▚ STOUT STREET · PAPERSMMXXVI
WHITE PAPER №01 · 2026 EDITION

The Assurance Gap

The United States has AI standards, auditor accreditation, and management-system certificates. It does not have conformance testing of deployed systems. The fix is a scheme inside the existing architecture, not a rival institution.

John Francis · Stout Street Capital · July 2026 · PDF · 19 pages · 8,033 words · 204 KB
$ read the pdf → ▚ save assurance-gap.pdf
1,561
AI bills · 45 states, early 2026
$15M
aiSure coverage limit
5
ANAB-accredited 42001 bodies
12 mo
certificate term, full re-test
[ abstract ]

What it argues.

Auditor accreditation is not missing: ANAB accredits ISO/IEC 42001 certification bodies, and Schellman, SGS, DEKRA, DQS and BSI hold that accreditation. What is missing is conformance testing of system behavior, a defined certification unit that survives model updates, and a public registry. Drawing on Underwriters Laboratories, FedRAMP and the NTSB, the paper specifies what gets certified and for how long, who pays and why publishing test methods defeats issuer-pays capture, why parametric insurance makes AI harm priceable, why state procurement is the one demand lever federal preemption explicitly does not reach · and the seven ways the institution fails.

[ figures ]

The evidence, drawn.

fig. 01 · the gap, dated
← OVERSIGHT RETREATSTHE MARKET ASSEMBLES →ISO/IEC 42001 published · AI management systemscertifiableDEC 23First ISO 42001 certificates issueOCT 24UK institute renamed: safety → securityFEB 25SGS accredited by ANAB for 42001APR 25US institute renamed CAISI; remit narrowsJUN 25ISO/IEC 42006 published · auditor requirementsJUL 25Colorado delays its AI ActAUG 25EO 14365: state-law preemption campaignDEC 25aiSure × Mosaic: $15M AI performance coverFEB 26BSI holds ANAB + UKAS + RvA accreditationMAR 26EU defers high-risk conformity to Dec 2027MAY 26Colorado repeals and replaces: disclosure onlyMAY 26
Both columns are true at once. Regulation retreated; standards, accreditation, and insurance kept arriving. The missing piece is the conformance layer that binds the right-hand column into one mark. Dates as cited in the paper.
fig. 02 · the stack, audited
Public registry · grants, suspensions, withdrawalsMISSINGCertification unit + 12-month lifecycleMISSINGConformance testing of deployed behaviorMISSINGManagement-system certification (ISO/IEC 42001)EXISTSAuditor accreditation · ANAB · 5 bodies · IAFEXISTSStandards · NIST AI RMF · ISO/IEC 42001 / 42006EXISTS
What this edition corrects: the bottom three layers are built and operating · ANAB has accredited Schellman, SGS, DEKRA, DQS and BSI. The paper's claim is only the dashed top three, run as a scheme inside the existing architecture.
fig. 03 · what moves the certificate
CERTIFICATE = deployment configuration × use profilevalid 12 months · continuous monitoring against thresholds fixed at certificationRE-TEST BEFORE EXPIRYweight update, incl. fine-tuningsystem prompt or policy layerretrieval corpus class or sourceany decision thresholdexpanded use profile or populationreduced human-review postureNO RE-TEST REQUIREDhosting and infrastructurelatency optimisationlogging changesanything off the inference path
UL certifies a toaster; the toaster is the same toaster next year. An AI system is not · so the unit and its lifecycle are defined before anything else. Systems that update continuously in production have no certifiable artifact, and the paper says so.
[ contents ]

Inside the paper.