Must be established as a legal entity in an EU Member State (or third country with Article 39 bilateral agreement — none exists with US yet). National accreditation (ISO 17065 or 17020) from the member state's notifying authority. Permanent staff with technical competence in AI/ML, relevant domain, and EU legal framework. Documented impartiality procedures. Professional indemnity insurance. Application via notifying authority → Commission → NANDO database listing.

Connecticut DCP administers a multi-year IVO pilot. Up to 5 IVOs approved — hard cap. Pilot begins July 1, 2027. IVOs execute an MOU with DCP defining scope, methodology, reporting, and governance. Companies receiving IVO verification gain evidentiary support in civil litigation. UConn's Institute for Municipal and Regional Policy evaluates the pilot. MOU framework not yet published — rule-making period is open now. DCP has discretion to set technical requirements.

Study bill only. Directs JCOTS (Joint Commission on Technology and Science) to evaluate IVO feasibility. Report due to legislature November 1, 2026. Passed 84–14 House, 40–0 Senate — strong bipartisan signal. No operational IVO program until 2027 legislative session at earliest; operational program 2028 at earliest. File stakeholder input to JCOTS before November report.

Re-run a representative subset of EQSB scenarios on a scheduled cadence (monthly/quarterly). Compare outputs against the original baseline evaluation using similarity scoring. Detect behavioral regressions in any of the 8 EQSB dimensions. Generate automated drift reports with timestamps and cryptographic attestation (links to Gap 4). Alert thresholds trigger mandatory re-assessment. This is proprietary — statistical monitoring tools (Evidently AI, Arize, NannyML) do not do this.

SHA-256 hashing of every scenario input, model response, and evaluation output at moment of capture. RFC 3161 trusted timestamp from accredited timestamp authority (DigiCert or Sectigo — both commercially available). Digital signature using certificate from recognized CA. Append-only immutable log with cryptographic integrity verification. Chain-of-custody document template for each report (who ran evaluation, on what system, what time, what model version). Assessment staff must not have administrative access to modify logs after generation.

NIST SP 800-92 (log management + integrity), NIST SP 800-86 (forensic chain of custody), ISO/IEC 27001 Annex A 5.28 (evidence collection), ISO/IEC 27037 (digital evidence), RFC 3161 (trusted timestamping — legally recognized in EU under eIDAS Article 41, increasingly cited in US courts).

OCC Bulletin 2026-13 (joint with Fed + FDIC, supersedes SR 11-7) applies to banks with $30B+ in assets (and smaller banks with significant model risk). Preserves: model inventory, conceptual soundness validation, ongoing monitoring, third-party model validation, performance benchmarking. What changed: more principles-based, uniform $30B threshold, generative AI and agentic AI explicitly carved out pending forthcoming RFI, increased board-level governance emphasis. Third-party models (AI vendors used by banks) must be incorporated into the bank's MRM framework regardless of source code access.

Gen AI is excluded from April 2026 guidance but banks are already deploying it. The OCC gen AI RFI (expected 2026) will likely lead to guidance requiring behavioral validation — ikwe.ai's EQSB methodology is more appropriate for gen AI validation than statistical SR 11-7 methods. Entry strategy: sell gen AI behavioral validation as a preparedness product at community and regional banks ($5B–$30B assets) that are underserved by Big Four validation firms.

NYC LL144 requires a specific adverse impact ratio calculation using the four-fifths (80%) rule — a quantitative measurement showing selection rates by gender and race/ethnicity. This is not currently in EQSB's scenario-based methodology. Building this module unlocks both NYC LL144 standalone engagements AND the multi-state bundle. This is the single most important product buildout for the bundle.