Gates & Checks
Quality at every stage. Resilience in every release. Flawless experiences every time.
What are the GATES checks?
Boards and auditors ask the same two questions about any AI system in production. Who approved it, and what was it tested against? GATES gives every model and agent a record that answers both.
GATES covers Governance, Assurance, Trust, Evals and Security. A model or agent passes each of the five checks before release and again after it changes.
Repeating the checks matters because a system that passed in March can behave differently in June without anyone editing it, once its data, prompts or upstream models shift. Each check leaves documentation that governance and audit teams can review directly.
Governance has not kept pace with adoption, and in a Deloitte survey of 3,235 IT and business leaders across 24 countries, only 21% said their organization has a mature governance model for agentic AI. Gartner expects 40% of organizations deploying AI to implement dedicated AI observability tools by 2028, and OWASP places prompt injection at the top of its list of LLM application risks. Auditors will increasingly expect evidence on both fronts, covering how each model is monitored and how it was tested against attack.
Services
What does each GATES check cover?
Governance
Every model and agent in production needs an accountable owner. We help you name that owner and record the policy the system operates under. We also agree who can override the system and define the escalation route for cases it cannot resolve. Boards and regulators ask about ownership early, and this check creates that record.
Assurance
A written AI policy carries weight with auditors only when each release is tested against it, and assurance tests each release against the policy written for it and files the results where audit teams can find them. Approval then rests on evidence from that specific release.
Trust
Business users rely on AI only when they can understand its answers, and explainability reviews and bias monitoring build that understanding. As that confidence grows, the business can hand the system more work.
Evals
Because real customer queries rarely look like a pre-release test set, we build evaluation sets with the business and agree acceptance thresholds before release, and grading continues in production. Nimbus builds test questions from your own knowledge base and scores responses on dimensions such as accuracy, safety and compliance. It also tracks regressions over time.
Security
Prompt injection tops the OWASP list for LLM applications. An agent with tool access adds a second concern, because a manipulated instruction can trigger a real action such as a payment or a record change. We test every input the system accepts for prompt injection and data leakage. Each agent is limited to the tools it needs, and the tests repeat after any change. OWASP’s Top 10 for Agentic Applications adds risks such as goal hijack and tool misuse, and we test agents against that list.
How does a GATES review work?
A review moves through the below steps, and the last one keeps running for as long as the system is live.
Scope
We agree which model or agent is in scope, what it is used for, who owns it and which policies apply to it.
Test
We run the five checks against the system as it is deployed, including its prompts, data sources and tool permissions.
Report
You receive a score for each check and a gap report with a prioritized plan to close each gap.
Retest
The affected checks repeat each time the model, its data or its dependencies change.
Quantifiable proof points
Proof from a GenAI chatbot evaluation
Source: QKTech Helps Leading Indian Insurer Evaluate its Gen AI-powered Chatbot
424
test cases executed, built from annotated questions and answers and their variations
89.2%
answer correctness
93.9%
factual accuracy, measured as grounded responses
94.3%
context relevance
6.1%
hallucination rate found in testing
How does GATES apply in your industry?
Regulators and tolerance for error differ by industry. Our teams shape the below checks around those conditions.
Banking and financial services
Banks answer to regulators on explainability and accountability. India’s RBI FREE-AI framework sets out seven guiding principles and 26 recommendations across governance, innovation and consumer protection. Agentic systems add a testing problem, because identical inputs no longer produce identical outputs. Our banking teams therefore pair pre-release evaluation with production monitoring.
Insurance
An insurer’s chatbot must understand a query, retrieve the right information and answer accurately within one conversation. For a leading Indian insurer, we evaluated each of those steps, along with error handling and integration with the insurer’s information database. The results appear in the metrics above.
Automotive and manufacturing
Fleet owners expect conversational access to live vehicle data. For a leading automotive OEM, we prepared test data for 38 question categories, from fuel consumption to breakdowns. We then applied retrieval-augmented evaluation to measure and reduce hallucinations.
Healthcare and medtech
Clinical and commercial AI, such as triage assistants and pharmacovigilance models, needs outputs that remain explainable and supported by evidence that withstands regulatory review. GATES adds guardrail testing and drift monitoring to those systems.
Challenges we’ve met
Success Stories
Latest Insights
FAQs
Common questions about GATES
These answers cover what AI program owners and risk teams ask us first.
What are the GATES checks?
GATES covers Governance, Assurance, Trust, Evals and Security. QKTech applies these five checks to a model or agent at release and after each later change. Each check leaves evidence that governance and audit teams can review.
What do we receive at the end of a GATES review?
You receive a score for each check and a gap report. The report includes a prioritized plan to close the gaps, along with documentation for your governance and audit teams.
Do the checks apply to AI agents as well as models?
Yes. For an agent, the checks also cover the tools it may call and the actions that need a person’s approval. They also cover how it recovers when an upstream system fails.
What is the difference between evals and assurance?
Evals measure how well the system performs, for example its accuracy and hallucination rate. Assurance proves that one specific release met the policy written for it. It also records that proof for audit.
Can you check a GenAI chatbot that already exists?
Yes. A leading Indian insurer needed this for its chatbot. We ran 424 test cases on Nimbus to measure answer correctness and hallucination rate.
Talk to a Reliability of AI lead
Describe the model or agent nearest to release, or a live one that has not been retested since launch. A Reliability of AI lead will reply with a readiness view and the checks we would run first.