GovKM Proposed Standards and Guidance

Answer Review Questions with Inspectable Evidence

Support current and historical review questions with authorized evidence, usable source references and visible gaps.

GovKM-proposed public draft. Published for public review. Not externally accredited or endorsed.

Document

EICARS implementation guidance — proposed public draft. Checklist coverage: R09.1, R09.2, R09.3, R09.4. Prepared November 9, 2026. These suggested approaches support the published GovKM-proposed EICARS v0.1 draft; they do not add requirements or grant external accreditation.

Purpose and use

Support current and historical review questions with authorized evidence, usable source references and visible gaps.

Use this guide within a declared organizational scope, with existing repositories and suitable organizational processes. AI is optional. Examples and suggested evidence are implementation aids; the published standard governs a conformance assessment. The Riverton case below is fictional, not an observed deployment or test result.

Responsible roles

Business owners and authorized reviewers, with records and system support.

Assign responsibilities through the organization’s actual instruments. A suggested role in this guide does not itself confer decision authority.

R09.1 Retrieve evidence for declared tasks

Suggested approach: Define the operational or review questions the environment must support, including the relevant time and authorized audience. Provide a manual or automated route to the evidence needed for each task. Test meaningful business questions rather than only keyword search. No particular model or automated reconstruction method is required.

Riverton example: For Riverton, staff retrieve the approved target date, facilities findings and outstanding IT acceptance for an opening briefing. A historical review uses the appropriate earlier records.

Evidence and completion check: Retain the task description and evidence route. Have an authorized reviewer assemble the account, recording missing sources and whether the declared question can actually be answered.

R09.2 Identify sources and transformations

Suggested approach: Identify the source artifacts and relevant versions supporting an account. Explain material context, applicable approval evidence and transformations used to produce it. Keep citations usable by the intended authorized reviewer. Do not treat a generated summary or extracted passage as proof of facts absent from the source.

Riverton example: The Riverton briefing cites the approved date decision and inspection revision. It labels the unsigned modification as a proposal and distinguishes it from the executed contract record.

Evidence and completion check: Ask a reviewer to follow each material conclusion to the source. Retain the account, references and any transformation limitations that could affect interpretation.

R09.3 Report gaps and disputed evidence

Suggested approach: Report missing evidence, conflicts and unresolved questions alongside supported conclusions. Distinguish source observations from interpretation. Limit the account to the evidence available; do not imply complete recovery or certainty where relevant history is absent. Assign unresolved business questions to the responsible office.

Riverton example: Riverton’s facilities condition can be supported while overall readiness remains unresolved because IT acceptance is pending and staffing confirmation is unavailable to the account.

Evidence and completion check: Inspect the evidence gaps and resulting limitations in the briefing. Confirm that a reviewer can see which conclusion is supported, conditional or not established.

R09.4 Approve tests and assess AI separately

Suggested approach: Have the business owner approve expected outcomes before testing. Use representative normal cases, historical questions, conflicts and missing-evidence cases. Assess the information environment independently of any consuming AI, then evaluate a proposed model and integration for fidelity, citations, boundaries and appropriate uncertainty.

Riverton example: Riverton’s expected result is that a completed facilities inspection does not establish complete opening readiness. A confident “ready” answer fails the approved case even if it cites a real report.

Evidence and completion check: Keep the approved cases, expected results and actual observations. Record separate environment findings and model findings; do not attribute an unsupported answer to the corpus without evidence.

Evidence and completion checks

Agree the population, expected results and acceptance conditions before assessing. Record the date, assessor, evidence reference, observed result and limitation. Use approved safe examples for access, malicious-content or lifecycle tests. Documented policy and observed operating behavior are both relevant; one does not automatically prove the other.

On smaller screens, scroll the table horizontally to view every column.

Item	Suggested evidence and demonstration
R09.1	Retain the task description and evidence route. Have an authorized reviewer assemble the account, recording missing sources and whether the declared question can actually be answered.
R09.2	Ask a reviewer to follow each material conclusion to the source. Retain the account, references and any transformation limitations that could affect interpretation.
R09.3	Inspect the evidence gaps and resulting limitations in the briefing. Confirm that a reviewer can see which conclusion is supported, conditional or not established.
R09.4	Keep the approved cases, expected results and actual observations. Record separate environment findings and model findings; do not attribute an unsupported answer to the corpus without evidence.

Record a gap where the required outcome is not demonstrated. Assign an owner and review date, then verify any correction. Completion of this page alone does not demonstrate conformance with all ten domains, certify legal compliance, approve an AI deployment or authorize autonomous actions.

Common mistakes

Treating retrieval as proof; hiding missing sources; confusing an illustrative response with observed model performance.

Continue the checklist

Use this page with the EICARS standard, the identity guide and the full Riverton scenario. No particular product, model or repository migration is required.

Implementation overview

Suggested operating approach: assign the responsible roles, confirm applicability, implement suitable controls in the existing environment, examine operating evidence and track unresolved gaps. Tailor the methods to scale and risk. Maintain current services during preparation and preserve records, access and legal obligations throughout.

Standards traceability and references

Government Authority and References

U.S. federal reference review: November 9, 2026. These are GovKM mappings of relevance, not government endorsement or a legal compliance determination. Statutes and regulations are mandatory only within their scope; federal policy applies to covered agencies and uses; technical guidance and voluntary resources require the stated selection, adoption or contractual basis. Private and nonfederal organizations must identify their own governing requirements.

The eCFR is authoritative but unofficial. Retrieved Title 36 pages displayed currency through November 5, 2026. Source retrieval does not establish exhaustive legal currency or clause-level implementation compliance. Check current agency supplements, deviations, court orders, schedules, contracts and later amendments. Add the organization’s actual instruments and the qualified official’s applicability determination.

R09.1 — Retrieve evidence for declared tasks

36 CFR 1222.22, 1222.24, 1222.26 and 1222.28 — Documentation and recordkeeping
Issuing body: National Archives and Records Administration. Pinpoint: 1222.26(b). Relevance: Electronic retrieval.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1236.10 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.10(d), (f). Relevance: Usability and context.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
5 U.S.C. 552 — Freedom of Information Act
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: 552(a)(3)(B)–(D). Relevance: Scoped electronic search.
Classification: Statute — mandatory when applicable. Applicability: Covered agencies and responsive agency records; exemptions and exclusions apply.

GovKM recommendation boundary: The point-in-time task and reconstruction outcome are EICARS recommendations; FOIA does not mandate a new analytical answer or unrestricted disclosure.

R09.2 — Identify sources and transformations

44 U.S.C. 3101 — Agency documentation duties
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: 3101. Relevance: Decision documentation.
Classification: Statute — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NARA Bulletin 2015-04 — Transfer metadata
Issuing body: National Archives and Records Administration. Pinpoint: transfer metadata. Relevance: Source context.
Classification: Agency bulletin — requirements within stated transfer scope. Applicability: Transfers of permanent electronic records to NARA.
36 CFR 1236.14 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.14(b). Relevance: Migration documentation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.

GovKM recommendation boundary: The cited sources support the underlying governance outcome. This checklist’s packaging, evidence register and assessment format are GovKM recommendations unless separately adopted.

R09.3 — Report gaps and disputed evidence

5 U.S.C. 552a — Privacy Act
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: (d)(3)–(4), (e)(5). Relevance: Covered disputes and accuracy.
Classification: Statute — mandatory when applicable. Applicability: Covered agency systems of records and individuals, subject to definitions, exceptions and exemptions; section (m) can cover contractors.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section IV(C). Relevance: Documented deficiencies.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.
NIST AI 600-1 — Generative AI Profile
Issuing body: National Institute of Standards and Technology. Pinpoint: relevant suggested actions on confabulation. Relevance: Optional AI risk guidance.
Classification: Voluntary government guidance. Applicability: Generative AI risk management.

GovKM recommendation boundary: Uncertainty reporting is a recommended general practice; Privacy Act dispute rules apply only within their own scope.

R09.4 — Approve tests and assess AI separately

NIST SP 800-53A Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: assessment planning. Relevance: Expected assessment evidence.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Security/privacy control assessment; broader application is an adaptation.
OMB M-25-21 — Federal AI use
Issuing body: Office of Management and Budget. Pinpoint: 4(b); section 5. Relevance: High-impact AI testing.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Covered agency AI uses; high-impact provisions and national security/intelligence exceptions have distinct scopes.
NIST AI RMF 1.0
Issuing body: National Institute of Standards and Technology. Pinpoint: Measure function. Relevance: Voluntary AI evaluation.
Classification: Voluntary government framework. Applicability: Organizations evaluating AI; a policy or contract can incorporate selected practices.
OMB M-26-04 — Procured LLM principles
Issuing body: Office of Management and Budget. Pinpoint: principles and procurement implementation. Relevance: Covered LLM procurement.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Covered agency LLM procurement under the memorandum’s definitions and exclusions.

GovKM recommendation boundary: Business-owner approval of the proposed test is an EICARS assessment control, not a universal statutory sign-off requirement.

Federal AI-use, high-impact AI, AI-acquisition and covered LLM procurement requirements have distinct scopes and exceptions. Information preparation does not substitute for any applicable AI-use risk acceptance, information-system authorization, procurement or legal decision.

This section gives relevant official references for each covered checklist item and is not an exhaustive list of every possible obligation. The actual agency, program, records, data, system and contract determine additional duties. The EICARS organization of these tasks, suggested registers and completion checks remain GovKM recommendations unless independently required or adopted.

Version history

November 9, 2026 — Publication authorized by GovKM. Guidance based on checklist and government authority reference package checked November 5, 2026. References must be periodically revalidated.

November 9, 2026 — Expanded implementation guidance, version 0.1. Replaced the shorter implementation text with the reviewed Riverton examples, task-specific approaches, evidence checks and official authority mappings, with Robert Noyes’s approval. Existing URLs and checklist anchors are preserved. No EICARS requirement or GovKM doctrine is amended.