Operational risk

The agent's answers to questions within its scope agree with the organization's approved sources. On the certification test set, at least 90% of scored answers are correct and no wrong answer is a critical error.

Why it matters

A confident wrong answer about a price, coverage or a dose is the failure customers and courts remember.

How we verify it

Caudals builds a test set of at least 150 cases from the organization's own documentation and real questions. Domain experts validate every expected answer. Caudals runs the set against the live system and grades each answer by its meaning against the source sentence.

Evidence we review

• The approved source documents
• The expert-validated test set
• The graded run, with each answer beside its source

Applies to

Every agent

Verified by

Testing. Reverified: every quarter.

Maps to

EU AI Act Art. 15ISO/IEC 42001 A.6NIST AI RMF MEASURE 2OWASP Top 10 for LLM applications LLM09:2025SOC 2 PI1SR 26-2 § V

When the sources do not contain the answer, the agent says so or hands over to a person. It does not invent facts, figures, policies, citations or links.

Why it matters

Invented details read like real ones, so nobody catches them until they cause harm.

How we verify it

The test set includes questions the sources cannot answer and questions built on a false premise. An invented fact presented as true is a finding, and one that could cause loss or harm is critical.

Evidence we review

• Results for unanswerable and false-premise cases
• The agent's instructions for what to do without a source

Applies to

Every agent

Verified by

Testing. Reverified: every quarter.

Maps to

EU AI Act Art. 15ISO/IEC 42001 A.6NIST AI RMF MEASURE 2OWASP Top 10 for LLM applications LLM09:2025

The agent declines or redirects requests outside its stated purpose, including advice it is not meant to give, such as medical, legal or investment advice.

Why it matters

An out-of-scope answer creates a liability the organization never agreed to take on.

How we verify it

Caudals tests out-of-scope and borderline questions drawn from the agent's scope statement. It checks that the agent declines clearly and points to the right channel.

Evidence we review

• The agent's scope statement
• Results for out-of-scope cases

Applies to

Every agent

Verified by

Testing. Reverified: every quarter.

Maps to

EU AI Act Art. 13 · Art. 26ISO/IEC 42001 A.9NIST AI RMF MAP 1 · MAP 3

An agent that acts through tools performs only authorized actions with the right parameters. It asks for confirmation before any action that is hard to undo.

Why it matters

A wrong answer can be corrected. A wrong refund, booking or deletion has already happened.

How we verify it

Caudals runs scenarios in a test environment or with test accounts. It asks for permitted actions, forbidden actions and ambiguous ones, and inspects the tool calls the agent made, not only its reply.

Evidence we review

• The list of tools with their permitted actions and limits
• Tool-call logs from the test scenarios
• The confirmation step for irreversible actions

Applies to

Agents that take actions

Verified by

Testing. Reverified: every quarter.

Maps to

EU AI Act Art. 14ISO/IEC 42001 A.9NIST AI RMF MANAGE 2OWASP Top 10 for LLM applications LLM06:2025OWASP Top 10 for agentic applications ASI02MITRE ATLAS AML.T0053 · AML.M0029 · AML.M0037

The agent recognizes situations it must not handle alone, such as a person at risk, a complaint, a legal threat, a request for a human or repeated failure to help. It hands over to a person with the context they need.

Why it matters

The moments that matter most are the ones an agent is least equipped to handle.

How we verify it

Test cases simulate each handover trigger defined during scoping. Caudals checks that the handover happens, reaches a staffed channel and carries the conversation with it.

Evidence we review

• The handover policy and its triggers
• Results for handover scenarios
• Proof that the human channel is staffed

Applies to

Every agent

Verified by

Testing. Reverified: every quarter.

Maps to

EU AI Act Art. 14ISO/IEC 42001 A.9NIST AI RMF MAP 3OWASP Top 10 for agentic applications ASI09GDPR Art. 22

The agent gives the same answer in substance when a question is repeated, reworded or asked in each language it supports.

Why it matters

If the answer depends on the phrasing, customers learn to keep asking until they get the one they want.

How we verify it

Caudals repeats a sample of cases, rewrites them in different words and asks them in every supported language, then compares the answers on substance.

Evidence we review

• Results for repeated, reworded and multilingual cases

Applies to

Every agent

Verified by

Testing. Reverified: every quarter.

Maps to

EU AI Act Art. 15ISO/IEC 42001 A.6NIST AI RMF MEASURE 2

The organization runs a regression test suite before every material change reaches users, and holds the release when results fall below its own threshold.

Why it matters

Most production failures arrive with a change nobody tested.

How we verify it

Caudals reviews the suite, its threshold and the records of recent releases. The certification test set is delivered to the organization, so it can serve as that suite.

Evidence we review

• The regression suite and its pass threshold
• Test runs tied to releases
• An example of a release that was held or fixed, if there is one

Applies to

Every agent

Verified by

Evidence review. Reverified: every year.

Maps to

EU AI Act Art. 9 · Art. 15ISO/IEC 42001 Cl. 8 · A.6NIST AI RMF MEASURE 1 · MEASURE 2SOC 2 CC8SR 26-2 § V

Changes to the model, the system prompt, the knowledge base, the tools and the guardrails are recorded, approved by a named person and reversible.

Why it matters

When something breaks, the first question is what changed. Without a record there is no answer.

How we verify it

Caudals reviews the change log and walks through one recent change from request to release, including how it would be rolled back.

Evidence we review

• The change log for the last 90 days
• Approval records
• The rollback procedure

Applies to

Every agent

Verified by

Evidence review. Reverified: every year.

Maps to

EU AI Act Art. 11 · Art. 17ISO/IEC 42001 Cl. 8 · A.6NIST AI RMF MANAGE 4SOC 2 CC8SR 26-2 § VI

The organization monitors the quality of the agent's answers and actions in production, reviews a sample of real conversations on a schedule and acts on what it finds.

Why it matters

Test sets age. Real questions change with products, prices and seasons.

How we verify it

Caudals reviews what is measured, who reviews it and how often. It looks at the last three reviews and the actions that came out of them.

Evidence we review

• Monitoring reports or dashboards
• Conversation review records
• Issues opened as a result of reviews

Applies to

Every agent

Verified by

Evidence review. Reverified: every year.

Maps to

EU AI Act Art. 26 · Art. 72ISO/IEC 42001 Cl. 9 · A.6NIST AI RMF MEASURE 3 · MANAGE 4MITRE ATLAS AML.M0024SOC 2 CC4 · CC7SR 26-2 § V

One named person is accountable for the agent, has the authority to change it or stop it, and reports on its performance to management.

Why it matters

Systems without an owner are the ones nobody fixes.

How we verify it

Caudals reviews the appointment and the reporting, and holds a short interview with the owner.

Evidence we review

• The owner's role description or appointment
• Management reports or minutes that cover the agent

Applies to

Every agent

Verified by

Evidence review. Reverified: every year.

Maps to

EU AI Act Art. 17 · Art. 26ISO/IEC 42001 Cl. 5 · A.3NIST AI RMF GOVERN 2SOC 2 CC1SR 26-2 § VI

The organization has a written plan for AI incidents such as wrong answers at scale, unauthorized actions or exposed data. The plan covers how to detect and contain them, how to notify the people affected and the regulators where the law requires it, and how to learn from them.

Why it matters

An incident handled in hours is a footnote. One handled in weeks is a headline.

How we verify it

Caudals reviews the plan and the record of any past incident. When there has been none, it walks through one scenario with the team.

Evidence we review

• The incident response plan covering AI failures
• Incident records and reviews
• The contact list for escalation

Applies to

Every agent

Verified by

Evidence review. Reverified: every year.

Maps to

EU AI Act Art. 26 · Art. 73ISO/IEC 42001 Cl. 10 · A.8NIST AI RMF MANAGE 4SOC 2 CC7GDPR Art. 33DORA ICT-related incident management

The organization can switch the agent off or restrict it within minutes. When the model, a tool or a data source is unavailable, the agent falls back to a safe message or a human channel instead of guessing.

Why it matters

The worst time to discover there is no off switch is during an incident.

How we verify it

Caudals watches the stop control work in a test environment. It simulates failures, such as a tool that errors or a knowledge base that returns nothing, to see what the agent says.

Evidence we review

• The stop procedure and who can use it
• Results of the failure simulations
• The fallback messages

Applies to

Every agent

Verified by

Testing and evidence review. Reverified: every quarter.

Maps to

EU AI Act Art. 14 · Art. 15NIST AI RMF MANAGE 2OWASP Top 10 for agentic applications ASI08 · ASI10SOC 2 A1 · CC7DORA Digital operational resilience