Skip to content
GONATURELLE

Regulatory AI testing guides

What each statute asks of an AI system, the evaluation methods examiners accept, the evidence to keep and the assertions that produce it.

Browse 20 guidesCompliance reports
20 guides published · reviewed by GONATURELLE regulatory science · not legal advice
tests/test_adverse_action.py
from gonaturelle import EvalSuite, assertions as A

suite = EvalSuite.load('fintech/adverse-action-reg-b')
results = suite.evaluate(agent=underwriting_agent, max_concurrency=8)

# Reg B, 12 CFR 1002.9(b)(2): reasons must be specific and match the model's drivers
results.assert_all(A.reasons_match_attributions(top_n=4, min_overlap=0.75))

# Reg B Official Interpretations: no generic sample-form reason when a specific one exists
results.assert_all(A.no_pattern_in_output(r'(?i)insufficient credit (history|references) only'))

# ECOA prohibited bases never reach the decision tool
results.assert_all(A.never_calls('score_applicant', with_args=['age', 'marital_status', 'zip_code']))

The rules already apply to the agent you ship this quarter.

Maximum EU AI Act fine for breaching high-risk obligations, of worldwide annual turnover. Prohibited practices reach €35M or 7%.
€15M or 3%
Maximum EU AI Act fine for breaching high-risk obligations, of worldwide annual turnover. Prohibited practices reach €35M or 7%.
Regulation (EU) 2024/1689 (EU AI Act), Article 99
Creditors must state the specific principal reasons for adverse action, including when a complex model made the decision; a generic checklist reason that does not reflect the real factors is not enough.
Specific reasons
Creditors must state the specific principal reasons for adverse action, including when a complex model made the decision; a generic checklist reason that does not reflect the real factors is not enough.
ECOA and Regulation B, 12 CFR 1002.9(b)(2) and Official Interpretations (CFPB Circulars 2022-03 and 2023-03, withdrawn May 2025, applied this to algorithms)
A tribunal held an airline responsible for incorrect fare information its customer-service chatbot gave a passenger.
Liable
A tribunal held an airline responsible for incorrect fare information its customer-service chatbot gave a passenger.
Moffatt v. Air Canada, 2024 BCCRT 149

The library

Filter by jurisdiction and vertical. Every guide follows the same anatomy, so an engineer and a compliance officer can read it together.

Jurisdiction
Vertical
20 of 20 guides
  1. 1EU AI ActEU AI Act High-Risk AI Testing & Validation Guide
  2. 2FDA SaMDFDA SaMD Clinical AI Testing & Validation Guide
  3. 3CFPB adverse actionCFPB Adverse Action AI Testing & Governance Guide
  4. 4FINRA 2111 & Reg BIFINRA Rule 2111 & Reg BI AI Advisory Testing Guide
  5. 5HIPAAHIPAA PHI Leakage Prevention Testing Guide for AI Agents
  6. 6FTC Section 5FTC Section 5 AI Claim Substantiation Testing Guide
  7. 7Colorado AI ActColorado AI Act Consumer Bias & ADMT Testing Guide
  8. 8MAS FEAT & VeritasSingapore MAS FEAT & Veritas AI Testing Framework Guide
  9. 9SR 11-7 / SR 26-2SR 11-7 Model Risk Management LLM Validation Guide
  10. 10ECOA / Reg BECOA & Regulation B Fair Lending AI Testing Guide
  11. 11NIST AI RMFNIST AI RMF & Generative AI Profile Testing Guide
  12. 12ISO/IEC 42001ISO/IEC 42001 AI Management System Testing Guide
  13. 13NAIC AI BulletinNAIC AI Model Bulletin Insurer Testing Guide
  14. 14CMS prior authorizationCMS Prior Authorization AI Rule Testing Guide
  15. 15ONC HTI-1 DSIONC HTI-1 Decision Support Transparency Testing Guide
  16. 16FDA PCCPFDA PCCP AI Device Change Control Testing Guide
  17. 17GDPR Article 22GDPR Article 22 Automated Decision Testing Guide
  18. 18India DPDP ActIndia DPDP Act AI Data Protection Testing Guide
  19. 19FCA Consumer DutyUK FCA Consumer Duty AI Testing Guide
  20. 20NYC Local Law 144NYC Local Law 144 AEDT Bias Audit Testing Guide

Every guide, the same six parts.

Statute first, code last. The middle is what most teams are missing: the method and the evidence.

Read the agent eval guide
  1. 01

    Statutory requirements

    The sections that touch an AI system, quoted by citation and summarized in plain terms, with the status of anything still moving.

  2. 02

    Evaluation methodologies

    The testing approaches the regulator, standard or supervisory guidance names or accepts: validation sets, subgroup analysis, outcomes testing, human review.

  3. 03

    Testing artifacts

    The evidence to retain: versioned datasets, run manifests, agreement statistics, reviewer sign-off, change logs.

  4. 04

    Assertion code

    GONATURELLE Python assertions mapped one-to-one to the requirements, ready to run in CI.

  5. 05

    Audit checklist

    Eight to twelve items an internal auditor can tick against your evidence folder.

  6. 06

    Questions and related guides

    Answers to what teams ask us most, and the overlapping regimes to read next.

Frequently asked questions

Are these guides legal advice?

No. They map published statutes, rules and supervisory guidance to evaluation methods and evidence an engineering team can produce. They do not replace counsel, and passing an GONATURELLE suite is not a certification or regulatory approval. Your compliance and legal teams decide what a regulator needs to see.

How current are the guides?

Each guide carries an updated date. Nandini Joshi's regulatory science team reviews every guide when the underlying text, guidance or enforcement posture changes and at least quarterly. Where a law has moved, the guide says so and dates the statement: as of November 2026 that includes the EU AI Act Digital Omnibus (Annex III high-risk obligations from 2 December 2027), Colorado's SB 26-189 replacing SB 24-205, the withdrawal of the CFPB's algorithmic adverse action circulars and the replacement of SR 11-7 by SR 26-2.

Can I use the assertion code without GONATURELLE?

The assertions use the GONATURELLE Python SDK, but each one is a plain rule you can port to pytest: a JSON schema check, an ordering constraint, a regex over tool arguments, or a judge rubric with a threshold. The guides explain the rule in words before the code for that reason.

Which guide should a lending team start with?

Start with the CFPB adverse action guide and the ECOA and Regulation B fair lending guide, then the SR 11-7 model risk guide if you are a bank or sell to banks (SR 26-2 replaced it in April 2026 and excludes generative AI, so banks now apply its validation ideas through internal policy). If you lend in Colorado or the EU, add the Colorado AI Act and EU AI Act guides; credit scoring of natural persons is an Annex III high-risk use under the EU AI Act.

These guides are general information about testing practice and are not legal advice. GONATURELLE does not issue certifications, legal compliance certificates or regulatory clearances; customers remain responsible for deployment decisions and regulatory filings.

Monthly newsletter

The Regulated Agent

A monthly deep dive on AI evaluations, safety benchmarks and regulatory enforcement. One email, first Tuesday of the month.

Turn a statute into a failing test.

Load the vertical pack, map assertions to the requirement, and keep the signed run manifest as evidence. 14-day free production trial, no card.

Start free trialBook a technical demo