The five EUQA controls
Every EUQA trust profile is built from the same five controls. They are deliberately small in number so a firm without a compliance team can complete them, and deliberately evidence-based so the result can be verified rather than self-declared.
1. Governance
Maintain the policy and operating rules for AI use.
2. Ownership
Assign a named person accountable for AI oversight.
3. AI literacy
Record how staff are supported to use AI responsibly — the practical fluency behind the obligation.
4. Inventory
Know which AI tools and digital workers your business uses.
5. Verification
Publish evidence that clients, insurers and procurement teams can check.
Why five
Each control answers one question a client, insurer or regulator actually asks. Together they cover what you use, who is responsible, what your people know, what rules apply and what you can prove.
Naming
Control three is AI literacy. We sometimes describe it as fluency, because in practice it is about people using AI well, but AI literacy is the term the obligation uses.