO EMAIL GATE
AI Procurement Evidence Inventory.csv
Original working columns for scope, owner, approved answer, evidence URI, review date, gap, and target date.
BOUNDARIES MATTER
Clear answers before the first workshop.
Is this an AI certification or an audit opinion?
No. AssureDeck is an evidence-production and deal-enablement service. Your team approves every representation. Independent certification, assurance, or legal opinions stay with qualified third parties.
Do you replace Vanta, Drata, Conveyor, or a trust center?
No. We make those systems more useful by creating the AI-specific inventory, evidence index, approved answers, and gap backlog that can be imported into the tools you already use.
What if our evidence is incomplete?
That is expected. We never invent a control or soften an unknown. We separate what is proven, what is partially supported, and what must be built before the claim can be approved.
Do you need our confidential files in the free check?
No. The readiness check runs locally in your browser. It asks only whether broad evidence types exist and does not upload or retain your answers.
What happens to a submitted scope brief?
The contact form stores only the fields you submit plus a one-way daily anti-abuse identifier. It is used to assess and respond to your request, is not sold, and is separate from the local-only readiness check. Use the Privacy request option in the same form for access or deletion.
THE BUYER IS ASKING NOW