---
title: "Independent AI Assessments Need Clear Mandates"
description: "OpenAI calls for deep access for independent AI assessors. Enterprises should define scope, evidence, confidentiality, remediation, and reporting."
date: 2026-09-28
lang: en
tags: [governance, ai-act, analysis]
author: "thinkai.at"
canonical: https://thinkai.at/en/blog/independent-ai-assessments-need-mandates/
---

# Independent AI Assessments Need Clear Mandates

**Independent AI assessments** become reliable only when mandate, access, and publication rules are settled before testing starts. OpenAI published a set of principles on September 22, while the NIST AI Risk Management Framework treats evaluation as part of continuous risk management.

## A certificate is not enough

OpenAI distinguishes between an individual safety claim and a safety case: a structured argument connecting claims with evidence, assumptions, uncertainty, and residual risk. External assessors should not merely review these statements. They need proportionate access to training, evaluation, and deployment information so they can challenge assumptions and reach their own conclusions.

The provider names several requirements: a pre-agreed scope, transparent methods, relevant expertise and independence, protection of confidential information, actionable findings, and responsible publication. Where direct access is impossible because of legal, security, or intellectual-property constraints, controlled or privacy-preserving access mechanisms may be appropriate.

## The assessment starts in the contract

For an enterprise buying or deploying AI, the main consequence appears before the technical work. The mandate should define:

- **Subject:** Which models, versions, safeguards, and operating conditions are assessed?
- **Evidence:** Which logs, test data, system documentation, incident records, and experts are available?
- **Independence:** Which financial or organizational conflicts must be disclosed?
- **Confidentiality:** Where does the work take place, who receives findings, and which data may leave the environment?
- **Remediation:** How are findings prioritized, fixed, retested, and reported to governance bodies?

Without these points, a formally independent report can remain methodologically narrow or leave important assumptions untested.

## Connect findings to internal risk management

NIST describes the AI RMF as a voluntary framework for incorporating trustworthiness into the design, development, use, and evaluation of AI systems. For European enterprises, an external report therefore does not replace the internal owner or the approval decision for a specific use case. It provides evidence for the organization’s own risk and release process.

Treat independent assessments as a recurring control: trigger them after material model changes, new data classes, broader tool permissions, or significant incidents. The value is not the logo on the report. It is a mandate that permits difficult questions, defensible evidence, and verifiable remediation.

## Sources

- [OpenAI — Priorities and principles for effective third party assessments](https://openai.com/index/priorities-principles-third-party-assessments/)
- [NIST — AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)