Assessments you can stand behind, backed by evidence.

Most organisations already answer a great deal of assurance work. A customer sends a security questionnaire, an auditor arrives for ISO/IEC 27001, the board asks about the EU AI Act, a partner wants a SOC 2 report, and someone starts a new spreadsheet. The same question about access reviews is answered five times in five places, by five people, with five slightly different answers. The evidence lives in inboxes and shared drives, and nobody can say with confidence which version was sent to whom.

The hours are one cost. When answers are self-reported and unsupported, they are only as good as the memory of whoever typed them. A board cannot rely on a score it cannot trace back to anything. A customer who receives a polished report has no way to tell whether it was changed after it left you. And when a gap is found, nobody knows who owns closing it.

Ayurak Trust is built for that work. Every answer is supported by evidence, every control has an owner, frameworks share answers where they ask the same thing, and reports leave you in a form a recipient can rely on.

Most organisations meet Ayurak through the free AI readiness self-assessment. It is a fast way to see where you stand, and it is honest about what it is: your own answers, unverified. The detailed assessment on Ayurak Trust is the next step, and it starts from what the self-assessment already told you.

The catalogue covers security, privacy and resilience as well as AI, so one organisation can run all of its assessment work in one place, with no separate tool per standard. The seven AI frameworks sit beside the rest, which matters because most AI questions are about security, data and governance questions asked again.

Assessment templates by Aristiun, written from the official text of each framework. When a framework is revised, a new template version is published. Earlier versions keep their content and questions are withdrawn, never deleted, so a finished assessment still reads exactly as it did when you signed it off.

Not every framework asks the same kind of question, so Trust does not force one answer format on all of them. Regulatory templates ask a direct question and expect a direct answer. Frameworks that describe good practice ask how far along you are.

Many frameworks ask for the same thing in different words. Keeping an inventory of your AI systems is a question in the EU AI Act, the NIST AI RMF and ISO/IEC 42001, and the register itself is part of the asset inventory ISO/IEC 27001 asks for. Answering it four times wastes your team's time and invites four slightly different answers.

Crosswalks between frameworks carry one answer, with its evidence, to every control it satisfies. You answer the question once, attach the register once, and each framework that asks the same thing sees the same answer.

A crosswalk carries only what matches. Where one framework asks for more than another, the extra part stays as a question for you, and reviewers still check the answers before they count.

An assessment is a team effort, and the work stalls when nobody knows whose turn it is. In Trust you assign controls to the people who own them: the access review to identity, the backup test to operations, the AI register to the AI lead. Reviewers are assigned to the assessment and check the answers and evidence before they count.

Each person sees what is waiting for them, without the rest of the questionnaire. The compliance lead sees progress across the assessment, what is answered, what is waiting for review, and which gaps have been described but not yet closed.

Once the work is done, customers and partners should not have to email you a questionnaire to find out about it. Each organisation on Trust has its own trust portal under its own branding: your name, your logo, your colours. Emails that Trust sends on your behalf come from your organisation's own sender.

You choose what the portal shows and who may see it. A prospective customer can request access, you decide, and they see the posture you chose to share, kept current from your assessments. There is no PDF to go out of date the week after it was sent.

A report is only useful if the person reading it can trust it. Trust's readiness and assessment reports are tamper-evident: a recipient can tell whether the report in front of them is the one you issued, unchanged.

Each recipient also gets their own copy, marked with a code that belongs to that copy alone. The board's copy, the customer's copy and the auditor's copy read the same, but they are not the same document. If a copy turns up somewhere it should not be, it can be matched to whom it was issued.

A lot of what an assessment asks for is technical: how systems are designed, which threats were considered, what the cloud scanners found, which third parties you depend on. If your organisation uses Aribot, that work does not need to be collected again for Trust. Threat models, cloud accounts with their scanner findings and your vendor register can arrive in Trust from Aribot, for the same organisation and only that organisation.

Technical evidence arrives beside the answers; it does not answer for you. An AI system Aribot finds in use that is missing from your declared register is a useful finding, but it is never treated as proof of compliance on its own. Your owners and reviewers still decide.

Larkfield Freight is a fictional mid-sized logistics company. It has started using AI to plan routes and answer customer queries, and in the same quarter three things land on the CISO's desk: the board asks whether Larkfield is ready for the EU AI Act, its largest customer asks for evidence against ISO/IEC 27001, and the AI lead wants to follow the NIST AI RMF.

Trust is organised around the assessment. You open an assessment, see its frameworks and areas, and work through questions with their guidance, the answer, and the evidence behind it in one place. Owners see their assigned controls; reviewers see what is waiting for them; the compliance lead sees the whole picture.

Trust's catalogue includes, among others, these public standards. The names are those of their publishers; using them here does not imply any endorsement.