About

A policy, a confident presentation, or a successful demonstration can tell a board something useful. Each still needs evidence behind it. The Assurance Line gives directors and executives a way to ask for that evidence and understand how far it supports the decisions they have to make.

Built from a practical need

Daniel Johns initially wrote the framework for his own use while leading NIMIS Intelligence, a company building autonomous AI systems for security testing. Working in both board and executive roles, he needed a method he could hold his own company to and use to answer questions from directors and investors.

What was the system allowed to do? Who was accountable for its decisions? What evidence showed it was working as intended? What happened when it failed? Those questions became a line of inquiry, written to apply across AI systems and to be understood by the people responsible for the decision.

From one company to any board

Advisory work brings experience to an organization, but it reaches one client at a time. Publishing the framework makes that method available to boards and executives who want to apply it themselves.

The free resources introduce the eight domains and show the method through a complete worked example. The Board Edition provides the questions and follow-ups for oversight discussions. The Professional Edition adds the detailed requirements, evidence, and tools for the people who assess and implement AI governance.

A method that follows the evidence

The framework starts with what AI the organization uses, then follows eight questions in sequence through to what happens when a system fails. Each question rests on the answers before it. If an organization cannot identify its AI systems, for example, a board cannot establish whether responsibility has been assigned for all of them.

Each requirement identifies evidence that can be examined. The method helps a board see which claims are supported, where evidence is incomplete, and where its assurance stops. It also gives management a structure for preparing the answers and the work behind them.

The framework maps its requirements to the National Institute of Standards and Technology (NIST) AI Risk Management Framework, ISO/IEC 42001, and the European Union AI Act. It is versioned, with dated citations and a recorded change history, so a board paper can be traced to the version it relied on. Those mappings support the method; using it does not itself establish compliance or certification.

Created by Daniel Johns

Daniel brings more than 20 years of experience in cybersecurity, engineering, and assurance. His background includes the Australian Signals Directorate, formal assurance work at BAE Systems, and security architecture and technology risk across finance, healthcare, transport, and critical infrastructure.

Building autonomous AI systems at NIMIS Intelligence brought that experience into the practical questions of AI governance. The Assurance Line applies those disciplines to the questions boards and executives face.

View Daniel’s background on LinkedIn.