AITS 26002:2026 · Published
AITS — Artificial Intelligence Trust Standard
AITS is an independent international AI trust standard developed by Eric Chuar Technologies. It defines reviewable governance, risk, data, evaluation, human-oversight, security, transparency, monitoring and retirement requirements for organizations that develop, buy, integrate or operate artificial intelligence systems across jurisdictions and business contexts.
Direct definition
What is AITS?
AITS is an independent international AI trust standard developed by Eric Chuar Technologies. It defines reviewable governance, risk, data, evaluation, human-oversight, security, transparency, monitoring and retirement requirements for organizations that develop, buy, integrate or operate artificial intelligence systems across jurisdictions and business contexts.
AITS is intended to make conformance review practical. It does not award status for intent alone: the applicant identifies a bounded system, names accountable owners, operates applicable controls and supplies evidence that can be traced to the current version. The assessment considers design and operation together because a policy that is not followed, or a technical control with no accountable decision path, is not sufficient evidence.
| Acronym | AITS |
|---|---|
| Formal name | Artificial Intelligence Trust Standard |
| Reference | AITS 26002:2026 |
| Publisher | Eric Chuar Technologies |
| Maintainer | Eric Chuar Technologies Standards & Conformance |
| Scope | A governance and technical-assurance framework for responsible, reliable and accountable AI systems. |
| Status | Published — assessment required for certification |
| Geographic application | Designed for international and cross-border use |
Purpose and intended outcomes
What AITS is designed to achieve.
A governance and technical-assurance framework for responsible, reliable and accountable AI systems. The standard gives technical and non-technical stakeholders a common way to define expectations, inspect implementation and record residual risk without implying that one control pattern fits every organization.
- AI use cases approved against clear purpose, affected people and prohibited-use boundaries
- Risk classification that drives proportionate oversight, testing and evidence
- Traceable data and provider decisions with lawful handling responsibilities
- Human control, transparency and incident routes matched to real consequences
- Continuous monitoring and safe change or retirement when assumptions no longer hold
Who should use it
Accountability spans buyers, builders and operators.
Use is appropriate when the organization can identify the subject of assessment and the responsibilities it actually controls. Suppliers may contribute evidence, but outsourcing work does not outsource accountability for an applicant's decisions.
- Organizations developing, integrating, procuring or deploying AI
- AI product owners, model-risk teams and accountable executives
- Data, security, privacy, legal and human-rights reviewers
- Developers operating prompts, tools, retrieval and automated actions
- Procurement teams and assessors evaluating provider evidence
Scope boundary
Systems and lifecycle stages included and excluded.
Included
Predictive, generative, classification, recommendation, decision-support and agentic AI used internally or in products, including third-party models, prompts, tools, retrieval sources and human decision interfaces.
Excluded and not implied
It does not declare an AI system legally compliant in every jurisdiction, guarantee truth or fairness, certify a foundation-model provider, or represent ISO/IEC 42001, NIST, OECD, EU or government approval.
The assessment statement must identify organizational boundary, systems, interfaces, locations, lifecycle stages and material providers. Shared platforms can be included only to the extent that responsibilities and evidence are available. A narrow scope is acceptable when it is described honestly; ambiguous scope is not enlarged by marketing language.
Normative language
How to read the requirements.
Shall
A mandatory requirement for the declared scope. An exclusion needs a justified scope decision, not silent omission.
Should
A recommended practice. A different approach may be accepted when evidence shows an equivalent, context-appropriate outcome.
May
A permitted option that does not become mandatory merely because it appears in guidance.
Evidence
A record, artefact, observation or reproducible result that supports a claim. Evidence must be attributable, current enough for the decision and protected according to sensitivity.
Core principles
AITS principles guide proportionate implementation.
Purpose legitimacy
An AI use must have an approved purpose, affected-party analysis and lawful operating boundary before capability is treated as justification.
Risk-proportionate control
Higher consequence, uncertainty or autonomy demands stronger evidence, oversight and release authority.
Human agency
People receive meaningful notice, review and intervention routes where system output can affect them materially.
Evidence over impression
Claims about accuracy, fairness, safety and reliability are tied to defined datasets, contexts, thresholds and limitations.
Secure orchestration
Prompts, retrieval sources, tools, identities and automated actions are treated as attack surfaces.
Lifecycle accountability
Monitoring, incidents, provider changes and retirement remain owned after initial approval.
Normative control set
Mandatory AITS requirements.
Every applicable requirement shall be addressed for the declared scope. Alternative control designs may be accepted only when they produce an equivalent, evidence-supported outcome and do not conflict with the requirement. Assessors sample both design and operation and may request additional evidence where a material risk or inconsistency appears. Each control needs an accountable owner, affected boundary, review trigger and exception path; evidence must be attributable to the assessed version or operating period.
- AITS-4.1
Use-case approval
The organization shall record the intended use, expected benefit, affected parties, accountable owner and go or no-go authority before operational use. Evidence: approved AI use-case record.
- AITS-4.2
Prohibited uses
The organization shall define and enforce prohibited uses, unacceptable outcomes and escalation triggers appropriate to law, rights and organizational policy. Evidence: prohibited-use policy and enforcement tests.
- AITS-4.3
Risk classification
The organization shall classify each AI system by impact, autonomy, data sensitivity, reversibility and foreseeable misuse, then assign proportionate controls. Evidence: risk classification and rationale.
- AITS-5.1
Data provenance
The organization shall document material training, evaluation, retrieval and operational data sources, permissions, quality limits and transformations where accessible. Evidence: data provenance and limitation register.
- AITS-5.2
Lawful data handling
The organization shall minimize personal and confidential data and define lawful collection, access, retention, deletion and cross-border responsibilities. Evidence: data assessment and handling controls.
- AITS-5.3
Provider evaluation
The organization shall evaluate model and service providers for capability, limitations, security, privacy, change notice, continuity and exit risk. Evidence: provider due-diligence and decision record.
- AITS-6.1
Accuracy and hallucination testing
The organization shall test representative and adversarial cases against defined correctness, groundedness and unsupported-output thresholds. Evidence: versioned evaluation set and results.
- AITS-6.2
Fairness and impact evaluation
The organization shall assess differential outcomes and affected-party risks using measures appropriate to the context rather than a universal fairness score. Evidence: impact assessment and mitigation record.
- AITS-6.3
Human oversight
The organization shall define when a person reviews, can override, stop or appeal an AI-supported action and ensure that role has adequate information and authority. Evidence: oversight procedure and exercised examples.
- AITS-6.4
Transparency
The organization shall provide notices explaining AI involvement, intended purpose, meaningful limitations and routes for questions or challenge where relevant. Evidence: approved notice and interface evidence.
- AITS-7.1
Prompt and tool security
The organization shall test prompt injection, unsafe tool use, retrieval poisoning, data leakage and privilege escalation for systems using prompts or actions. Evidence: threat model and adversarial test results.
- AITS-7.2
Access control
The organization shall apply least privilege to models, data, prompts, tools, configuration and administrative actions with periodic review. Evidence: role matrix and access review.
- AITS-7.3
Logging and traceability
The organization shall retain proportionate records of versions, material inputs, outputs, decisions, overrides and actions without excessive personal-data capture. Evidence: logging design and trace samples.
- AITS-8.1
Operational monitoring
The organization shall monitor quality, drift, misuse, failures, complaints and material changes against approved thresholds. Evidence: monitoring dashboard and decision log.
- AITS-8.2
Incident response
The organization shall define containment, human escalation, impact assessment, communication, remediation and learning for AI-related incidents. Evidence: tested AI incident procedure.
- AITS-8.3
Change control
The organization shall reassess risk and repeat relevant evaluation when models, data, prompts, tools, providers or intended use materially change. Evidence: change record and regression evidence.
- AITS-8.4
Vendor management
The organization shall maintain responsibilities, service limits, evidence access, incident notification and exit arrangements for third-party AI dependencies. Evidence: contract-control and exit register.
- AITS-9.1
Safe retirement
The organization shall disable access and automated actions, preserve required evidence, handle retained data and communicate replacement or withdrawal when an AI system retires. Evidence: approved retirement and completion record.
Required evidence
Evidence must support the claim being assessed.
An applicant should provide the smallest sufficient evidence set rather than an uncontrolled data dump. Records should show who made a decision, what boundary and version it concerned, what result was observed and how exceptions were handled. Sensitive technical, employee or customer material remains protected and is not published merely because it supports assessment.
- AI system and use-case inventory
- Prohibited-use and risk-classification records
- Data provenance and handling assessment
- Provider and contract due diligence
- Evaluation datasets, thresholds and results
- Human-oversight and appeal procedures
- Transparency notices and user evidence
- Prompt, tool and access security tests
- Monitoring, incident and complaint records
- Change-control and retirement evidence
Assessment and certification
Certification is a controlled decision, not an automatic badge.
The programme confirms the applicant and scope, reviews submitted evidence, performs a technical assessment and records findings. The applicant responds to nonconformities with cause, correction and evidence of effective action. A certification decision is separated from evidence preparation as far as the programme's current operating model permits. Surveillance and renewal consider continuing control operation and material change.
Conformance levels
The declared scope has accountable ownership, a documented baseline and an implementation plan. Foundation is a readiness state, not certification.
Required controls and evidence have been reviewed against the selected standard, with identified nonconformities recorded and corrective actions accepted.
A formal conformance decision has been issued through the EC TECH programme after scope confirmation, evidence review, technical assessment and closure of blocking nonconformities. Certification is neither automatic nor external accreditation.
Nonconformity levels
A condition that does not presently breach a mandatory requirement but could weaken consistency, evidence quality or future conformance if left unattended.
A contained failure to meet a requirement where the control system remains substantially effective. Closure requires proportionate correction and evidence accepted by the programme.
A missing, systemic or materially ineffective control, or a condition that creates unacceptable risk for the declared scope. Certification cannot be granted or maintained until satisfactory corrective action is verified.
Relationship to established frameworks
AITS uses informed alignment without false equivalence.
These references help applicants deepen controls or compare terminology. “Informed by” means a source influenced the requirement design; “maps to” means a documented relationship can be shown; “aligned with” indicates compatible outcomes. None of those phrases means “certified to”. An external framework or law retains its own scope, text, assessment route and authority.
ISO/IEC 42001:2023
Its AI management-system approach informs organizational governance and continual improvement. AITS certification is not ISO/IEC 42001 certification.
NIST AI RMF 1.0
Its Govern, Map, Measure and Manage functions inform AITS risk ownership, context analysis, evaluation and treatment.
OECD AI Principles
Their emphasis on human-centred values, transparency, robustness, security and accountability informs AITS policy outcomes.
EU AI Act
Its risk-based structure is relevant when an applicant develops or deploys AI in the European Union. AITS does not provide a legal presumption of conformity.
NIST SSDF
Its secure software lifecycle practices inform engineering controls for AI components, orchestration and supply chains.
Implementation pathway
A practical 30/60/90-day adoption sequence.
The sequence is a planning aid, not a promised certification timetable. Complexity, evidence maturity, third-party access and corrective work determine the real path. Teams should prioritize material risk and sustainable operation rather than creating documents that exist only for assessment day.
First 30 days — know the AI estate
- Inventory systems, providers and accountable owners
- Stop or isolate prohibited and unowned uses
- Classify material use cases
- Define evaluation and oversight criteria
Days 31–60 — test and control
- Document data and provider decisions
- Run accuracy, fairness and security evaluations
- Implement notices, access and human intervention
- Create monitoring and incident routes
Days 61–90 — prove governance
- Collect operating evidence
- Exercise escalation and change controls
- Resolve material nonconformities
- Submit a bounded scope for assessment
Benefits
What disciplined adoption can improve.
- A common governance language for business, legal and technical teams
- More defensible AI approval and procurement decisions
- Clearer human oversight and transparency
- Repeatable quality and security evaluation
- Lifecycle control when providers or capabilities change
Limitations
What certification does not prove.
- AITS does not replace jurisdiction-specific legal advice or regulatory assessment
- Testing cannot prove an AI system will never fail, discriminate or be misused
- Results remain valid only for the declared system, version, data and context
- AITS is independent EC TECH certification, not external accreditation
Versioning and change control
Current version: AITS 26002:2026.
This page represents the current published 2026 version. Proposed changes are evaluated for need, clarity, measurable effect, compatibility and transition impact. A future revision will identify material changes and whether previously assessed scopes need additional evidence. Editorial clarification does not silently weaken a mandatory requirement, and an applicant cannot select an obsolete clause solely to avoid a current control.
Last reviewed: 6 September 2026. Public revision history will be linked when a subsequent revision exists; no empty or fictional history is presented.
AITS questions and direct answers
AITS is the Artificial Intelligence Trust Standard, an independent international AI trust standard developed by Eric Chuar Technologies for accountable AI governance and technical assurance.
Assessment enquiry
Request a standards scoping conversation.
Select the standard you want to discuss. This step carries only the selected standard into EC TECH’s existing contact route; do not include passwords, production data or private audit evidence in a public enquiry.
Primary references
Sources reviewed for technical accuracy.
References are linked for comparison and implementation depth. Their inclusion does not imply endorsement, adoption, accreditation or certification of AITS by the referenced organization.
- ISO/IEC 42001:2023 AI management systems
- NIST AI Risk Management Framework
- OECD AI Principles
- European Commission AI Act overview
- NIST Secure Software Development Framework
Last reviewed: 6 September 2026.