{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:e542a1851c8c176ba2d527bcdd1e574e8c9b9b5ee51fbbb9ca5a86307c7b2d84","slug":"controls-quarterly-third-party-ai-evaluation-cycle","url":"/assets/agent_workflow-controls-quarterly-third-party-ai-evaluation-cycle-e6e3fafe.5ffceb3dfee086e7.json"},"kind":"record","record":{"attributes":{"department":"ai-governance","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-quarterly-third-party-ai-evaluation-cycle","description":"Each quarterly instance runs against the existing Control item for independent third-party AI evaluation (framework aiuc-1 + iso-42001 + eu-ai-act; domains ai_governance; frequency quarterly; control_owner AI Product Lead) — the run enriches that Control's execution history and is its evidence of operation, it never creates a duplicate Control; the one record it does create is a per-quarter Audit item (audit_type: it_audit) for the evaluator engagement. The decision-aware cycle confirms the quarter's in-scope systems and risk taxonomy, engages an independent evaluator with the test plan, categories, and pass thresholds fixed in advance, provisions contained test access, triages every finding by category and severity against the tested control, routes failed thresholds through remediation and evaluator retest, gates acceptance of the evaluator report, publishes the accepted evidence (trust-portal summary, customer-facing attestation, evidence register), and tunes guardrails from the findings. In scope: every in-scope AI system and agent under the AIUC-1 program and its six mandatory third-party test categories (B001 adversarial robustness, C010 harmful outputs, C011 out-of-scope outputs, C012 agent-specific risk, D002 hallucinations, D004 tool calls). Out of scope: internal red-teaming, pre-release model evaluation, and vendor AI due diligence, which run in their own workflows. It hands off only to the next quarterly run of itself, seeding it with the open carry-forward finding Issues that the publish-evidence-and-tune-guardrails step links to the anchor Control.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-quarterly-third-party-ai-evaluation-cycle","capabilities":[],"controls":["UC-AI-21","UC-AI-18","UC-AI-20","UC-AI-19"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:e542a1851c8c176ba2d527bcdd1e574e8c9b9b5ee51fbbb9ca5a86307c7b2d84","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-quarterly-third-party-ai-evaluation-cycle","standards":["nist-ai-tevv-athlon","aiuc-1","iso-42001","eu-ai-act"],"teams":["ai-governance","procurement"]},"id":"wf:C67","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC67","slug":"controls-quarterly-third-party-ai-evaluation-cycle","sourceIds":["aiuc-1","nist-ai-agent-identity","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"Quarterly Third-Party AI Evaluation Cycle","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a3d47be993481d1b17b86ce4d5f82bf4724655d6804992f80fcfb94036fb8e7","properties":{},"sourceDetailPath":"/data/v1/records/wf-c67-2d6bb2c2.json","sourceId":"wf:C67","targetDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","targetId":"uc:UC-AI-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:80e9af26c29453059d89e2aba17000c854a1989c3ce1528c70e9d7bc1db36e64","properties":{},"sourceDetailPath":"/data/v1/records/wf-c67-2d6bb2c2.json","sourceId":"wf:C67","targetDetailPath":"/data/v1/records/uc-uc-ai-18-f15ac93a.json","targetId":"uc:UC-AI-18","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b798358969420b3f109b3ffaa3cce3f890eb7e7ba87673c9c66c2fd5e2387db9","properties":{},"sourceDetailPath":"/data/v1/records/wf-c67-2d6bb2c2.json","sourceId":"wf:C67","targetDetailPath":"/data/v1/records/uc-uc-ai-20-c0e507ce.json","targetId":"uc:UC-AI-20","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f1b4a8472bf97ad9143ae40e4686cb83c55566975085fcda5dc8864209f8d27a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c67-2d6bb2c2.json","sourceId":"wf:C67","targetDetailPath":"/data/v1/records/uc-uc-ai-19-535f3660.json","targetId":"uc:UC-AI-19","type":"tests"}],"schemaVersion":1}