AI Assurance Services Your Auditor Can Verify

AI Governance and Compliance Services, Ready for Your Auditor

AI Governance and Compliance Services for Auditors

AI governance and compliance services, also called AI assurance services, are the testing and documentation work that proves an AI system does what its owner claims. From Dhaka, Eicra Soft Limited delivers that work for international companies: model testing, code audit, EU AI Act documentation, risk and traceability records, oversight of payroll, accounts payable (AP) and employer of record (EOR) work, and incident logs. Each one ends in a document an auditor, a customer or a regulator can read.

Book a 30-minute scoping call See the six services

2 weeksDocumentation diagnostic, $1,500, half credited to the pilot

4 weeksOne AI system’s pack, $4,000 fixed, signed by your owner

EvidenceDated test sets, logs and named sign-offs, not a deck of assurances

YoursEvery pack handed over as editable files your own team owns

Tested in your own repositories, model endpoints and ticketing · Confidentiality and data processing agreements signed before any data moves · Overlap hours agreed at kickoff

Which AI Governance Services Do We Offer?

Our AI governance and compliance services are six separate engagements within our AI services range, each with its own scope and price. Testing and audit produce the evidence, and the documentation services turn it into the records a reviewer asks for. Oversight and incident work keep the record true after go-live, when models, prompts and data start to change in production.

AI Model Testing Services

A structured evaluation set built from your cases, accuracy, precision, recall, hallucination and bias checks, red-team prompts and a written result report you can show a reviewer.

AI Generated Code Audit

A review of AI-written source code for security holes, licence risk, dead paths and untested logic, with a prioritised fix list and the re-test results.

EU AI Act Documentation

Technical documentation, risk management records, post-market monitoring plans and human-oversight descriptions mapped to the articles that apply to your system and its role.

Risk and Traceability Documentation

Risk register, model cards, data lineage, decision logs and an audit trail of sign-offs, written so a reviewer can follow every step from data to decision.

AI Oversight for Payroll, AP and EOR

Human-in-the-loop reviewers with payroll and finance experience check AI output on payslips, invoices and contracts against your rules, and record every exception. Testing shows how a model behaves; human-in-the-loop review records who approved each live decision.

Error and Incident Documentation

Incident templates, severity and escalation rules, root-cause write-ups and a register you can hand to a customer or insurer after a failure.

How Do Tests Become Auditor-Ready Records?

AI governance and compliance services turn a test into a record in one order. Your system is measured on your own cases first, the risk and documentation files are written from those results, and a named owner signs them. Every run is then kept dated, so a reviewer can repeat it.

From a test result to a record a reviewer can check

01MeasureA test set built from your own cases, scored for accuracy, precision and recall; AI-written code audited and re-testedAI Model Testing ServicesAI Generated Code Audit300 past decisions
02DocumentRisk register, model cards and data lineage, plus EU AI Act files mapped article by articleRisk and Traceability DocumentationEU AI Act Documentationerror rate, date, owner
03SignA named owner signs each record; what was not tested and what stays open are written down
04Keep datedRun dates, scripts and a change log, so the same test runs again after the next model upgradere-run six months later
05ReviewerAn auditor, a customer’s security team, counsel or a regulator reads the file

After go-live: AI Oversight for Payroll, AP and EOR checks pay, invoice and contract output, and Error and Incident Documentation records each failure; both feed the risk register again.

Each test can be repeated by your own team: you keep the test set, the scripts and the change log.

How to read it: every record on the right rests on a measured result on the left, and yellow marks the signature that turns a draft into a record. The figures follow the illustrative hiring screen in the rules below.

Which AI Compliance Service Do I Need?

The AI governance and compliance service you need depends on who is asking. An engineer needs testing or a code audit; a customer’s security team needs risk and governance documentation; counsel or a regulator needs EU AI Act documentation; and an incident needs a written record. Payroll and finance teams need trained reviewers on the output itself.

Find your situation on the left, then read across
Your situation	What you need	Where we start
You cannot say how accurate the model actually is	AI Model Testing Services	Test set built from your own cases and scored
AI wrote large parts of the codebase	AI Generated Code Audit	Repository scan, a fix list and a re-test
Your system falls under an Annex III use case	EU AI Act Documentation	Classification check against the Act, with your counsel
A customer’s due-diligence form asks about AI	Risk and Traceability Documentation	Gap review of what you already hold, document by document
AI touches payslips, invoices or contracts	AI Oversight for Payroll, AP and EOR	Calibration sample on your real payroll or invoice output
Something went wrong and nobody recorded it	Error and Incident Documentation	Incident register, severity rules and a first write-up

Which AI Assurance Service Suits You?

The fit check asks five questions about your AI system and who is asking about it. Read across your answer and note the service named; the one that appears most often is where to start. If testing appears twice or more, start there, because every document, from the risk register to the technical file, rests on measured evidence.

Answer each question, then count which service appears most
Question	Option A	Option B	Option C
1. Can you state your model’s accuracy today?	Yes, measured on a held-out set → EU AI Act Documentation	Only the vendor’s benchmark → AI Model Testing Services	No number at all → AI Model Testing Services
2. How much of the codebase did AI write?	A little, fully reviewed → AI Model Testing Services	A lot, reviewed quickly → AI Generated Code Audit	Nobody has counted → AI Generated Code Audit
3. Who has asked you about AI risk?	Nobody yet → Risk and Traceability	A customer or insurer → Risk and Traceability	Counsel or a regulator → EU AI Act Documentation
4. Does AI touch pay, invoices or contracts?	No, internal drafts only → AI Model Testing Services	Yes, with a human check → AI Oversight for Payroll, AP and EOR	Yes, unchecked → AI Oversight for Payroll, AP and EOR
5. What happens when AI output is wrong?	Logged with a root cause → EU AI Act Documentation	Fixed quietly in a chat thread → Error and Incident Documentation	Nobody records it → Error and Incident Documentation

Six possible outcomes: AI Model Testing Services · AI Generated Code Audit · EU AI Act Documentation · Risk and Traceability Documentation · AI Oversight for Payroll, AP and EOR · Error and Incident Documentation. If two services tie, start with testing — documentation without measured evidence is a claim, not a record. Testing first also shows which documents you will not need.

How Does AI Assurance Work, and in What Order?

AI assurance work runs in one order: measure, then document, then keep the evidence dated. Data governance sits underneath all three. Each rule below is applied in that order, and we say so when the cheaper step is the one you need. Skipping a step means paying for it twice, once to write it and once to rewrite it.

Measure First, Then Write It Down

A risk register written before anything was tested records opinions, not facts. The first question a reviewer asks is how you know, and a policy document cannot answer it.

So testing comes first: a test set from your own cases, written guardrails, a recorded result and a date. The documents are then descriptions of something real.

Write for the Person Who Will Challenge It

Assurance documents are not marketing. The reader is an auditor, a customer’s security team or your own counsel, and each of them is looking for the gap you did not mention.

So we state limits plainly: what was tested, what was not, what remains open and who owns it. A stated gap survives review; a hidden one does not. It also costs more when a customer finds it.

Keep Evidence Dated and Reproducible

Evidence that cannot be repeated is an anecdote. Models change, prompts change and data drift sets in, so a result without a date and a method is worth very little six months later.

You receive the test set, the scripts, the run dates and a change log. Your team can then repeat the same test after the next model upgrade and compare the two results line by line.

What a deadline does not change: the work behind a conformity file does not shrink when a date moves. Article 9 of the EU AI Act requires that “a risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems”, and that record needs test evidence that takes months to build. Illustrative example: a hiring screen tested on 300 past decisions gives the risk register a measured error rate, a date and an owner before any policy is written. Six months later the same 300 decisions are re-run, and the change log shows whether the error rate moved.

Why Choose Us for AI Governance and Compliance?

AI governance and compliance work is judged by the first reviewer who challenges it, so every record we write starts from measured evidence. Our files follow the EU AI Act article by article and map risks, including bias and drift, to the National Institute of Standards and Technology (NIST) AI Risk Management Framework (NIST, 2023), and we write the control descriptions in the form an ISO/IEC 42001 management-system review expects.

What a typical AI compliance effort leaves out, and what we include
Item	Without	With EICRA
Model accuracy	“We use a leading model”	Measured on a held-out test set built from your own cases, with precision and recall
Bias and safety	Assumed handled by the vendor	Tested against written guardrails with documented prompts and a recorded pass or fail
AI-written code	Merged because it runs	Audited for security, licence and untested paths, with a fix list and a re-test
EU AI Act	A blog post and a hope	Documentation mapped article by article to your system’s role; legal positions stay with your counsel
Traceability	Screenshots in a chat thread	Dated records, model cards, data lineage, an audit log and named sign-offs
Payroll and finance output	Spot-checked when someone remembers	Human reviewers on a written rubric, every exception logged with its cause and fix
Incidents	Fixed quietly, never recorded	Severity and escalation rules, a root-cause write-up and a register you can share
Contracts	A freelancer invoice	Company contract with General Data Protection Regulation (GDPR) Article 28(3) processor terms where they apply

AI Governance and Compliance FAQs

Pricing opens the list; timing, data handling, switching provider and what assurance cannot prove follow.

How Much Do These Services Cost?

Each service has a fixed price agreed in writing after a free 30-minute scoping call. For documentation, the two-week diagnostic and the four-week pilot pack carry the prices shown at the top of this page; testing, code audits and oversight are scoped the same way, with every deliverable and its acceptance check listed before you approve anything.

What Do AI Governance Services Include?

AI governance and compliance services give an organisation the evidence and records that show its AI is controlled: tested models, audited code, a risk register, policies, data governance records, documentation mapped to laws such as the EU AI Act, and traceability records for oversight and incidents. They turn good intentions into dated files a reviewer can check and repeat.

How Long Does AI Assurance Work Take?

Two weeks for the documentation diagnostic and four weeks for one AI system’s pack, as the top of this page shows; testing and code audits are scoped in the same free call. Most time goes into collecting records, so we list every repository, model endpoint, owner and approval we need at kickoff.

Is Testing the Same as an AI Audit?

No. Testing measures how a model behaves on a defined set of cases and produces a result with a date and a method. An audit reviews whether the records, controls and sign-offs around that model hold up for a third party. We do the first with AI model testing and prepare the second through documentation; a formal audit opinion stays with an accredited auditor.

How Do You Handle Our Data During Testing?

Under a non-disclosure agreement (NDA) and a data processing agreement (DPA), signed first. As a Bangladesh-based team we use least-privilege named access that is removed at handover, prefer synthetic or masked test records to personal data, and write the retention policy and deletion date into the contract.

How Is EU Data Transferred to Dhaka Lawfully?

Through the transfer mechanism written into the DPA. Bangladesh has no EU adequacy decision, so where personal data must leave the EU at all, the DPA carries the European Commission’s standard contractual clauses and the transfer safeguards your counsel asks for. Where the work allows, we avoid the transfer entirely by testing on synthetic or masked records, or by working inside your own environment under named access.

What Happens After I Send an Enquiry?

You send one AI system and the question your auditor, customer or counsel asked.
We reply with the records that question needs and the test that comes first.
A free 30-minute scoping call fixes the deliverables, the acceptance check and the price in writing.
NDA and DPA are signed before any repository, endpoint or record is shared.
Work starts on the agreed date with a named owner on each side.

Can You Take Over Files From Another Vendor?

Yes, after a gap review. We read what you already hold, document by document, mark what is dated, sourced and signed, and list what is missing or contradicts the live system. Records that pass are kept and referenced; only the gaps are rewritten, so you do not pay twice for the same file.

What Can AI Assurance Not Prove?

A test set is only as good as the cases you give us. If the sample is small, stale or unrepresentative of production, the result is a measured fact about that sample, not a guarantee about every future input. We state the sample, its date and its limits in every report, and where the underlying records are inconsistent we point you to data quality and cleansing work before testing starts.

Reviewed by Asma Sultana Minu, Local Corporate Counsel. Last reviewed 7 October 2026. Informational only, not legal advice.

Send us one AI system and the question your auditor asked. We will tell you which records are missing and which test comes first.

Book a 30-minute scoping call