Stage 5: Test and validate | ClearPath AI Governance

What this stage is for

Prove before launch that the system performs as intended, treats groups fairly and resists misuse. AI systems are probabilistic, so passing functional tests is not enough: you also need accuracy, bias, robustness and security testing, and for generative AI, red-teaming.

Who is involved

Engineering and data science, Product owner, Security, Risk and compliance.

Key outputs: Test plan, test and bias reports, red-team record.

Step-by-step tasks

Tick each task as you complete it. Your ticks stay in this browser tab unless you export your workspace.

Write a test plan with metrics, methods, data sets and thresholds before testing starts.
Test accuracy overall and by group, and compare error rates, not just overall accuracy.
Test security, including prompt injection, data leakage and misuse.
For generative AI, run red-team exercises and record what was found and fixed.
Have someone independent of the builders sign off the results.

Region callouts

Shown for the regions in My regions (header). The region pages are never hidden.

High-risk systems must meet accuracy, robustness and cybersecurity requirements, and providers keep documentation of testing. European Union page

Some US employment rules require independent bias audits of hiring tools (for example New York City). Scope and definitions differ by rule. United States page

Test for discrimination against the Equality Act's protected characteristics where decisions affect people. United Kingdom page

No AI-specific testing rule applies generally. Use the national guidelines and sector expectations as a guide. India page

Tools and templates

Tools

Evidence checklist: Tick what you can produce today.
Evidence tracker (per system): Track evidence for each system, with coverage across systems.
Testing and monitoring plan builder: Define what to test and what to watch.
Bias metrics calculator: Fairness indicators from your own CSV, computed in your browser.

Templates

Bias testing report: MD, DOCX
LLM application security checklist: MD, DOCX
Model validation checklist: MD, DOCX
Testing and validation plan: MD, DOCX
All templates for every stage

Common mistakes

Testing only overall accuracy.
Setting thresholds after seeing results.
Skipping security testing because the model is vendor-supplied.

You're done when…

A signed test plan and results exist for each system.
Bias and security results are recorded.
Failures have actions with owners.

Reviewed 3 Oct 2026.

← Stage 4: Design controls and document · Stage 6: Approve and deploy →