Keep the purpose of the evaluation, the system and version tested, the relevant configuration, the approved test set or its controlled reference, results, and the reviewer’s decision. Explain the intended use and limitations so a strong result in one setting is not mistaken for evidence about every setting. Track issues through correction and any retesting. Protect test data and sensitive outputs appropriately. A useful record lets another qualified person understand what was evaluated and why the team accepted the result. A single score without context is difficult to use when the product, provider, or business use changes.
Related: SOC 2 audit and compliance hub.
Further reading: NIST Generative AI Profile.
