{"id":"5027176d-42c2-4018-aec2-ea782b9b835a","arxiv_id":"2509.08852","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper presents the TÜV AUSTRIA Trusted AI audit catalog, a statistical framework based on the Stochastic Application Domain Definition, minimum performance requirements, and independent-sample testing for certifying AI systems.","lead":"This white paper describes the TÜV AUSTRIA Trusted AI framework, a three-pillar audit catalog for certifying machine learning systems, and shares lessons from years of practical audits. It matters because it offers one of the first concrete paths for turning the EU AI Act's high-level requirements into testable, statistically grounded certification criteria.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SADD interpretation ambiguity undercuts the certificate's statistical guarantee: error control is relative to a text-defined distribution that different informed users can operationalize differently.","rationale":"The reader's weakest_assumption identifies exactly the SADD operationalizability issue, and I agree that it is load-bearing. The paper's own acknowledgment in Section 5.1.4 confirms that the SADD is not a formal mathematical object, yet the entire statistical testing procedure assumes a well-defined reference distribution. The 'average informed user' concept, borrowed from product liability law, does not provide a unique operationalization. My proposed concrete test would empirically assess whether this ambiguity is material in practice. If auditors substantially agree on the sampling process, the concern is mitigated; if not, the certificate's guarantees are vacuous. I keep the reader's CONDITIONAL verdict because the statistical reasoning itself is sound and the limitations are disclosed, but the framework's central premise remains unvalidated. The paper should either provide a formalization path for SADD or report evidence that inter-auditor interpretation is consistent.","tokens_in":45858,"tokens_out":4078,"duration_ms":45950,"concrete_test":"Conduct an inter-rater reliability study using representative SADDs from completed audits. Have several qualified auditors, blinded to each other, independently convert each SADD into a concrete sampling plan and inclusion/exclusion criteria based solely on the text. Apply these plans to a common pool of candidate data points and measure agreement on sample inclusion (e.g., Cohen's kappa) and the resulting performance estimates. If the estimated metric (e.g., accuracy) differs across raters enough to change an MPR pass/fail decision, or if kappa is below a pre-agreed threshold (e.g., 0.7), the certificate's guarantees are interpretation-dependent and the central claim is not robust.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that an audited system passing the statistical tests can be certified as meeting defined performance requirements with controlled error probability (Section 4.1). This guarantee is meaningful only if the Stochastic Application Domain Definition (SADD) identifies a unique reference distribution for sampling. The paper admits in Section 5.1.4 that 'the SADD is usually provided as a text and cannot be fully formalized in a mathematical sense' and instead invokes the legal construct of an 'average informed user.' If two informed users interpret the SADD differently, they may sample from different populations, and the binomial test of Section 5.1.5 controls type I error only with respect to whichever distribution the auditor happens to operationalize. The certificate's claim then becomes conditional on a subjective interpretation, not an objective property of the system in its actual application domain. This is not a mere implementation gap; it is a logical gap between the formal statistical guarantee and the operational premise on which it rests. The paper's honest admission of this limitation does not resolve it, and the 'average informed user' is a legal placeholder, not a mathematical definition.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This white paper presents the TÜV AUSTRIA Trusted AI audit catalog, a conformity-assessment methodology for machine-learning systems aligned with the EU AI Act. The framework rests on three pillars: secure software development, functional requirements, and ethics/data privacy. The core methodological claim is 'functional trustworthiness': an AI system's application domain is defined statistically through a Stochastic Application Domain Definition (SADD), minimum performance requirements (MPRs) are set from risk analysis and legal obligations, and MPRs are verified by statistical tests on independently sampled data. The paper then surveys key certification topics—data leakage, robustness, OOD detection, adversarial examples, distribution shift, uncertainty, bias, fairness, explainability—and post-certification monitoring and retraining, including FWER control via fixed-sequence and fallback procedures. It also reports 'typical mistakes' from the authors' audit practice.","tokens_in":46073,"tokens_out":13817,"duration_ms":138394,"significance":"If the framework holds, this is one of the few concrete operationalizations of AI Act conformity assessment, and it usefully translates legal obligations into testable statistical criteria. The statistical tools used (binomial test, Bonferroni correction, closed testing procedures) are standard and correctly applied in the worked examples. The paper is honest about its limits: Section 3.2 states it is not an accredited scheme, and Section 5.1.4 concedes the SADD cannot be fully formalized. However, the central guarantee is conditional on the SADD being an unambiguous reference distribution, and the paper's own caveat shows this is not achieved. The paper also contains no empirical evidence for its 'lessons learned,' so its value is primarily as a practitioner-oriented methodology description.","major_comments":[{"comment":"Central claim in §4.1 is statistical guarantees of expected performance, defined with respect to the reference distribution p(x) fixed by the SADD. §5.1.4 concedes the SADD 'is usually provided as a text and cannot be fully formalized' and invokes the 'average informed user' to define the 'true' application domain. Different informed users can operationalize the same text differently, yielding different sampling distributions; §5.1.5 tests then control type I error only for whichever distribution the auditor happens to use. Thus the certificate's guarantee is conditional on a subjective interpretation, not a property of the system in a well-defined domain. The honest admission does not resolve the gap. Please either require a fully operationalized SADD (explicit inclusion/exclusion criteria and a mechanical sampling protocol), or restrict the certificate's claim to the operationalized re","section":"§5.1.4 (with §4.1 and §5.1.1)"},{"comment":"The definition of unbiasedness in this central sampling section is incorrect. The text says an estimator is unbiased if it 'reflects the true value across the application domain if it is evaluated on a large enough sample and there are no systematic deviations.' Unbiasedness is a finite-sample property: E[θ̂] = θ for the given sampling design; the 'large enough sample' property is consistency. Please correct the definition and ensure the surrounding discussion of variance and estimation follows from standard definitions.","section":"§5.1.3"},{"comment":"The fixed-sequence testing section states that 'The sequence terminates as soon as a hypothesis cannot be rejected, as all subsequent hypotheses will also be non-rejectable.' This is a procedural rule of the fixed-sequence scheme, not a statistical property of the hypotheses; in the fallback procedure, later hypotheses can still be tested with their allocated weight. As written, the sentence could mislead readers implementing the procedure. Please rephrase and clarify the distinction between the testing algorithm and the underlying FWER control property.","section":"§6.2"}],"minor_comments":[{"comment":"'The corresponding significance level can be set even higher for particularly critical elements' should read 'lower' (i.e., stronger evidence); a higher α makes rejection easier, which is presumably not intended for critical MPRs.","section":"§5.1.2"},{"comment":"The table reports a confidence interval [0.885, 1.000] for n=100, which appears to be a one-sided interval, but the text does not say so. Specify whether intervals are one- or two-sided and state the method (e.g., Clopper-Pearson).","section":"§5.1.5"},{"comment":"The formula (1-α)^n for 'the probability of not falsely rejecting at least one' assumes independent tests. Bonferroni-style FWER control does not require independence. Please state the assumption or label the formula as an illustration.","section":"§5.1.6"},{"comment":"Equation (7) writes the epistemic term as I(p(y,w|x,D)); standard notation is I(y; w | x, D), the mutual information between the target and the parameters. Please fix the notation.","section":"§5.3.4"},{"comment":"The paper uses 'certification' freely, but §3.2 correctly states the scheme is not accredited and the certificate is only a conformity statement. This caveat should also appear in the abstract or introduction to avoid overclaiming.","section":"Abstract / §3.2"},{"comment":"The two-stage shift-detection approach applies two-sample tests to features from a learned encoder. The statistical validity of those p-values depends on treating the encoder as fixed; please state the assumptions or use a data-splitting / conditional-testing framework.","section":"§5.3.3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is heavily self-referential: the SADD, functional trustworthiness, and the key bound in Eq. (10) come from the authors' own prior publications (Nessler et al. 2023, Schmid et al. 2024, Zellinger 2020). I did not find this to be a circularity, but the editors should ask the authors to clarify the incremental contribution of this manuscript relative to those works. The paper is also a hybrid of tutorial review, position statement, and audit catalog description, with no empirical evaluation; if the journal does not normally publish white papers, this should be considered. The SADD formalization issue in §5.1.4 is the main substantive obstacle; it is fixable by restricting the claim or by requiring an operationalized protocol."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nRead through the TÜV AUSTRIA white paper on certifiable AI. The short version: it is an honest, professional description of an audit catalog that maps the EU AI Act to concrete checks, and the genuinely new parts are the practical audit findings (data leakage examples, common pitfalls) and the discussion of FWER control across retraining cycles. I don't think the core SADD idea is new—it is from their earlier papers—but the lessons-learned material is not available elsewhere.\n\nWhat the paper does well: it is transparent about scope. It explicitly says in Section 3.2 that the scheme is not accredited, and in Section 5.1.4 that the SADD is usually a text that can't be fully formalized and relies on an 'average informed user'. That level of honesty is rare. The statistical methods (binomial test, Bonferroni, fixed-sequence and fallback procedures) are standard and correctly presented. The monitoring and retraining section is a reasonable application of multiple-testing control to a tricky problem.\n\nThe soft spots are real but not disqualifying. The biggest is the one the authors admit: the statistical guarantee is only as precise as the SADD. If different informed auditors interpret the text differently, the reference distribution changes and the test controls error relative to that interpretation. The paper leans on a legal construct to paper over this. I think this is an inherent limitation of any text-based standard rather than a fatal flaw, but it does mean the certificate's claim should be phrased as 'conditional on the auditor's reading of the SADD', not as an unconditional property. The lack of empirical data—no audit counts, no inter-auditor agreement, no outcomes—also weakens the lessons-learned section. And the core concepts are self-cited from the same group, which lowers novelty but doesn't invalidate the approach.\n\nWho is this for? Anyone working on AI assurance, conformity assessment, or AI Act compliance. It is a useful reference for the TIC sector. It would benefit from peer review—especially from statisticians who can push on the SADD formalization and from auditors who can suggest how to test inter-rater reliability. I would not cite it in my own work immediately, but if I were writing on AI certification, I'd want to cite the lessons-learned part.\n\nRecommendation: send it to a serious referee. It is not a breakthrough, but it is a solid, honest piece of operational guidance that deserves engagement rather than desk rejection.","headline":"A transparent audit catalog for EU AI Act compliance; the new value is in the practical audit lessons and the retraining FWER discussion, but the SADD's interpretative flexibility keeps the statistical guarantee conditional.","tokens_in":46612,"tokens_out":2499,"would_cite":false,"duration_ms":25934,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An AI certificate can be made into a reproducible statistical claim about performance on a defined application domain.","keywords":["functional trustworthiness","Stochastic Application Domain Definition","AI certification","EU AI Act","minimum performance requirements","statistical testing","data leakage","distribution shift"],"falsifier":"Have several competent auditors, given the same SADD and the same deployed system, independently draw a test sample according to their reading of the sampling strategy. If their measured performance estimates differ by more than sampling variability would allow, the certificate's guarantees are not reproducible.","tokens_in":45735,"feed_emoji":"✅","tokens_out":4494,"duration_ms":43280,"temperature":0.7,"pith_summary":"The paper argues that an AI system can be certified as trustworthy only if its performance is checked against a precisely specified population: the application domain, defined as a stochastic sampling recipe, risk-based minimum performance requirements, and a statistical test on independently sampled data. It presents this 'functional trustworthiness' principle as the core of an audit catalog that translates the EU AI Act's obligations into testable criteria for data, model development, robustness, fairness, and monitoring. If the principle is right, a certificate is not a subjective opinion but a reproducible claim that a system meets its stated performance requirements with a controlled error probability. The paper also reports practical failure modes—data leakage, inadequate domain definitions, neglected biases, missing drift controls—that the audit procedure is designed to catch.","feed_headline":"Certify AI by sampling the domain it must survive","feed_subtitle":"A white paper ties EU AI Act duties to risk-based performance tests on independently drawn data.","key_machinery":"The Stochastic Application Domain Definition (SADD) carries the argument. It is a three-part recipe: (1) description of the data-generating process and operating context, (2) technical requirements for valid inputs, and (3) a sampling strategy that specifies the reference distribution for evaluation. The SADD matters because without it the reported performance metric has no well-defined population, so the statistical test has nothing to test against and the certificate cannot be reproduced.","core_discovery":"The central claim is that functional trustworthiness—not general robustness or generic safety—should anchor AI certification. Functional trustworthiness couples three components: a Stochastic Application Domain Definition (SADD) that turns the intended use into a reference distribution p(x) through an explicit sampling strategy; minimum performance requirements derived from risk analysis and desired quality characteristics; and a valid statistical test of those requirements on independent samples drawn according to the SADD. The paper claims this coupling makes performance evidence transparent and reproducible, allows third parties to replicate the evaluation, and gives the certificate's gua","pith_inferences":["The SADD's reliance on the 'average informed user' suggests a testable quality gate: before certifying, an auditor could measure inter-rater agreement among several informed users who independently write sampling strategies from the same SADD; low agreement would expose an ambiguous domain definition.","The same statistical core could be extended to post-market surveillance: continuous monitoring with sequential testing would let certificates be maintained across updates while controlling cumulative error, an extension the paper lists as future work.","For foundation models and general-purpose AI, which lack a fixed application domain, the SADD approach would have to be inverted—defining a minimal set of operating conditions under which the model can be certified—rather than a single reference population.","The adversarial-robustness assessment could be made quantitative in the same minimum-performance-requirement style by setting an explicit maximum perturbation budget and testing whether the model's accuracy under that budget exceeds a threshold, mirroring the framework's treatment of accuracy."],"forward_implications":["If the framework is correct, a certified system's performance claim is a statistical claim: the system exceeds its minimum performance requirements at a predefined family-wise significance level, not merely on one benchmark.","Test data 'representativeness' becomes operational: a test set is representative when it is an independent random sample per the SADD, giving Article 10(3) of the EU AI Act a concrete interpretation.","Multiple performance requirements on the same dataset require multiple-testing corrections such as the Bonferroni correction or closed testing procedures; otherwise the certificate's error control is void.","A retrained or updated model cannot inherit its predecessor's certificate; sequential procedures such as fixed-sequence testing or the fallback procedure would be needed to control error rates across update cycles.","Distribution-shift monitoring can substitute for label-hungry performance monitoring, because the maximum possible performance drop under a domain shift is bounded by the total-variation distance between the original and shifted distributions."],"supporting_citations":[{"why":"Introduces the principle of functional trustworthiness that the framework builds on.","marker":"[Nessler et al., 2023]"},{"why":"Presents the first version of the audit catalog whose practical lessons this paper extends.","marker":"[Winter et al., 2021]"},{"why":"Supplies the sampling-theory basis for the SADD's reference distribution and sampling strategies.","marker":"[Lohr, 2021]"},{"why":"Details the SADD concept and the average informed user interpretation.","marker":"[Schmid et al., 2024]"},{"why":"Backs the taxonomy of data-leakage scenarios used in the functional requirements.","marker":"[Kapoor and Narayanan, 2023]"},{"why":"Provides the multiple-comparison correction for testing several minimum performance requirements.","marker":"[Bonferroni, 1936]"},{"why":"Proves the fallback procedure controls the family-wise error rate for sequential re-testing after model updates.","marker":"[Wiens and Dmitrienko, 2005]"},{"why":"Supplies the total-variation bound connecting domain shift to worst-case performance drop.","marker":"[Zellinger, 2020]"}],"fun_headline_variants":["Sample the domain to certify AI","Risk-based tests prove AI trust","Domain sampling meets EU AI Act","Functional trustworthiness: AI certification key","Certify AI by statistical domain testing"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The certificate's validity assumes that the written application-domain definition is precise enough that different informed people agree on what counts as a valid test sample; the paper concedes that the SADD is text and cannot be fully formalized.","fun_headline_variants_meta":{"raw":{"variants":["Sample the domain to certify AI","Risk-based tests prove AI trust","Domain sampling meets EU AI Act","Functional trustworthiness: AI certification key","Certify AI by statistical domain testing"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000313,"raw_usage":{"total_tokens":1626,"prompt_tokens":768,"completion_tokens":858,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":512,"completion_tokens_details":{"reasoning_tokens":800}},"tokens_in":512,"tokens_out":858,"duration_ms":8272,"temperature":1.0,"reasoning_tokens":800,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T22:50:08.671984+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have several competent auditors, given the same SADD and the same deployed system, independently draw a test sample according to their reading of the sampling strategy. If their measured performance estimates differ by more than sampling variability would allow, the certificate's guarantees are not reproducible.","supporting_citations":[],"review_version":1}