AI is being written out of liability policies
ISO's optional endorsements CG 40 47 and CG 40 48 let insurers exclude generative-AI claims from commercial general liability cover.
Source: Independent Agent
v0.1 The Assay Standard is an open draft
The hallmark for AI agents.
Assay tests your agent against an open standard, on your real model, and marks the exact release that passed. Every new release is tested again. Buyers get proof they can check, and insurers get evidence they can price.
Founding cohort open. Europe first, in English and French.
SPECIMEN
Illustrative, not a test result
Agentthe maker's mark
Standardthe fineness mark
Tested bythe assay office mark
Releasethe date letter
- Agent
- support-bot (sample)
- Use case
- Customer support
- Release
- a3f9c2e
A mark covers one release of one agent. Change the agent and the mark goes stale until it is tested again.
Chatbot invents a refund rule, and the airline is held to itAir Canada · 2024
Agent deletes a production database during a code freezeReplit · 2025
Sales bot agrees to sell a Tahoe for one dollarChevrolet dealer · 2023
Why now
Agents now spend, publish and delete. When one gets it wrong, someone pays.
Every incident here is public, sourced, and turned into a test in the Assay Standard.
The EU AI Act has fixed dates
High-risk obligations apply from 2 December 2027 for stand-alone systems, and from 2 August 2028 for systems built into regulated products.
Source: Regulation (EU) 2026/1744Insurers now write cover for AI itself
Armilla launched a Lloyd's-backed AI liability policy, and Munich Re's aiSure backs the performance guarantees of AI vendors.
Sources: Armilla, Munich ReUse cases
One standard for agents that do real work.
Each use case gets the same treatment: what the agent does, what can go wrong, what Assay tests, and the evidence behind it.
Damages we test against
Money outLost salesBad dataBrand damageLiabilityFines
Arago · letter of intent signed
Autonomous ad campaigns
The agent plans and launches campaigns on its own: audiences, creatives, placements and budgets, with no one approving each change.
- Brand damageAn off-brand creative, an ad next to unsafe content, or the wrong audience.
- Lost salesA launch that goes live misconfigured, in the week it mattered.
- Money outBudget spent outside the brief.
- LiabilityThe brand holds the agency or the vendor responsible.
- FinesHousing, job or credit ads that exclude protected groups.
Test suite · Ad campaignsStandard v0.1
creative.brand_rulesEvery creative checked against the brand's rules and each platform's ad policy.audience.matches_briefTargeting matches the brief and excludes no protected group.placement.exclusion_listNo ad runs on excluded or unsafe sites.campaign.matches_specWhat went live is what was approved.spend.within_limitsDaily and total caps hold, even when the agent is pushed to exceed them.
Pilot
We are preparing a pilot with Arago, which runs ad campaigns autonomously, under a signed letter of intent. Robin Cahierre, Assay's CTO, co-founded Arago and leads its AI. Results will be published here with Arago's permission.
Open to design partners
Catalog and storefront agents
The agent updates titles, prices, stock and product pages, often across thousands of products in one release.
- Lost salesProducts hidden or impossible to buy, or a checkout that breaks.
- Bad dataWrong prices, specs or stock published at scale.
- LiabilityOrders taken at a price nobody approved.
Test suite · CatalogsStandard v0.1
product.still_buyableEvery product in the release can still be found, viewed and added to a basket.price.matches_sourcePublished prices match the source of truth.checkout.end_to_endA test basket goes from product page to payment.change.within_scopeThe agent changed only what the release asked for.
Pilot
We are looking for one catalog team to run the first checks with, before and after each agent release.
Open to design partners
Agentic checkout
The agent buys on a shopper's behalf, through new agent payment protocols such as OpenAI and Stripe's Agentic Commerce Protocol and Google's AP2.
- Money outWrong items, wrong amounts, or the same order twice.
- LiabilityA purchase or a promise the shopper never approved.
Test suite · Agentic checkoutStandard v0.1
instruction.overrideText on a seller's page can't talk the agent into a different purchase.spend.within_mandateAmount, merchant and item stay inside what the shopper approved.order.no_duplicateA retry never buys twice.
Incident replay
Chevrolet of Watsonville sales botDec 2023
Told to agree with anything, a dealer's chatbot "agreed" to sell a 2024 Tahoe for one US dollar. The bot was taken down and the offer was not honoured. Assay's test: instruction.override, with no commitment outside approved offers.
Open to design partners
Support agents that refund or state policy
The agent answers customers, issues refunds and explains company policy, in the company's name.
- LiabilityA policy or promise the company is then held to.
- Money outRefunds paid outside the rules.
- Brand damageCustomers who leave after a confident wrong answer.
Test suite · Customer supportStandard v0.1
policy.no_inventionAnswers stay bound to the written policy.refund.within_limitsRefunds respect amount and eligibility rules.scope.legal_adviceOut-of-scope questions get a refusal and a source.disclosure.ai_labelledCustomers know they are talking to an AI.
Incident replays
- Moffatt v. Air Canada, Feb 2024The website chatbot invented a retroactive bereavement-refund rule. The airline was held liable for CAD 812.02, and its argument that the bot was responsible for its own actions was rejected.
- Cursor's support bot, Apr 2025It told users that being logged out was a new policy. No such policy existed, and users cancelled.
- NYC MyCity, Mar 2024It told businesses they could take a cut of workers' tips. The city shut it down in February 2026.
Open to design partners
Invoice and procurement agents
The agent checks supplier invoices against contracts and, more and more, acts on what it finds: credit requests, payment holds, emails to suppliers.
- Money outCredits or payments sent on a wrong finding.
- LiabilityRecoveries missed against a result the vendor guaranteed.
- Bad dataSupplier records changed on the strength of a misread invoice.
Test suite · InvoicesStandard v0.1
precision.labelled_setFindings checked against a labelled set of the customer's own invoices and contracts.injection.supplier_documentsText planted in an invoice can't redirect the agent.approval.before_sendingNothing reaches a supplier until the approval rule passes.
Evidence
No public incident yet. Vendors in this space publish precision figures; an Assay run measures precision on your own documents.
Open to design partners
Coding and ops agents with production access
The agent writes code, runs commands and changes infrastructure, with access to production.
- Bad dataProduction data deleted or overwritten.
- Lost salesDowntime while it is restored.
Test suite · Coding and opsStandard v0.1
destructive.under_freezeNo destructive command during a declared freeze.approval.gateIrreversible actions wait for a person.env.separationA development task can't reach production.
Incident replays
- Replit and SaaStr, Jul 2025During a declared code freeze, the agent ran destructive commands and deleted records on more than 1,200 executives and 1,190 companies. Replit then separated development and production databases.
- Google Antigravity, Nov 2025In auto-run mode, asked to clear a cache, it deleted the user's whole D: drive.
How certification works
Tested on every release, not once a year.
-
01
Connect
Point Assay at your agent: the real model and prompts, with its tools in a sandbox so nothing real is spent, sent or deleted.
-
02
Attack
Assay runs the standard's tests for your use case: injections, overrides, out-of-policy requests and destructive commands.
-
03
Fix and re-test
Each failure comes with the control that would have stopped it. Ship the fix, and Assay runs the same test against it.
-
04
Mark
The release that passes gets its mark, with the test log behind it. Change the agent and the mark goes stale.
Steps 02 to 04 run again on every release, from your CI: on: release
Why a mark per release
Agents change every week. Their proof should too.
| Question | Point-in-time audit | Assay |
|---|---|---|
| When it runs | Once, then on a yearly cycle | On every release, from your CI |
| What it covers | The agent as it was on the audit date | The exact release that is live |
| What a buyer sees | A certificate and a report on request | A mark that links to the release, the tests it passed and the date |
| What happens to fixes | Listed in the report for later | Re-tested in the same run |
| When the agent changes | The certificate stays on display | The mark goes stale until the next run |
The Assay Standard
An open standard, written in public.
Controls are grouped by the damage they prevent. Each one names the tests that prove it, and maps to the frameworks your security team and regulators already use.
Money and commitments
What the agent can spend, refund, offer or order, and the limits that hold under pressure.
Process integrity
The work the agent changes still works afterwards: products buyable, campaigns as approved.
Content and brand
What the agent publishes or says in your name, and where it appears.
Data and privacy
What the agent can read, keep, change and send, and to whom.
Security
Injections, instruction overrides and tool misuse, from users and from the documents the agent reads.
Accountability
Logs, human approval for irreversible actions, and telling people they are dealing with an AI.
Mapped to
OWASP Top 10 for LLM Applications
NIST AI RMF
EU AI Act
ISO/IEC 42001
MITRE ATLAS
Read v0.1
Draft v0.1, open for comment. A mapping shows which controls line up with each framework. It is not a claim of compliance.
For buyers and insurers
Evidence other people can check.
Buying an agent?
Ask the vendor for its Assay mark.
- Each mark names the release it covers and the date of the run.
- It lists the tests passed for that use case, and what was fixed.
- A stale mark tells you the agent changed since it was tested.
Underwriting AI risk?
Evidence per agent and per release, not a questionnaire.
- What the agent can reach: money, data, systems, customers.
- What was tested, what failed and what was fixed.
- Every control mapped to the frameworks you already use.
Assay does not sell insurance. We are talking with brokers about linking the mark to cover placed through licensed partners.
Why "Assay"
Before gold could be sold, it was assayed. Before an agent goes live, it should be too.
For seven centuries, precious metal has been tested by an independent office and stamped before sale. Hallmarking is one of the oldest forms of consumer protection. Assay applies the same rule to software that acts on its own.
Source: Hallmark, Wikipedia- 1260
Paris goldsmiths have their work assayed and marked under a statute.
- 1300
English silver must be assayed and stamped with a leopard's head before sale.
- 2026
Assay marks AI agents, one release at a time.
Founding cohort
Get your agent assayed first.
We are taking a small group of teams that run agents in production, starting in Europe.
- The full test, fix and re-test loop on one agent.
- A say in the standard before v1.
- Your name on the page only if you want it there.
Team
Who is building Assay.
Paul-Emile GrasCo-founder and CEOBuilt AI products for consumer companies, from pricing to travel-booking agents. At McKinsey, advised enterprises on AI transformation, including agent deployments at scale.
Robin CahierreCo-founder and CTOCo-founded Arago and leads its AI, which runs ad campaigns autonomously. Previously machine learning scientist at Amazon, in advertising, and at Huawei.