STALE: OUR MEASUREMENT

Our published benchmark result was measured with v0.41.2, 5 releases ago, past this project's own 2-release window, and the newest real-model measurement, dated 2026-09-18, is past this project's own 7-day window. That is our own number, not your assessment, which runs against your policy on the current release. Why, and what unblocks it

STALE: REGULATORY CLOCK

The regulatory entries on this page were last checked against their primary sources on — 34 days before this build’s anchor of , past this project’s own 30-day window. Every date here was true when it was read and has not been re-read since. Verify against the primary source before relying on it. The clock, with every source

ProvaelGitHub, star the repositoryQuickstart
NIST AI 100-1 · Generative AI Profile (NIST AI 600-1)

NIST AI RMF

The NIST AI Risk Management Framework is a voluntary structure for identifying and managing AI risk across four functions: Govern, Map, Measure and Manage. Provael’s evidence is aimed at Measure and Manage: an attack-success rate with its interval and a benign control, and a CI gate that acts on it. The product counts Measure as met only under a calibrated predicate.

Timing A voluntary framework, not a dated obligation.

From the regulatory clock

At a glance

Read from the site’s regulatory clock, the record that is re-verified against primary law, as of 19 September 2026.

Instrument
NIST AI 100-1 · Generative AI Profile (NIST AI 600-1) — Voluntary standard or framework — referenced, not a legal duty
Applies?
No fixed applicable date - there is nothing to count down to.
Responsible actor
The organisation operating the AI system.
What Provael measures toward it
A measured ASR with a CI and a benign control as the Measure-function evidence; a CI red-team gate for the Manage function.
What that does not establish
The AI RMF is not certifiable; Provael provides evidence, not conformity.
Source and review
Primary source · verified 19 September 2026
Use it for

What a Provael report can be used for

Measure 2.7

The AI RMF subcategory “AI system security and resilience - as identified in the MAP function - are evaluated and documented” is where this evidence fits: Provael offers the measured ASR, its 95% CI and the benign-FPR control as the evaluation, and the SARIF + signed attestation bundle as the documentation.

Measure

Quantify AI risks and trustworthiness characteristics with repeatable, documented methods - an ASR with a CI and a benign control fits, once its predicate is calibrated.

Manage

Prioritise and act on measured risks; a CI red-team gate operationalises the Manage function in the development loop.

The evidence

  • Measure: an attack-success rate with a benign control and confidence interval, tracked over time.
  • Manage: a CI gate that acts on the measurement and blocks regressions.
  • Documentation and reproducible traces supporting the Govern function’s evidence trail.
Limits

What it cannot be used for

A mapping identifies possible relevance. It does not establish that this framework applies to your product, that anything here is compliance, that an assessor or insurer will accept it, or a real-world risk probability. Whether it applies to your product depends on your role, market and product class: a question for your counsel, not a determination this page makes.

  • The product’s own catalogue counts the Measure mapping as met only under a calibrated predicate, and as a gap under the default one. The published result uses the default, uncalibrated predicate, so for Measure it is a gap until a calibrated run exists.
  • Simulation evidence for the tested checkpoint and protocol. Physical safety and conformity require separate assessment.
  • Provael measures adversarial robustness - susceptibility to manipulation - not general accuracy, reliability, or functional safety.
  • The measured result uses templated, auditable attacks; the search-based families (optimized, universal_patch, gradient_patch) have no real-policy rate. Results are a floor on susceptibility - a behavioural lower bound, not a certified worst-case bound.
Evidence, not certification

Running Provael does not make a system compliant or certified - it generates measurements you can put into a conformity or assurance file. Provael is not a notified body, a lab, or a certification scheme.

Independent project. Not affiliated with or endorsed by ISO, the EU, NIST, IEC, OWASP, or MITRE. Not legal advice.

Clause references are indicative: check each against the text you hold before you cite it.

What it is

The framework

  • NIST AI 100-1 defines the core AI RMF; the Generative AI Profile (NIST AI 600-1) extends it.
  • The Measure function is about analysing, assessing and tracking AI risks with repeatable metrics.
  • NIST AI 100-2e2025 provides the adversarial-ML taxonomy Provael names its attacks against (privacy attacks map to NISTAML.03).
Timing

Dates (verified 19 September 2026)

AI RMF 1.0 released
January 2023
Generative AI Profile
July 2024

Check the live EUR-Lex or ISO text before relying on a date.

Sources

Primary references

Sample SARIF ↓All frameworks

See what a report contains.

The sample report comes from a public run and is published in full, nothing redacted. To have this mapping filled in for your own policy, request a scoping call.

See the sample reportRequest a scoping call