01
Accurate classification
EU high-risk follows Article 6 and Annex I/III. Profiling removes the 6(3) exception. SR 11-7 applies to models at supervised US banks, not every LLM.
For 2LoD risk, 3LoD IT audit, and model-risk officers
Scope the system. Extract the real requirements. Walk the engineers through evidence.
ABF is a professional workbench for AI audits. Answer questions about intended purpose, role, and architecture. The engine returns official identifiers from NIST AI RMF 1.0, the EU AI Act, ISO/IEC 42001 (titles), SR 11-7, OWASP LLM Top 10 2025, and NIST AI 600-1 — each with a citation, source URL, evidence to request, and interview script. It does not invent “ABF-CTL” controls, and it will not label a chatbot high-risk merely because it handles personal data.
ABF is an audit-support tool, not legal advice, a notified-body opinion, or an ISO certification
decision. Screening conclusions are labelled indicative and cite the rule applied.
ISO/IEC 42001 “shall” statements are copyrighted and are not reproduced; titles only.
02
Official IDs, not folklore
GOVERN 1.1, Article 14, A.8.4 (communication of incidents — not “system protection”). Every row has a URL you can open during fieldwork.
03
Walkthroughs that engineers can answer
Procedures tell you whom to sit with, what to ask, what to watch in a live demo, and what to file as evidence — labelled as ABF workpapers.
Engagement record
These fields header the workpaper. Nothing here classifies the system.