TrustEval is an open-source toolkit for evaluating the trustworthiness of generative foundation models, including language, vision-language and text-to-image models. It generates fresh test data for each run instead of using a fixed test set. Test cases are varied to check consistency, and a judge model assesses each response. Results cover safety, fairness, robustness, privacy and truthfulness, and are presented in an interactive report.

The GCC AI and Data Protection checklist is an open checklist for companies in Qatar that use AI tools with personal data. It applies Qatar’s Personal Data Privacy Protection Law and the Qatar Financial Centre Data Protection Regulations 2021. Its 13 points cover tool inventories, lawful basis, special data, AI provider contracts, transfers, impact assessments, automated decisions and breaches. Each point cites the legal article it rests on.

Bernstein is an open-source Python tool for running multiple AI agents in parallel under rules set in configuration files. A language model splits a goal into tasks, and a non-AI scheduler assigns them to agents. Each agent works in a separate workspace. Automated checks test each output before it is merged. Runs are logged and can be replayed. Signed receipts allow runs to be verified offline.

RAIL-HH-10K is a dataset of 10,000 examples, split 8,000 / 1,000 / 1,000 into train, validation and test sets. Each example pairs a harmful response with a safe response, and both carry detailed annotations with explanations. Every example is scored on eight ethical dimensions: fairness, safety, reliability, transparency, privacy, accountability, inclusivity, and user impact. The examples are built from Anthropic’s HH-RLHF base dataset.

FAIRLENS is a benchmark and evaluation framework for measuring fairness (across demographic attributes such as gender, race, and age) and response validity of vision-language models used in high-stake...

OpenGuardrails is an open, vendor-neutral protocol for AI agent safety and security. It lets organisations integrate guardrails once and enforce them across all their agents and models. For each model call, an integration sends the request and the response to a runtime for a verdict. Detectors from different vendors plug into a common contract. A neutral benchmark ranks conformant detectors. The protocol covers harmful content and system compromise.

EduFair-Bench is a benchmark for auditing the pedagogical fairness of LLM tutors. It tests whether tutoring quality changes with student demographics. Tutors guide a simulated student through maths, physics and chemistry problems. The student’s demographic profile varies across gender, immigration background, first language and socioeconomic status. An LLM judge validated against human annotators scores each turn on five teaching metrics. Paired statistical tests measure bias.

Unofficial OWASP Agentic Top 10 Checklist is a free self-assessment tool from Decision Terrain. It reviews one agentic AI application against the OWASP Top 10 for Agentic Applications 2026. Thirty checks cover ten risks, including goal hijack, tool misuse, memory poisoning and rogue agents. Users record evidence, gaps and next actions for each check. Answers stay in the browser and can be exported. OWASP has not endorsed the tool.

nvTrust is NVIDIA’s open-source repository of tools for confidential computing on NVIDIA GPUs. It focuses on attestation, which cryptographically proves that a GPU and its environment are genuine and untampered with. An Attestation SDK supports local and remote verification of GPUs and NVSwitches. A Protected PCIe verifier covers multi-GPU systems. Host tools configure confidential computing modes and launch confidential virtual machines.

AI System Inventory and Agent Register is a governance tool from the AI Assurance Institute. It keeps one record per AI system, linked to stakeholders, use cases, misuse cases, capabilities and agents. Each record captures purpose, provider, accountability, personal data use and a first-pass EU AI Act risk class. An agent registry tracks autonomy levels, permitted tools and high-risk tool combinations. Records follow a draft, review and approve workflow.

AI-related Regulations and Standards Implementation and Assurance is a set of workbenches from the AI Assurance Institute. It helps organisations implement and assess compliance with the Cyber Resilience Act, DORA, NIS2 and EN, ETSI, ISO and NIST standards. Process owners work from action lists. They identify requirements, risks and controls. They then build a roadmap, produce artefacts and assess compliance. Dedicated flows also cover AI agent control and multi-agent systems.

AI Bias Auditing Tool is a Python tool for detecting bias in tabular datasets. Users upload a CSV file and choose a sensitive attribute and an outcome column. The tool calculates approval rates for each group. It then measures the Demographic Parity Difference using Fairlearn. Results are shown as charts and a short bias audit report. The tool runs in Google Colab and is designed for beginners.

The EU AI Act Obligation-to-Evidence Dataset is an open, machine-readable dataset mapping EU AI Act obligations to the evidence an auditor expects. It is published by EU AI Regulation Decoded, an independent practitioner project. Each obligation is linked to its legal source, applicable roles, risk categories, deadline, audit red flags and citations. The current early release covers 14 obligations, some still under review. It is not legal advice. It is released under a CC BY 4.0 licence.

CREST's nine Principles for AI-enabled Activities provide a practical foundation for responsible AI use in cybersecurity. They establish shared expectations for the governance and oversight of AI-enabled activities, covering accountability, transparency, documentation, human oversight, data handling, security, secure development, supply chain assurance and resilience. The Principles support cybersecurity service providers in addressing the opportunities, risks and responsibilities associated with AI use and contribute to trust, transparency and accountability in AI-enabled cybersecurity services.

The CREST AI Charter is a voluntary commitment supporting responsible AI use across the cybersecurity profession. It brings together organisations that recognise the importance of shared principles, professional standards and industry collaboration. Charter Signatories publicly support CREST's nine Principles for AI-enabled Activities and contribute to an international industry initiative promoting trust, transparency, accountability and assurance in AI-enabled cybersecurity services.

TrustLLM is a framework and open-source toolkit for evaluating the trustworthiness of large language models. It was presented at ICML 2024 by an international team led by researchers in the United States. It proposes principles for trustworthy models and a benchmark covering truthfulness, safety, fairness, robustness, privacy and machine ethics. The benchmark draws on more than 30 datasets. A public leaderboard ranks 16 leading models. The code is released under the MIT licence.

The MLCommons Jailbreak Benchmark v1.0 is a benchmark for evaluating how well large language models withstand jailbreak attacks, which are prompts designed to bypass safety safeguards. It was published by MLCommons, an industry and academic consortium. The benchmark applies known jailbreak techniques to prompts across eleven hazard categories. Results are compared with a safety baseline to show how much attacks weaken a system’s safety. Systems are graded on how often they produce content that violates safety standards.

xsoft comply is a Python software development kit that records the operations of AI systems to support record-keeping under Korea’s AI Basic Act. It records model calls, tool use, decisions and human reviews, and lets developers attach structured evidence for specific articles of the Act. Raw content is not sent by default, and common personal data is masked. Records are linked so changes can be detected. It is an early-stage product and does not certify compliance.

Agent Barn is an open-source control plane for running and governing AI agents on an organisation's own infrastructure. It was built by AAI Labs in Lithuania. Agents connect to team chat tools such as Slack and Microsoft Teams, and act on systems such as GitHub and Jira. Access roles control who manages each agent. Audit logs record conversations and tool calls, and costs are attributed to each agent. It is released under the Apache 2.0 licence.

The CREST Accreditation Standards set requirements for organisations that provide cyber security services, verified through independent assessment. They are published by CREST, an international not-for-profit body. Three components address AI. Domain 7 requires all accredited organisations to govern their use of AI, including validating AI-supported outputs. Annex B sets requirements for using AI in penetration testing, with human validation of findings. A third standard covers security testing of generative AI and large language model-enabled systems.