Agent
Norma generates and runs adversarial scenarios at a scale no human team would attempt by hand: biased output, confident nonsense, agents pushed outside their scope, and drift between versions. Every run is recorded.
Introducing
Norma.
by Ethics Code
The agent, the framework and the service to red team your AI.
Norma tests your AI systems for bias, blind spots and bad habits before they shape a decision.
Design partner spots are limited each quarter.
Three levels. You choose the depth.
Name the standard. Put the agent in your environment. Add a person who signs the conclusion.
- 01
Identify
Assessed against
The work starts by naming the measure. One framework, or more than one. The criteria have to fit how the system is used.
- EU AI Act
The direction of travel for high-risk systems in Europe.
- NIST AI RMF
A governance reference you can defend ahead of a mandate.
- ISO 42001
The management-system standard for AI.
- NYC LL 144
Bias-audit obligations for automated employment decisions.
- Custom frameworks
Your own criteria, when a published standard does not fit.
-
- 02
Embed
Agents in your ecosystem
The agent joins through the interface you expose. Access is the level you grant. Every run is recorded.
- Read only
Observes the system and keeps the evidence. Nothing is written back.
- Alerts
Flags bias, drift, and behavior that leaves the baseline.
- Intervene
Can take the action you authorize when a run leaves the agreed scope.
-
- 03
Sign
Human in the loop
The third level adds the service. A named reviewer reads the findings and signs. On the cadence you set, the agent runs the assessment again so that signature stays current.
- Human in the loop
A reviewer signs every conclusion. An automated report stays an opinion.
- Recurring assessment
The same audit is run again on a set cadence, or when the model, vendor, or data changes.
- Augmented service
Our reviewers join the engagement. The agent does the volume. The name on the conclusion stays a person.
-
How it works
Service
A subject matter expert reviews the findings and signs the conclusion. Their name goes on the assessment. An automated report is an opinion. A signed conclusion is evidence.
Framework
The framework turns those runs into a credibility case someone can read a year later.
- 01 Context of use
What the system is for, and what it is not for.
- 02 Risk tier
How much the model influences a decision, and how serious the consequence is.
- 03 Assessment plan
What will be tested, against which criteria, and why those criteria fit the tier.
- 04 Execution
Protocols run, with the evidence retained.
- 05 Findings
What failed, what was remediated, what remains.
- 06 Conclusion
Fit for the stated context of use, or not.
- 07 Lifecycle plan
What is monitored after go-live, and what triggers a reassessment.
What you get
The credibility dossier
One versioned document that answers how you know this AI is fit for the use you are putting it to.
- Context of use and risk tier
- Assessment plan and acceptance criteria
- Protocols run, with evidence retained
- Findings, remediation, and residual risk
- Signed conclusion, with the reviewer on record
- Lifecycle monitoring plan
The audit trail
Every model version, prompt, run, and reviewer decision, timestamped and exportable.
The monitoring
Models drift. Vendors update. Data moves. Re-testing against your baseline, with alerts when behavior changes enough to matter.
Who it is for
The risk is the decision the system can shape.
Life sciences
Protocol deviation, adverse events, medical coding, site monitoring.
Testing produces the traceable record GxP already expects.
Financial services
Credit support, fraud and AML triage, agents with account access.
Independent validation is already expected. AI adds opacity, drift, and fairness.
Insurance
Claims triage, underwriting assistance, fraud scoring.
Fairness scrutiny, and a duty to explain an adverse decision.
Public sector
Eligibility, procurement, case priority, citizen-facing assistants.
The standard of evidence is public.
Autonomous agents
Was the action authorized, and can you show who approved it?
A different question than whether the answer was right.
Teams selling into the EU can cover that direction of travel on the scoping call.
How we work with you
- 01
Scoping call
One context of use to start. A single well-evidenced assessment beats a survey of everything you run.
- 02
Baseline assessment
Fixed fee. Context of use, risk tier, assessment plan, and a signed dossier.
- 03
Continuous monitoring
Retainer. Re-test on a set cadence, and when the model, vendor, or data changes.
Design partners get the baseline at a reduced rate for working closely on the framework, and keep preferential terms afterward.
Become a design partnerRed team your AI before it shapes a decision.
An Ethics Code product.