Austin, Texas, USA, November 10th / PRNewswire / -- Responsible AI Institute ( RAI ) has launched TrustX Assurance Lab, which is an independent, vendor-neutral environment designed to address a key issue faced by companies when deploying autonomous AI: how can one prove that it will operate within authorized boundaries before allowing AI agents to enter the production environment?

As the AI system evolves from generating suggestions to making decisions, invoking tools, and taking action, what enterprises need is not only written policies and model evaluations but also evidence to prove that security controls, authorized permission limits, manual approvals, and upgrade mechanisms are indeed effective.

TrustX Assurance Lab is the foundation for the work of RAI AI and assurance, covering AI discovery, benchmark testing, and independent verification. This laboratory provides a structured approach for classifying AI workloads, testing their control measures under real and adversarial conditions, and independently verifying the relevant evidence. The laboratory conducted a live demonstration on RAISE in October 2026, marking an important step towards making responsible AI measurable and provable.

Vice Chairman Matt Sanchez stated: "For many years, the industry has been focused on defining what a responsible AI should be like. Now we must prove that it is truly effective."

"Autonomous AI cannot be trusted just because a policy claims it is secure. Its control measures must stand up to testing, and the evidence must be able to be independently verified. That's why we created TrustX Assurance Lab."

From AI policies to independent guarantees

The focus of the first phase of being responsible AI is to establish principles, frameworks, and standards. As AI becomes increasingly autonomous, the next challenge is to ensure that these requirements can be transformed into truly effective control measures when taking action in AI.

TrustX Assurance Lab addresses this challenge through six stages:

• Identify: Define the workload of AI, its purpose, capabilities, and operating environment.
• Classify risks based on autonomy, decision-making authority, system coverage, persistence, and potential impact.
• Control: Determine the required safeguard measures and establish the methods for their implementation and enforcement.
• Test: Verify workloads and their control measures under real, fault, and adversarial scenarios.
• Verification: Independently assess the test results and runtime evidence against established requirements.
• Improvement: Identify weak links, propose corrective measures, and support retesting as the system evolves.

This process will generate evidence that companies can use for deployment approval, security reviews, internal assurance, regulatory inspections, and ongoing supervision.

The laboratory is established on the basis of the TrustX Health and TrustX Finance working groups of RAI. These working groups bring together members from organizations and experts in various fields to develop practical control requirements and evidence expectations for regulated industries.

RAISE What attendees see: AI How control operates

On RAISE 2026, RAI demonstrated how an autonomous AI workload can go from initial risk classification to an independent assessment of its behavior through TrustX Assurance Lab.

The demonstration focused on testing three key issues: What is allowed to be done by the AI system? What happens when it attempts to perform actions that go beyond these boundaries? Can enterprises provide reliable evidence of what occurred?

During the on-site demonstration, RAI evaluated a business agent built by an employee through TrustX Assurance Lab.

• Single Instruction Evaluation: Based solely on the metadata of the proxy, the laboratory classifies the workload into 12 risk dimensions and assigns a risk level. Clarification questions are only raised when the metadata is incomplete.
• Runtime Decision-Making: In the proof-of-concept integration with OWASP Agent Control Standard, the proxy triggers a hook at each step, returning a decision of allow, deny, or ask for confirmation. The "ask for confirmation" option will defer the action to manual approval.
• Verifiable evidence: A signed telemetry record is generated at each step. The verifier checks for integrity and replays these decisions, then compares the agent's self-reported risks with the observed behavior to generate posture tags and an evidence report. Nowadays, 8 out of 12 risk dimensions can be observed at runtime.
• Embed existing tools: Since most AI builders are already working with tools they are accustomed to using, RAI also demonstrates how the same evaluation can function as a Microsoft Copilot plugin and a Claude skill.

This demonstration illustrates a fundamental difference: having the AI policy is not the same as proving that the control measures to implement these policies are functioning as expected.

Unlike traditional evaluations that rely primarily on documentation or self-declarations, Assurance Lab assesses observable system behavior and technical evidence under established test conditions.

The laboratory is currently operating on synthetic data and member use cases, with plans to conduct tests in a member environment in 2027.

Open and multi-party cooperative AI guarantee path

TrustX Assurance Lab integrates open standards, independent research, corporate practices, and runtime control technologies.

• Open Standards: RAI is participating in the OWASP Agent Control Standard (ACS) working group and demonstrated a proof of concept for ACS integration in RAISE in 2026. This laboratory provides an environment for evaluating the performance of runtime controls that are consistent with ACS in the face of enterprise requirements and real-world proxy behaviors.
• Independent research: Researchers from the University of Cambridge and Imperial College London contributed their expertise in control architecture, evaluation methods, and measurement techniques to enhance the rigor of technical testing.
• Enterprise Practices: RAI member organizations and industry working groups provide use cases, control requirements, and evidence expectations inspired by real-world environments.
• Runtime Technology: Runtime control technology transforms corporate policies into executable decisions, allowing for the permission, prevention, or escalation of proxy actions, while also recording supporting evidence.
• Open AI infrastructure: This laboratory utilizes models and supporting technologies that can be obtained through NVIDIA and Hugging Face, in order to conduct repeatable tests across different AI architectures and implementations.

RAI defines independent assurance requirements and evaluates evidence; technical providers, on the other hand, demonstrate and implement control measures that are currently being tested. Enterprises remain responsible for their own production systems, operational controls, and deployment decisions.

The laboratory aims to remain supplier-neutral and is open to other technology providers, as long as their implementations can be evaluated in accordance with the requirements published by the laboratory.

Enterprise Member Expansion

As RAI corporate members expand to NatWest, FactSet, and Wellington Management, the launch of Assurance Lab also reflects an increasing interest among financial institutions and information providers in practical methods for managing and independently verifying increasingly autonomous AI.

Through the RAI membership, organizations can participate in industry working groups, contribute to shared responsible AI practices, access TrustX assessment resources, and engage in initiatives that promote evidence-based AI guarantees.

Assurance Lab further expands on these activities by providing a practical environment that allows for testing of control requirements against actual AI behaviors.

The founding team's first batch of members are currently being assembled.

RAI is currently selecting a limited number of first batch enterprises to participate in TrustX Assurance Lab.

Participating organizations will have the opportunity to assess the selected AI workload, identify control requirements, test runtime behavior, and develop evidence packages to support internal assurance and independent verification.

The first batch of members will also help to shape the testing methods, industry-specific requirements, and the future capabilities of the laboratory.

Enterprises interested in participating can visit www.responsible.ai / trustx to express their interest.

About Responsible AI Institute

Responsible AI Institute ( RAI ) is an independent, supplier-neutral 501(c)(3) non-profit organization and also a responsible AI “do tank”. The organization was established in 2016 and is committed to realizing a credible future of human–AI partnership, where organizations, governments, and individuals can rely on AI systems and agents because their actions can be proven, not just promised.

RAI promotes this vision through three main pillars: by means of the educational program “Build Capability”, to help individuals and organizations use AI responsibly; through TrustX and assurance “Prove Trust”, which includes AI for discovery, benchmarking, and independent verification; as well as through industry working groups and open frameworks developed in collaboration with members, researchers, and policymakers, namely “Shape the Standard”. RAI publishes a large portion of its work in open-source format.

For more information: www.responsible.ai.

Media Contact

Responsible AI Institute