Common-Specification Equivalency Assessment

Document equivalent technical solutions when an applicable AI common specification is not followed.

Where an applicable common specification exists and a provider of high-risk AI or a GPAI model uses another approach, document the basis for equivalent compliance. Identify exactly which requirements or obligations the specification covers. Compare the adopted technical solutions with those requirements and retain the evidence and competent review supporting at least an equivalent level. Reassess when the specification, system or model changes. Do not treat a general framework mapping or an unrelated certificate as evidence of equivalence.

When selecting an alternative to an applicable common specification; on relevant source, system or model changes.

Applicable common-specification and scope record Requirement-by-requirement comparison Technical justification and supporting tests Review decision and unresolved gaps Change and reassessment history

Select an alternative technical solution and test whether its justification addresses the actual covered requirement. Check that evidence supports the claimed level of protection or compliance and remains current.