AI systems are moving into ever more critical processes, and with them a question grows: can this AI be trusted? The BSI answers it with A5, an assessment architecture that lets the trustworthiness of AI systems be examined and evidenced independently. A5 is still a draft, but it is coming in one form or another. Anyone who provides or operates AI gains an edge by preparing early.
What A5 is
A5 stands for AI Audit and Assurance Assessment Architecture, a modular assessment architecture from the BSI. It has two parts: the A5 criteria, testable requirements for the trustworthiness of AI systems, and the A5 assessment methodology based on ISAE 3000, the procedure by which these criteria are examined. The criteria are organized modularly into profiles, so that the scope can be tailored to your AI system and its context of use. The object of assessment can be an entire AI system, an application, a component, a model or a dataset.
A5 is currently in the community draft phase (version 0.9), with the commenting period running until 31 August 2026. The framework is therefore not yet final, but the direction is set. We follow its development actively and align your preparation with the current state.
Who examines, and where we come in
The A5 examination itself is a reasonable assurance engagement under ISAE 3000 and is carried out by an independent auditor, not by us. As a provider or operator, you describe your AI system and the controls established for it; the auditor assesses whether these meet the A5 criteria and reports on it. The result is a robust, shareable proof of trustworthiness, comparable to an assurance report on an internal control system.
That is exactly where our work sits: we make your AI system and your evidence assessment-ready so that the examination succeeds. Technical trustworthiness, where most initiatives fall short, is our core area.
How we prepare you
1. Gap analysis against the A5 criteria
We determine the right profile with you and identify where your AI system already meets the criteria and where it does not. The result is a prioritized roadmap to assessment readiness.
2. Test and secure the AI technically
With AI penetration tests and GenAI red teaming we uncover weaknesses that classic tests miss: prompt injection, data exfiltration through context and tool access, unsafe outputs. Based on the OWASP Top 10 for LLM applications.
3. Build controls and the system description
We help you establish the required controls and document your AI system so that the system description holds up in the examination. We interlock this with an existing ISMS rather than building it alongside.
4. Close gaps and support you up to the examination
We close the identified gaps and support you up to the examination, in coordination with your auditor. The auditor performs the examination; we pave the way there.
A5 builds on what we already do: understanding, attacking and securing AI systems. Take a look at our focus areas AI penetration tests and AI threats, or talk to us directly.