PATENT PENDING · APP #64/057,822

The Evolve Edge AI Risk Framework

EEARF is a five-dimension taxonomy for evaluating and maintaining AI governance validity — not at a point in time, but continuously as systems change.

Cross-mapped to NIST AI RMF, EU AI Act, ISO 42001, HIPAA, and OCC AI Risk Guidance. Validated via the ARM-B (AI Risk Model Benchmark) methodology.

The Foundational Insight

Traditional AI governance produces point-in-time assessments. These are accurate on the day they are completed — but AI systems are not static. Vendors change. Model versions update. Deployment contexts expand. Regulations evolve.

EEARF treats an assessment as a governance baseline, not a clearance. Prior evidence can remain historically accurate while no longer being sufficient to support the current governance decision. The framework provides a structured taxonomy for determining which prior evidence is still valid, which dimensions need to be revisited, and why.

"A change may be significant even when it does not alter any answer in the original assessment, simply because the assessment did not fully capture a relevant dependency."

The Five Dimensions

Model Risk

Dimension 1 of 5

Assessment of the AI model itself: vendor provenance, version stability, known failure modes, performance distribution, and supply chain attestation.

Change Triggers

·Vendor change

·Model version update

·Third-party audit lapse

Framework Mappings

NIST AI RMF — MAP.1, MEASURE.2

EU AI Act — Art. 9, Annex IV

ISO 42001 — A.6.2

Sample Assessment Questions

1.Has the model vendor completed a SOC 2 Type II or equivalent audit?

2.Does the current model version introduce failure modes not present in the assessed version?

3.Has model output distribution changed measurably since the last assessment?

Operational Risk

Dimension 2 of 5

Risk arising from how the system is deployed and operated: deployment context, fallback procedures, escalation paths, incident response, and monitoring coverage.

Change Triggers

·Deployment context change (internal → patient-facing)

·Removal of human-in-the-loop

·Change in usage volume or user population

Framework Mappings

NIST AI RMF — MANAGE.2, MANAGE.4

EU AI Act — Art. 9(7), Art. 17

ISO 42001 — A.9.4

Sample Assessment Questions

1.Does the current deployment expose the system to end users not previously in scope?

2.Are fallback and escalation procedures defined for the current deployment context?

3.Has operational monitoring been configured for the current deployment environment?

Data Governance

Dimension 3 of 5

Governance of data inputs, outputs, and processing: data classification, consent, retention, deletion, cross-border transfer, and data processing agreement coverage.

Change Triggers

·Expansion of data types processed

·New cross-border data transfer

·Change in data classification

Framework Mappings

NIST AI RMF — MAP.3, MANAGE.3

EU AI Act — Art. 10

HIPAA Security Rule — §164.312

ISO 42001 — A.8.4

Sample Assessment Questions

1.Are the newly processed data types covered by the existing data processing agreement?

2.Does the expanded data scope require a new DPIA under GDPR or equivalent?

3.Have data retention and deletion policies been updated to reflect current data scope?

Compliance Mapping

Dimension 4 of 5

Crosswalk between current system state and applicable regulatory frameworks: control coverage, evidence sufficiency, and regulatory gap identification.

Change Triggers

·New framework enforcement (EU AI Act Art. 50 August 2026)

·Vendor change affecting existing compliance crosswalk

·Addition of regulated data types

Framework Mappings

NIST AI RMF — GOVERN.1

EU AI Act — Art. 6, Annex III

OCC AI Risk Guidance

ISO 42001 — A.4.1

Sample Assessment Questions

1.Does the vendor change affect coverage under NIST AI RMF GOVERN.1?

2.Has the prior compliance crosswalk been invalidated by a vendor or scope change?

3.Are active regulatory frameworks reflected in the current control mapping?

Transparency & Accountability

Dimension 5 of 5

Obligations for disclosure, explainability, accountability assignment, audit logging, and human oversight — including EU AI Act Article 50 and NIST AI RMF GOVERN.6.

Change Triggers

·System deployed in patient-facing context

·EU AI Act Article 50 enforcement (August 2, 2026)

·Change in accountability assignment

Framework Mappings

NIST AI RMF — GOVERN.6, MANAGE.1

EU AI Act — Art. 13, Art. 50

ISO 42001 — A.10.1

HIPAA — §164.308(a)(2)

Sample Assessment Questions

1.Is the system required to disclose AI involvement to end users under EU AI Act Art. 50?

2.Has accountability been formally re-assigned for the current deployment context?

3.Are AI decision logs and audit trails configured and retained per regulatory requirements?

VALIDATION METHODOLOGY

ARM-B: AI Risk Model Benchmark

EEARF dimensions are validated against the ARM-B methodology — a structured benchmark that measures AI model and system behavior against governance expectations using structured test scenarios across real-world AI deployment contexts.

ARM-B is co-developed with academic collaborators and currently in commercial pilot. Results are used to validate EEARF dimension coverage and scoring accuracy. Whitepaper available on request — currently under co-author review.

EEARF and ARM-B are proprietary frameworks of Evolve Edge AI. Provisional patent filed May 5, 2026 (App. #64/057,822).

For research collaboration or licensing inquiries: k.green@evolveedgeai.com

PATENT PENDING · APP #64/057,822

The Evolve Edge AI Risk Framework

EEARF is a five-dimension taxonomy for evaluating and maintaining AI governance validity — not at a point in time, but continuously as systems change.

Cross-mapped to NIST AI RMF, EU AI Act, ISO 42001, HIPAA, and OCC AI Risk Guidance. Validated via the ARM-B (AI Risk Model Benchmark) methodology.

The Foundational Insight

"A change may be significant even when it does not alter any answer in the original assessment, simply because the assessment did not fully capture a relevant dependency."

The Five Dimensions

Model Risk

Dimension 1 of 5

Assessment of the AI model itself: vendor provenance, version stability, known failure modes, performance distribution, and supply chain attestation.

Change Triggers

·Vendor change

·Model version update

·Third-party audit lapse

Framework Mappings

NIST AI RMF — MAP.1, MEASURE.2

EU AI Act — Art. 9, Annex IV

ISO 42001 — A.6.2

Sample Assessment Questions

1.Has the model vendor completed a SOC 2 Type II or equivalent audit?

2.Does the current model version introduce failure modes not present in the assessed version?

3.Has model output distribution changed measurably since the last assessment?

Operational Risk

Dimension 2 of 5

Risk arising from how the system is deployed and operated: deployment context, fallback procedures, escalation paths, incident response, and monitoring coverage.

Change Triggers

·Deployment context change (internal → patient-facing)

·Removal of human-in-the-loop

·Change in usage volume or user population

Framework Mappings

NIST AI RMF — MANAGE.2, MANAGE.4

EU AI Act — Art. 9(7), Art. 17

ISO 42001 — A.9.4

Sample Assessment Questions

1.Does the current deployment expose the system to end users not previously in scope?

2.Are fallback and escalation procedures defined for the current deployment context?

3.Has operational monitoring been configured for the current deployment environment?

Data Governance

Dimension 3 of 5

Governance of data inputs, outputs, and processing: data classification, consent, retention, deletion, cross-border transfer, and data processing agreement coverage.

Change Triggers

·Expansion of data types processed

·New cross-border data transfer

·Change in data classification

Framework Mappings

NIST AI RMF — MAP.3, MANAGE.3

EU AI Act — Art. 10

HIPAA Security Rule — §164.312

ISO 42001 — A.8.4

Sample Assessment Questions

1.Are the newly processed data types covered by the existing data processing agreement?

2.Does the expanded data scope require a new DPIA under GDPR or equivalent?

3.Have data retention and deletion policies been updated to reflect current data scope?

Compliance Mapping

Dimension 4 of 5

Crosswalk between current system state and applicable regulatory frameworks: control coverage, evidence sufficiency, and regulatory gap identification.

Change Triggers

·New framework enforcement (EU AI Act Art. 50 August 2026)

·Vendor change affecting existing compliance crosswalk

·Addition of regulated data types

Framework Mappings

NIST AI RMF — GOVERN.1

EU AI Act — Art. 6, Annex III

OCC AI Risk Guidance

ISO 42001 — A.4.1

Sample Assessment Questions

1.Does the vendor change affect coverage under NIST AI RMF GOVERN.1?

2.Has the prior compliance crosswalk been invalidated by a vendor or scope change?

3.Are active regulatory frameworks reflected in the current control mapping?

Transparency & Accountability

Dimension 5 of 5

Obligations for disclosure, explainability, accountability assignment, audit logging, and human oversight — including EU AI Act Article 50 and NIST AI RMF GOVERN.6.

Change Triggers

·System deployed in patient-facing context

·EU AI Act Article 50 enforcement (August 2, 2026)

·Change in accountability assignment

Framework Mappings

NIST AI RMF — GOVERN.6, MANAGE.1

EU AI Act — Art. 13, Art. 50

ISO 42001 — A.10.1

HIPAA — §164.308(a)(2)

Sample Assessment Questions

1.Is the system required to disclose AI involvement to end users under EU AI Act Art. 50?

2.Has accountability been formally re-assigned for the current deployment context?

3.Are AI decision logs and audit trails configured and retained per regulatory requirements?

VALIDATION METHODOLOGY

ARM-B: AI Risk Model Benchmark

EEARF and ARM-B are proprietary frameworks of Evolve Edge AI. Provisional patent filed May 5, 2026 (App. #64/057,822).

For research collaboration or licensing inquiries: k.green@evolveedgeai.com