The minimum viable Assurance Pack checklist

You don’t need a heavyweight governance programme to ship more defensible ML. You need a minimum viable evidence bundle that you can generate consistently.

Here’s a checklist that’s realistic for a small team.

1) Intent (the one page that prevents confusion)

• Intended use: what the system is for
• Out of scope: what it is not for
• Assumptions: what must be true for it to work
• Operational constraints: latency, supported inputs, supported environments

If this isn’t clear, every downstream “risk discussion” becomes fuzzy.

2) Evaluation summary (reproducible, not vibes)

Minimum:

• dataset(s) used + how they were sampled
• core metric(s) + the exact numbers
• confidence / calibration note (even a small one)
• a short list of failure modes (what it gets wrong)

The goal isn’t perfection. It’s to make results repeatable and auditable.

3) Slice checks (one or two that matter)

Pick slices that reflect real risk:

• lighting/occlusion/background (for vision)
• device type or camera source
• edge-case scenarios you expect in production

You want at least:

• one “typical” slice
• one “risky” slice

4) Risk register (small, honest)

A starter risk register can be 5–10 bullets:

• risk
• impact
• likelihood (rough)
• mitigation
• how you’ll detect it

Keep it honest. A short truthful list beats a long generic one.

5) Monitoring plan (signals, thresholds, actions)

Minimum viable monitoring plan:

• what signals you will track (drift, latency, error proxies)
• thresholds (what counts as “bad”)
• actions (what you do when thresholds hit)
• owners (who wakes up)
• cadence (weekly review, monthly recalibration)

A monitoring plan without owners/actions is just documentation.

6) Traceability (so you can reproduce later)

Capture:

• repo URL + commit hash
• training run ID (or CI run ID)
• data version / snapshot identifier
• model version + packaging details

This is what makes your evidence defensible months later.

The point: consistency

The “minimum viable” pack works because it’s repeatable.
If you can generate it for every release, you get compounding benefits:

• fewer surprise regressions
• faster incident response
• clearer stakeholder communication
• easier audits (if/when they arrive)

For updates on Assurance Packs, join the Ormedian list or register interest in early access.