{
  "@context": "https://raw.githubusercontent.com/cloudronin/uofa/main/spec/context/v0.5.jsonld",
  "id": "https://uofa.net/iso42001/hybrid/cou1",
  "type": [
    "UnitOfAssurance",
    "CredibilityEvidencePackage"
  ],
  "synthetic": true,
  "conformsToProfile": "https://uofa.net/vocab#ProfileMinimal",
  "name": "Hybrid AIMS evidence — COU1: enterprise LLM-based knowledge retrieval (low risk)",
  "description": "ISO 42001 AIMS evidence package for COU1 of the iso42001 hybrid case study. Internal employee-facing LLM application that retrieves and summarizes information from the organization's internal knowledge base. Risk profile: Low. Hybrid construction: structural categories anchored in StackAware-style published AIMS materials (AI policy, AIMS scope, risk methodology, impact assessment methodology, SoA structure); supplemental categories (system inventory, data catalog, model evaluation, deployment config, monitoring, incident tracking) synthesized.",
  "couName": "COU1: enterprise LLM knowledge retrieval (internal employee assistant)",
  "intendedUse": "Internal employees query the assistant for information from the organization's knowledge base. The assistant returns retrieved snippets with citations.",
  "assuranceLevel": "Low",
  "decision": "Accepted",
  "modelRiskLevel": 2,
  "bindsRequirement": "https://uofa.net/iso42001/hybrid/cou1/req",
  "hasContextOfUse": {
    "id": "https://uofa.net/iso42001/hybrid/cou1/cou",
    "type": "ContextOfUse",
    "name": "Internal LLM knowledge retrieval (employee-facing)",
    "intendedUse": "Internal employees query for organizational knowledge.",
    "decisionConsequence": "Low",
    "modelInfluence": "Low",
    "description": "End users are employees; outputs supplement (not replace) human judgment; no external-party impact."
  },
  "hasEvidence": [
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/policy",
      "type": "https://uofa.net/vocab/aims#AIPolicy",
      "name": "Enterprise AI Policy v1.2 (low-risk deployment context)",
      "https://uofa.net/vocab/aims#policyText": "https://internal.example/policies/ai-policy-v1.2",
      "https://uofa.net/vocab/aims#approvalSignatory": "https://uofa.net/iso42001/hybrid/cou1/cao",
      "https://uofa.net/vocab/aims#approvalDate": "2026-01-20T00:00:00Z",
      "https://uofa.net/vocab/aims#reviewCadence": "annual",
      "https://uofa.net/vocab/aims#nextReviewDate": "2027-01-20T00:00:00Z"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/scope",
      "type": "https://uofa.net/vocab/aims#AIMSScope",
      "name": "AIMS Scope Statement (knowledge retrieval deployment)",
      "https://uofa.net/vocab/aims#approvalSignatory": "https://uofa.net/iso42001/hybrid/cou1/cao"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/objective",
      "type": "https://uofa.net/vocab/aims#AIMSObjectiveStatement",
      "name": "AIMS Objective: maintain user-rated answer accuracy ≥ 90%",
      "https://uofa.net/vocab/aims#objectiveStatement": "Maintain user-rated answer accuracy ≥ 90% on the production retrieval pipeline.",
      "https://uofa.net/vocab/aims#targetMeasure": "90% accuracy threshold",
      "https://uofa.net/vocab/aims#measurementCadence": "monthly"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/role-aims-owner",
      "type": "https://uofa.net/vocab/aims#RoleAssignment",
      "https://uofa.net/vocab/aims#roleName": "AIMS Owner",
      "https://uofa.net/vocab/aims#assignedPerson": "https://uofa.net/iso42001/hybrid/cou1/person/aims-owner"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/role-data-steward",
      "type": "https://uofa.net/vocab/aims#RoleAssignment",
      "https://uofa.net/vocab/aims#roleName": "Data Steward",
      "https://uofa.net/vocab/aims#assignedPerson": "https://uofa.net/iso42001/hybrid/cou1/person/data-steward"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/risk-register",
      "type": "https://uofa.net/vocab/aims#RiskRegister",
      "name": "AI Risk Register Q1 2026 (knowledge retrieval scope)",
      "description": "8-entry register: hallucination/confabulation, stale-info-surfaced, retrieval-relevance-degradation, embedding-drift, prompt-injection (low-risk for internal-only), citation-misattribution, output-comprehensibility, user-overreliance."
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/impact-assessment",
      "type": "https://uofa.net/vocab/aims#ImpactAssessmentRecord",
      "name": "AI system impact assessment v1.0 (COU1)",
      "https://uofa.net/vocab/aims#assessor": "https://uofa.net/iso42001/hybrid/cou1/person/aims-owner",
      "https://uofa.net/vocab/aims#assessmentScope": "End-user productivity and information accuracy impacts",
      "https://uofa.net/vocab/aims#assessmentDate": "2026-02-15T00:00:00Z",
      "https://uofa.net/vocab/aims#identifiedRisk": [
        "confabulation",
        "stale information",
        "user overreliance"
      ],
      "https://uofa.net/vocab/aims#mitigationStrategy": "Citations + freshness indicators + user feedback loop",
      "https://uofa.net/vocab/aims#nextReviewDate": "2027-02-15T00:00:00Z",
      "https://uofa.net/vocab/aims#affectedStakeholder": [
        "internal employees",
        "knowledge owners"
      ]
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/data-prov",
      "type": "https://uofa.net/vocab/aims#DataResourceProvenance",
      "https://uofa.net/vocab/aims#dataResource": "https://uofa.net/iso42001/hybrid/cou1/data/internal-kb",
      "https://uofa.net/vocab/aims#provenanceStage": "ingestion",
      "https://uofa.net/vocab/aims#hasNextStage": "https://uofa.net/iso42001/hybrid/cou1/data-prov-2",
      "sourceReference": "https://uofa.net/iso42001/hybrid/cou1/source/internal-kb-snapshot"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/data-prov-2",
      "type": "https://uofa.net/vocab/aims#DataResourceProvenance",
      "https://uofa.net/vocab/aims#dataResource": "https://uofa.net/iso42001/hybrid/cou1/data/internal-kb",
      "https://uofa.net/vocab/aims#provenanceStage": "consumption",
      "sourceReference": "https://uofa.net/iso42001/hybrid/cou1/source/internal-kb-snapshot"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/monitor",
      "type": "https://uofa.net/vocab/aims#OngoingDataQualityMonitoring",
      "https://uofa.net/vocab/aims#monitoringMethodology": "Weekly stratified-sample retrieval quality check, monthly aggregate dashboard",
      "https://uofa.net/vocab/aims#dataType": "internal-kb-text"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/audit",
      "type": "https://uofa.net/vocab/aims#AuditResultsRecord",
      "https://uofa.net/vocab/aims#auditedFunction": "AIMS controls A.5, A.6, A.7 (deployed scope)",
      "https://uofa.net/vocab/aims#auditDate": "2026-03-10T00:00:00Z",
      "https://uofa.net/vocab/aims#auditFindings": "2 minor observations; no nonconformities."
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/control-a52",
      "type": "https://uofa.net/vocab/aims#AIMSControl",
      "https://uofa.net/vocab/aims#controlIdentifier": "A.5.2",
      "https://uofa.net/vocab/aims#controlName": "AI system impact assessment process",
      "https://uofa.net/vocab/aims#designEffectiveness": "3",
      "https://uofa.net/vocab/aims#operationalEffectiveness": "2"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/control-a624",
      "type": "https://uofa.net/vocab/aims#AIMSControl",
      "https://uofa.net/vocab/aims#controlIdentifier": "A.6.2.4",
      "https://uofa.net/vocab/aims#controlName": "AI system V&V",
      "https://uofa.net/vocab/aims#designEffectiveness": "2",
      "https://uofa.net/vocab/aims#operationalEffectiveness": "2"
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/control-a74",
      "type": "https://uofa.net/vocab/aims#AIMSControl",
      "https://uofa.net/vocab/aims#controlIdentifier": "A.7.4",
      "https://uofa.net/vocab/aims#controlName": "Data resource provenance",
      "https://uofa.net/vocab/aims#designEffectiveness": "3",
      "https://uofa.net/vocab/aims#operationalEffectiveness": "3"
    }
  ],
  "bindsClaim": [
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/claim/policy",
      "type": "https://uofa.net/vocab/aims#AIPolicyAppropriatenessClaim",
      "name": "Claim: AI policy is appropriate to organizational purpose",
      "hasSupportingEvidence": [
        "https://uofa.net/iso42001/hybrid/cou1/policy"
      ]
    },
    {
      "id": "https://uofa.net/iso42001/hybrid/cou1/claim/control-a624",
      "type": "https://uofa.net/vocab/aims#ControlOperationalEffectivenessClaim",
      "name": "Claim: control A.6.2.4 operates effectively at low-risk assurance level",
      "https://uofa.net/vocab/aims#claimsControl": "https://uofa.net/iso42001/hybrid/cou1/control-a624",
      "hasSupportingEvidence": [
        {
          "id": "https://uofa.net/iso42001/hybrid/cou1/impl-a624",
          "type": "https://uofa.net/vocab/aims#ControlImplementationRecord",
          "description": "V&V SOP applied to all 4 deployed model versions in COU1 scope."
        },
        {
          "id": "https://uofa.net/iso42001/hybrid/cou1/assess-a624",
          "type": "https://uofa.net/vocab/aims#ControlEffectivenessAssessment",
          "description": "Self-assessment by AIMS owner: V&V was performed on all deployed versions."
        }
      ]
    }
  ],
  "wasDerivedFrom": "https://uofa.net/iso42001/hybrid/construction-v0.4",
  "wasAttributedTo": "https://uofa.net/iso42001/hybrid/case-study-author",
  "generatedAtTime": "2026-05-06T00:00:00Z",
  "hash": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
  "signature": "ed25519:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
  "hasWeakener": [],
  "hasDecisionRecord": {
    "id": "https://uofa.net/iso42001/hybrid/cou1/decision",
    "type": "DecisionRecord",
    "actor": "https://uofa.net/iso42001/hybrid/cou1/person/aims-owner",
    "role": "AIMS owner",
    "outcome": "Accepted",
    "rationale": "AIMS evidence is structurally complete for the low-risk knowledge retrieval COU. Self-assessment of control effectiveness is acceptable evidence at this assurance level; OOS firings on independent-verification, methodology-validation, and audit-independence-attestation are surfaced and contextualized as appropriate-for-Low-risk per ISO 42001 risk-proportionality.",
    "decidedAt": "2026-05-06T00:00:00Z"
  },
  "adversarialProvenance": {
    "generatorVersion": "iso42001-hybrid-cou1-v0.4",
    "toolVersion": "uofa-cli 0.5.0",
    "promptTemplateVersion": "case-study-anchor-v0.1.0",
    "specId": "iso42001-hybrid-cou1",
    "generationTimestamp": "2026-05-06T00:00:00Z",
    "targetWeakener": null,
    "targetDefeaterType": "case-study",
    "coverageIntent": "case-study-cou1-low-risk",
    "sourceTaxonomy": "case-study/aims/low-risk-knowledge-retrieval",
    "evidenceGapDescription": "COU1 expected dual output (per spec §2.6.4): small C3 firing set; OOS firings expected for control-operational-effectiveness (each declared control), policy-appropriateness, audit-independence — but contextualized as appropriate-for-Low-risk per ISO 42001 risk-proportionality. The OOS firings inform the auditor about the next layer of evidence that would be available without claiming the bundle is inadequate for the assurance level being claimed."
  },
  "hasValidationResult": "https://uofa.net/iso42001/hybrid/cou1/audit"
}