Research — Observed Ratings
AIQ™ Observed Ratings
An AI-governance rating for any publicly-listed company, built entirely from public data — no input or involvement needed from the company itself. Read your own public position, or benchmark peers, clients and counterparties.
Outside-in · Not certified
The premise
The frameworks don’t suggest quietly governing AI. They explain how to disclose it.
The anchor frameworks — NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OECD AI Principles, and GDPR — define 68 public disclosures an enterprise is expected to make about its AI governance. An AIQ™ Observed Rating reads which disclosures a company has published and which it has not.
That makes it useful in three directions: see how your own public position reads to an outsider, benchmark competitors, and screen clients, suppliers and portfolio companies — none of which needs their cooperation.
How it works
From public disclosure to a star rating.
Every credited finding is backed by a public source and by the framework clause that calls for it. Provenance is reported separately from the rating, so you can see how directly the evidence is attributable to the company.
68 disclosures the frameworks call for
The full AIQ™ methodology comprises 250 data points. 68 of them are things an anchor framework calls on a company to disclose publicly. Only those are rated, and each is recorded against the specific clause that calls for it — NIST GOVERN 2.1, ISO/IEC 42001 §5.3, EU AI Act Art. 17(1)(j), and so on.
Six parallel collectors, then a counter-verifier
Six collectors gather evidence independently: SEC filings, the company’s own website, AI product screens, regulator records, patents and research, and ESG reports. Each candidate finding is then passed to an independent counter-verifier that attempts to disprove it. A finding scores only if the counter-verifier fails to overturn it.
Tiered, weighted, and expressed in stars
Disclosures are not counted equally. Each carries a tier — Critical, Important, or Advanced — set by how many frameworks call for it, how severe the governance gap is in its absence, and how objectively it can be measured. Tiered results are weighted across the five governance dimensions and reported as a star rating, per dimension and overall, beside a Confidence Grade for the evidence behind it.
The rating
A star rating from 0–5, per dimension and overall.
Ratings are expressed in half-star steps, assigned in ten bands across the tiered, weighted result. A star rating records how much of the called-for disclosure was found and published — not a judgment of the company’s underlying governance. Alongside the count of disclosures found, it is the rating; the weighting behind the band is methodology, not a second score.
The scale runs 0–5, and the lowest rating awarded is half a star: a company with nothing published rates 0.5 rather than 0. The bottom of the scale is the lowest rating available, not a statement that the company has no AI governance.
What you receive
Six ratings: one for each dimension, and one overall.
A rating is not a single figure. Each of the five governance dimensions is rated on its own, so a company can read strongly in one and thinly in another — which is the point of reading the five together. The overall rating sits alongside them.
| Dimension | Weight | Found | Rating |
|---|---|---|---|
| Strategic Alignment | 20% | 5 | 3.5 |
| Oversight & Accountability | 30% | 4 | 3.5 |
| Technical Robustness | 25% | 7 | 4.0 |
| Responsible AI & Compliance | 15% | 14 | 3.5 |
| Adaptability & Education | 10% | 3 | 4.5 |
| Overall rating | 100% | 33 | 3.5 |
Shown to demonstrate the format of the deliverable. A real rating names its subject and cites a public source for every credited disclosure. Ratings are issued per company on request.
Collection
Six collectors, working in parallel.
Each collector gathers evidence independently, and each factor is attributed to the one that is its primary source of record.
SEC filings
10-K and 8-K filings, DEF 14A proxy statements, and investor materials. Company-authored, filed with a regulator.
Company website
Responsible AI pages, privacy policies, trust centres, transparency reports, and published technical documentation on the company’s own domain.
AI product screens
What a product actually tells its users: model and service cards, AI disclosure labels, content credentials, data-export and privacy-rights interfaces.
Regulator records
Public registries including the EU AI database, regulatory sandboxes and comment dockets, supervisory participant lists, and enforcement records.
Patents & research
USPTO filings, published research, open-source repositories, and standards-body participation.
ESG reports
Sustainability and CSRD reporting, human-rights impact assessments, and human-capital disclosure.
Counter-verification
Every finding is attacked before it is allowed to score.
A finding that survives collection is handed to an independent counter-verifier whose task is to disprove it — to establish that the disclosure does not say what the collector concluded, that it is not attributable to the company, or that it falls outside the currency window. Findings the counter-verifier overturns are discarded and never reach the rating. Where public sources conflict, the more conservative reading prevails.
Provenance
Where the evidence lives is reported separately from the rating.
A rating says how much of the called-for disclosure was found. Provenance says how directly that evidence is attributable to the company. The two are independent readouts and neither adjusts the other.
Published on the company’s own website or domain. The company controls the page and is the author of record.
Company-authored content hosted elsewhere — an SEC EDGAR filing, for example. The company wrote it; another party publishes it.
Third-party commentary, such as news coverage. Neither authored nor published by the company.
Evidence older than 12 months earns no credit. A disclosure found outside that window is reported as such rather than treated as absent — the frameworks look for current disclosure, so a lapsed one is a lapse, not a gap in our collection.
Where more than one source supports the same finding, the strongest available provenance applies.
Confidence Grade
How sure we are that the reading is reliable.
The stars measure how much the company has published. The Confidence Grade measures the evidence behind each credit: whether it appears in more than one place, whether it has appeared in more than one reporting period, whether the sources agree, and whether at least one source is the company’s own. It is reported beside the rating, per dimension and overall, and it never changes a star.
Company-authored source; appears in two or more in-window sources or two or more reporting periods; every source agrees.
Company-authored, but one source in one period (not tested against another), or sources disagreed and the conflict was resolved by correction or the conservative reading.
Third-party sources only. Still credited — provenance and confidence never remove credit.
Each found disclosure scores A = 2, B = 1, C = 0. A dimension’s grade is the average of its disclosures: A at 1.5 or above, B from 0.5 up to 1.5, C below 0.5.
A run grades A when at least two-thirds of its found disclosures grade A and all six ratings hold with every grade-C credit removed; B when at least one-third grade A and the overall rating holds without them; C otherwise.
A thin credit is still a credit. Provenance and confidence sit beside the rating and never remove a finding from it: a disclosure the company genuinely published counts whether we found it in two places or one.
The grade measures the evidence, not how close a rating sits to a band boundary. Margin — which credits a rating would lose on refresh — is reported separately, so neither is mistaken for the other.
What a low rating does and does not mean
A missing disclosure is a missing disclosure.
An Observed rating is built only from what a company has published. Where a called-for disclosure is absent, the rating records that it was not found — not that the underlying control is absent. A company may govern its AI well and disclose little; that company will rate lower than one which governs comparably and publishes what the frameworks call for.
Where a certification claim can be verified against a certifying body’s records and the disclosures that certification calls for are still absent, the report says so. It is a stronger finding, and it carries no additional weight in the rating.
Traceability
Two citations behind every credited finding.
Each credited disclosure is recorded twice over: the framework clause that calls for it, and the public source where it was found. A rating is a statement of opinion, and the factual premises of that opinion are disclosed in full so that any reader — including the rated company — can check them.
The framework clause that calls for the disclosure — for example ISO/IEC 42001 §5.3 or EU AI Act Art. 17(1)(j).
The public document where the disclosure was found, with the date it was retrieved.
A named company may request review of the public data underlying its rating. Engaging AIQA directly converts an Observed rating into a verified AIQ™ Score.
A worked report
What an Observed report looks like.
The report covers the subject and evidence window, the disclosures found and not found, the public source behind every credit, six star ratings (five dimensions plus overall), the Confidence Grade for each, the verification record, and the narrative that makes the result actionable. The sample subject is fictional. Its figures follow the published AIQ™ Observed Rating methodology.
Meridian Peak, Inc.
NYSE: MPKS- Run
- mpks-illus-2026-09-29 · rev 3
- Engine
- AIQ™ V3.3.1
- Evaluated
- 29 September 2026
- Evidence window
- 29 September 2025 – 29 September 2026
- Supersedes
- mpks-sample-2026-09-29
Overall rating
Found 33 of 68 called-for disclosures, tier-weighted within each dimension and then weighted across the five.
Confidence Grade
33
Found
Called-for disclosures found and credited
33
Not found
No public source found within the evidence window
2
Lapsed
Found, but last published outside the currency window
17
Sources
Distinct public sources inside the window
Provenance of found disclosures
What the company has published
- Strategy in public view. AI strategy, a two-year roadmap and measurable AI objectives are published on the company’s own site and summarised in the 10-K.
- Board oversight and staff rules. The proxy assigns AI oversight to the Audit & Risk Committee with semi-annual risk reports; a current acceptable-use policy bars client and personal data from public generative-AI tools.
- Clients, data rights and training. A client AI-use statement is tied to the services terms; the assistant is labelled as AI; access-request, profiling-objection and transfer routes and a role-specific AI curriculum are published.
Where called-for disclosure is missing
- Technical Robustness rates 1.5 stars. No independent validation, adversarial testing, testing methodology or documentation standard was found; human review of AI-drafted client work was last described June 2025 — lapsed.
- Incident handling. No AI incident-response plan, incident tracking or post-incident review was found — holding Oversight & Accountability at 2.0 stars despite board oversight.
- Management-layer controls. No ethics board, risk register or pre-deployment review was found; vendor-selection criteria last published November 2024 — lapsed; the sustainability report was unreachable and is recorded as not found.
Why the rating is defensible
- Counter-verifier: one finding overturned, one clean record confirmed. A news profile described a pre-deployment review board no company source supports (recorded as not found); a check of enforcement and litigation records found no AI violations.
- Correction and conservative reading. AI-accountability roles corrected from three to two after a departure; the lower of two conflicting steering-group readings was used.
- Traceability. Every found disclosure cites the framework clause that calls for it and the public source where it was found; 24 of 33 rest on the company’s own site, 3 on third-party sources only.
AIQ™ Observed Rating — Sample Report
The full report as issued: masthead and ledger, the five dimension write-ups with every credit and its source, the verification record, the Confidence Grade tables, peers and definitions.
Notice
AIQ™ Observed Ratings and AIQ™ Scores are statements of opinion as of the date expressed, not statements of current or historical fact.
Provided “as is” without warranties of any kind. An Observed Rating is built from public information without the subject company’s participation and reflects only what that company has published. Where a called-for disclosure is absent, the rating records that it was not found — not that the underlying governance control is absent. Ratings do not constitute regulatory compliance, certification, or legal assurance. A named company may request review of the underlying public data.
For informational purposes only. Not investment, legal, tax, or compliance advice, and not a recommendation to buy, sell, or hold any security, or to do (or refrain from doing) business with any entity.
Fictional subject — illustrative only. Meridian Peak, Inc., its ticker, its sources, its peers and its findings are invented to show the format of an Observed report. Any resemblance to an actual company is coincidental.
Methodology detail
The mechanics of AI disclosures.
Every Observed Rating is a statement of opinion, and we publish our full reasoning behind it. The detail that follows isn’t required reading, but is there for anyone who wants to verify a finding.
Not an AIQ™ Score
An Observed rating is not an AIQ™ Score and not an AIQA Certification. It runs on its own scale, measures a different thing, and is not comparable to a verified AIQ™ Score. Certification comes only through a direct engagement and cannot be earned through an Observed rating.
Coming next
Inferred Ratings
Observed ratings speak only to the 68 disclosures the frameworks call for publicly. Inferred ratings will map observed disclosure against the full 250-point corpus. They are in development and are not yet issued.
What Inferred Ratings will doAIQ™ Observed Ratings and AIQ™ Scores are statements of opinion as of the date expressed, not statements of current or historical fact.
For informational purposes only. Not investment, legal, tax, or compliance advice, and not a recommendation to buy, sell, or hold any security, or to do (or refrain from doing) business with any entity.
Every credited finding in an Observed Rating cites the framework clause that calls for the disclosure and the public source where it was found. The rating scale, the tiering, the dimension weights, and the behaviour of that weighting are published with the methodology.
Provided “as is” without warranties of any kind. An Observed Rating is built from public information without the subject company’s participation and reflects only what that company has published. Where a called-for disclosure is absent, the rating records that it was not found — not that the underlying governance control is absent. Ratings do not constitute regulatory compliance, certification, or legal assurance. A named company may request review of the underlying public data.
AIQ™ and AIQ Score™ are trademarks of AIQA Global, LLC. Scores do not constitute regulatory compliance, legal advice, or investment advice. No assurance is provided regarding future performance, risk outcomes, or insurance eligibility.