Recognised, not repeated — version 2.3 from PARTNER-A
← back to the version · Partner A national AI assurance authority · Illustrative recognition arrangement, Annex B
PARTNER-A has already accredited this model. Where their framework and ours agree, their approval is reusedReusing an allied partner's accreditation for the parts their framework and ours agree on, instead of repeating that work. instead of the work being done twice — 38 of 92 items here. Everything else is still reviewed here, and nothing is reused until somebody here signs for relying on it, under Relying on it below.
38
reused from PARTNER-AReusing an allied partner's accreditation for the parts their framework and ours agree on, instead of repeating that work.
54
reviewed hereItems their framework does not cover, or whose evidence did not reach us. These are reviewed here, in full.
59%
reviewed here, of 92
13.5h
instead of 23h from scratchAn assumption: how long a reviewer spends on each item. The item counts are measured; this rate is yours to change. Currently 15 minutes per item.
Hours are the item counts, which are measured, times 15 minutes per item, which is an assumption — the same as on the “what changed” screen. Change it above.
What they sent us
| Allied partner package | PA-CVC-0042 2.3 |
| Their decision | accredited on 2026-08-23 by Partner A accrediting authority (delegated) — valid to 2028-08-23 |
| Their rule set | Partner A national AI assurance criteria (illustrative) |
| Their seal | pa-seal:9f2c41d0e8…pa-seal:9f2c41d0e8b7a6c50000000000000000 not verifiedMade with their key, which we do not hold, so we cannot check it. We record it, and never claim to have checked it. |
| Received | 2026-10-22 from Allied partner liaisonpartner.liaison@coe.ic.gov · 31 documents |
| Fingerprint of what they sentA short code computed from a file's exact contents. Change a single character and the code changes completely. | cbbafa310f48824d…cbbafa310f48824dac6a10853c78c8fb0157a1d0999dae67f088e9045321ef02 |
Their signature is made with a key we do not have, so we store it and never claim to have checked it. What this record does prove is exactly what they sent us — that fingerprint above — and exactly what our own official relied on. That is a real guarantee, and a smaller one than “we verified their approval”.
What they could not send us
| Document | MarkingWho this document may be shared with. It decides what can cross to a partner. | Why it stayed with them |
|---|---|---|
| Adversarial test setThe adversarial examples the robustness evaluation was run against. | RESTRICTED | their own national attack library; the agreement does not let them share it |
| Trigger test setCandidate backdoor triggers the model was tested against. | RESTRICTED | built from a sensitive source; the agreement does not let them share it |
They told us what they were holding back, rather than just leaving it out. That matters: a package quietly missing something looks exactly like an incomplete one. A gap somebody declared can be closed two honest ways — we run the test ourselves, or a named person accepts the risk. There is no third way.
What that came to on this package: D2 we tested it ourselves · D5 still open — needs our own test, or somebody to accept the risk
Where the line falls, and why ⓘWhat can be reused from the partner, and what stays ours to check — with the reason for each.
reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. 38not sentThe agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. 6ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. 48
| reused | The agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. |
| not sent | The agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. |
| ours to check | The agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. |
RulesThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data. (27 in scope)
| Rule | What it asks | Reused? | Why | Here |
|---|---|---|---|---|
| A1 | The artifact under accreditation is uniquely and immutably identified | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| A2 | The architecture and class ontology are specified | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| A3 | Inherited weights are attested and pinned | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| A4 | Loading the artifact does not execute untrusted code | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| A5 | The software supply chain is inventoried and screened | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| B1 | The training corpus is fully enumerated | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| B2 | The corpus is screened for poisoning and the model for backdoors | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| B3 | Label quality is independently sampled | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| C1 | Performance is established under operational conditions | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| C2 | Fielded performance is instrumented between accreditation events | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| D1 | A structured threat model covers every in-scope ATLAS technique | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| D3 | Transferred attacks are evaluated even where the model is not exposed | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| D6 | Interface leakage is quantified | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | covered by their approval | |
| D2 | Robustness against crafted inputs is measured | not sentThe agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. | Adversarial test set | met here |
| D5 | Backdoor triggers are tested for | not sentThe agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. | Trigger test set | still open |
| B4 | What the corpus reveals has been assessed | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Data | met here |
| C3 | The human review capacity behind the model is assessed | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Performance | met here |
| D4 | Physically realisable attacks are evaluated | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Adversarial robustness | met here |
| D7 | Synthetic and manipulated input imagery is addressed | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Adversarial robustness | met here |
| E1 | The deployment is described and its conditions declared | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Deployment and access control | met here |
| E2 | Artifacts and the package itself are protected at rest | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Deployment and access control | met here |
| E3 | The inference interface is rate-limited and monitored | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Deployment and access control | met here |
| E4 | The fielded artifact is continuously verified against the accredited baseline | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Deployment and access control | met here |
| F1 | What the model discloses through its outputs is governed | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Disclosure and classification | met here |
| F2 | Publication and architecture disclosure are reviewed | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Disclosure and classification | met here |
| F3 | Classification and releasability are determined | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Disclosure and classification | met here |
| G1 | Mission impact of model failure is assessed | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | Governance and decision | met here |
Attacks to defend againstThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk. (65 in scope)
| ATLAS IDMITRE ATLAS: a public catalogue of real-world attacks on AI systems, used here as the list of threats to defend against. | Attack technique | Reused? | Here |
|---|---|---|---|
| AML.T0001 | Search Open AI Vulnerability Analysis | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0002.000 | Datasets | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0002.001 | Models | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0005.000 | Train Proxy via Gathered AI Artifacts | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0005.002 | Use Pre-Trained Model | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0010 | AI Supply Chain Compromise | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0010.001 | AI Software | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0010.002 | Data | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0010.003 | Model | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0011 | User Execution | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0011.000 | Unsafe AI Artifacts | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0016 | Obtain Capabilities | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0017 | Develop Capabilities | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0018 | Manipulate AI Model | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0018.000 | Poison AI Model | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0018.001 | Modify AI Model Architecture | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0018.002 | Embed Malware | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0020 | Training Data Poisoning | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0031 | Erode AI Model Integrity | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0059 | Erode Dataset Integrity | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0109 | AI Supply Chain Rug Pull | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0111 | AI Supply Chain Reputation Inflation | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0115 | Publish Poisoned AI Artifacts | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0115.000 | Datasets | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0115.001 | Models | reusedThe agreement covers this one, the evidence behind it was sent to us, and it is still in date. We are taking the partner's word for it instead of checking it again. | |
| AML.T0015 | Evade AI Model | not sentThe agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. | met here |
| AML.T0043 | Craft Adversarial Data | not sentThe agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. | met here |
| AML.T0043.002 | Black-Box Transfer | not sentThe agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. | met here |
| AML.T0043.004 | Insert Backdoor Trigger | not sentThe agreement covers this one, but the partner could not send us the evidence behind it. Taking their word for it would mean accepting something nobody here can ever look at. So it stays with us — and we cannot close it by reviewing, either, without running the test ourselves. | still open |
| AML.T0000 | Search Open Technical Databases | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0002 | Acquire Public AI Artifacts | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0005 | Create Proxy AI Model | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0005.001 | Train Proxy via Replication | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0006 | Active Scanning | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0007 | Discover AI Artifacts | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0013 | Discover AI Model Ontology | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0014 | Discover AI Model Family | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0016.000 | Adversarial AI Attack Implementations | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0017.000 | Adversarial AI Attacks | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0024 | Exfiltration via AI Inference API | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0024.000 | Infer Training Data Membership | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0024.001 | Invert AI Model | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0024.002 | Extract AI Model | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0029 | Denial of AI Service | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0034 | Cost Harvesting | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0034.000 | Excessive Queries | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0035 | AI Artifact Collection | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0040 | AI Model Inference API Access | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0041 | Physical Environment Access | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0042 | Verify Attack | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0043.000 | White-Box Optimization | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0043.001 | Black-Box Optimization | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0043.003 | Manual Modification | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0044 | Full AI Model Access | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0046 | Spamming AI System with Chaff Data | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0047 | AI-Enabled Product or Service | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0048 | External Harms | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0048.001 | Reputational Harm | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0048.002 | Societal Harm | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0048.004 | AI Intellectual Property Theft | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0063 | Discover AI Model Outputs | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0076 | Corrupt AI Model | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0088 | Generate Deepfakes | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0096 | AI Service API | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
| AML.T0112.001 | AI Artifacts | ours to checkThe agreement does not cover this one, so we check it ourselves. Usually that is because it is about how we run the model, what we judge to be sensitive, or what happens if it fails — and nobody else can speak to those. | met here |
An attack defence is only reused when everything under it is too: the evidence reached us, it is still in date, and every rule resting on that evidence is also covered by the agreement. Without that last part, a technique that happens to rely on one of our own access logs would slip in on a partner’s analysis.
Relying on it
What would cross to them ⓘThe same rule pointed the other way: which of our documents could be released to a partner, decided by each document's marking.
55 may cross 4 withheld PARTNER-A accepts PARTNER-RELEASABLE, UNCLASSIFIED. Everything else stays here. Each document’s marking decides it, one document at a time.
What they could do with what crosses: their agreement covers 15 of our rules, and with this list 14 of those would arrive with all their evidence — 1 would not.
| Document | Marking | Crosses? |
|---|---|---|
| Classification determination | RESTRICTED | withheld |
| Corpus classification review | RESTRICTED | withheld |
| Releasability determination | RESTRICTED | withheld |
| Weights access log | RESTRICTED | withheld |
| Adversarial test set | UNCLASSIFIED | crosses |
| Analyst workload assessment | UNCLASSIFIED | crosses |
| Anomalous query detection | UNCLASSIFIED | crosses |
| API access log | UNCLASSIFIED | crosses |
| Architecture disclosure review | UNCLASSIFIED | crosses |
| Architecture spec | PARTNER-RELEASABLE | crosses |
| Artifact malware scan | PARTNER-RELEASABLE | crosses |
| Artifact storage controls | UNCLASSIFIED | crosses |
| Availability target (SLO) | UNCLASSIFIED | crosses |
| Backdoor screen result | PARTNER-RELEASABLE | crosses |
| Base model attestation | PARTNER-RELEASABLE | crosses |
| Base model selection rationale | PARTNER-RELEASABLE | crosses |
| Model checkpoint fingerprint | PARTNER-RELEASABLE | crosses |
| Corpus disclosure review | UNCLASSIFIED | crosses |
| Corpus drift monitor | PARTNER-RELEASABLE | crosses |
| Corpus manifest | PARTNER-RELEASABLE | crosses |
| Data source attestation | PARTNER-RELEASABLE | crosses |
| Decoy test set | UNCLASSIFIED | crosses |
| Denial deception assessment | UNCLASSIFIED | crosses |
| Dependency scan | PARTNER-RELEASABLE | crosses |
| Deployment integrity check | UNCLASSIFIED | crosses |
| Distribution record | UNCLASSIFIED | crosses |
| Downstream dissemination map | UNCLASSIFIED | crosses |
| Drift detection record | PARTNER-RELEASABLE | crosses |
| Extraction evaluation | PARTNER-RELEASABLE | crosses |
| False positive monitor | PARTNER-RELEASABLE | crosses |
| Framework version pin | PARTNER-RELEASABLE | crosses |
| Human review procedure | UNCLASSIFIED | crosses |
| Impact assessment | UNCLASSIFIED | crosses |
| Inversion evaluation | PARTNER-RELEASABLE | crosses |
| Label provenance | PARTNER-RELEASABLE | crosses |
| Label quality audit | PARTNER-RELEASABLE | crosses |
| Membership inference evaluation | PARTNER-RELEASABLE | crosses |
| Ontology release review | UNCLASSIFIED | crosses |
| Operational test record | PARTNER-RELEASABLE | crosses |
| Output disclosure policy | UNCLASSIFIED | crosses |
| Output granularity review | UNCLASSIFIED | crosses |
| Package access log | UNCLASSIFIED | crosses |
| Performance monitor | PARTNER-RELEASABLE | crosses |
| Physical attack evaluation | UNCLASSIFIED | crosses |
| Poisoning screen result | PARTNER-RELEASABLE | crosses |
| Provenance of input imagery | UNCLASSIFIED | crosses |
| Public overlap analysis | PARTNER-RELEASABLE | crosses |
| Publication review record | UNCLASSIFIED | crosses |
| Query rate controls | UNCLASSIFIED | crosses |
| Retraining record | PARTNER-RELEASABLE | crosses |
| Retrieval timestamps | PARTNER-RELEASABLE | crosses |
| Robustness evaluation | PARTNER-RELEASABLE | crosses |
| Software bill of materials (SBOM) | PARTNER-RELEASABLE | crosses |
| Serialisation format record | PARTNER-RELEASABLE | crosses |
| Synthetic imagery detection | UNCLASSIFIED | crosses |
| Threat model record | PARTNER-RELEASABLE | crosses |
| Transferability evaluation | PARTNER-RELEASABLE | crosses |
| Vulnerability monitoring record | PARTNER-RELEASABLE | crosses |
| Weights provenance | PARTNER-RELEASABLE | crosses |
Nothing here sends anything anywhere. It is the list a release review would work from, and the withheld rows are the part that needs a decision rather than a click.
The agreement with PARTNER-A
| Our rules it coversOur rules that their framework is agreed to cover. Only these can ever be reused. | A1, A2, A3, A4, A5, B1, B2, B3, C1, C2, D1, D2, D3, D5, D6 |
| Attack defences | covered, against the ATLAS 2026.07 attack list |
| Their approval is good for | 24 months |
| Markings we may send them | PARTNER-RELEASABLE, UNCLASSIFIED |
Covers the model itself and the testing of it. How we run it, what we judge to be sensitive, and what happens if it fails all stay with us — by design, not because the agreement is unfinished.
The list of what this agreement covers is written by whoever negotiated it, and copied into the record when the agreement was registered — so renegotiating it later cannot rewrite what a past approval rested on. Your own agreements would drop in the same way.