Assessment engine
What is ARIE?
ARIE is the assessment engine within AIRAS Cloud, described on the public engine page as the AIRAS Regulatory Intelligence Engine. It applies deterministic, version-controlled rules to recorded inputs and preserves reasoning for review. It supports regulatory assessment and operational risk governance; it does not grant approval, replace legal advice or allow a favourable score to override a prohibition.
Author accountable for content: Richard Higgins · Designated reviewer: Amy Feery (owner review pending) · Source checked 2026-10-28 by the development assistant. No human review or independent assurance is claimed.
Short answer
ARIE is the assessment engine within AIRAS Cloud, described on the public engine page as the AIRAS Regulatory Intelligence Engine. It applies deterministic, version-controlled rules to recorded inputs and preserves reasoning for review. It supports regulatory assessment and operational risk governance; it does not grant approval, replace legal advice or allow a favourable score to override a prohibition.
Source checked 2026-10-28; owner review pending. General information for governance planning, not legal advice.
Key points
- Identical inputs and the same approved ruleset version should yield reproducible reasoning.
- AI qualification, role, prohibitions and classification are distinct questions.
- Detection confidence, regulatory classification and operational risk are not interchangeable.
- An authorised person owns the final decision and its conditions.
What deterministic assessment means
A deterministic engine evaluates supplied facts under explicit rules rather than asking a generative model for an opinion about whether the use should proceed. Reproducibility requires the input snapshot and the ruleset version: identical labels without those dependencies are not sufficient evidence.
Version control matters when methodology or configuration evolves. A later assessment should not silently reinterpret a historical decision. The retained record must show what was assessed under which rules, with its reasoning and evidence, so a reviewer can understand the original result.
Separate the questions before combining the record
A potential AI capability first needs factual qualification and a context of use. Operator role, prohibited-practice screening, high-risk classification and applicable obligations are separate regulatory questions. Operational risk, control readiness and evidence completeness must also be considered without collapsing them into one confidence number.
A high-confidence discovery signal only indicates confidence in the finding. It does not mean the use is high-risk, lawful or approved. Conversely, uncertainty about a finding is a reason to obtain evidence rather than a basis for automatic acceptance.
Controls, evidence and the human decision
The engine output informs the governed review. Reviewers need the inputs, rationale, applicable controls, unresolved facts and evidence quality—not only a score. Named authorised people determine whether the use should proceed, proceed with conditions, remain open for further evidence or be restricted.
A prohibition is a gate, not a score to average away. A favourable numerical result cannot make a prohibited practice acceptable. The governing principle, AI does not approve AI, keeps decision ownership with a competent authorised person rather than the model or the engine.
Where ARIE sits in the platform
AIRAS Cloud connects intake and assessment to control ownership, evidence, review, decision, monitoring and export. ARIE is the assessment capability within that lifecycle; Shadow AI Defence is an evidence-led discovery entry point with its own human confirmation and handoff boundaries.
The public engine and risk-assessment pages explain the operating model. Proprietary configurations, production weights, expressions and customer records are not public reference material and are not disclosed by this answer.
Limits of the claim
Repeatable software reasoning is not a legal opinion or regulatory approval. Input quality, approved configuration, role and deployment context affect the result. Internal regression tests can support source behaviour; they do not prove a live deployment is isolated, externally penetration-tested or certified.
An organisation remains responsible for its use of AI and for obtaining appropriate professional advice. Review the Trust Centre and agreed release evidence before relying on deployment or assurance claims, and request a synthetic demonstration to understand the workflow without sharing confidential material.
Primary sources
How AIRAS Cloud supports this
Related answers
Turn the regulation into an operating record
AIRAS Cloud gives Irish and EU organisations one accountable place to discover AI, determine scope, classify defensibly, assign controls and evidence every decision.
No commercial commitment. No confidential information required.