The five EUQA controls
Every EUQA trust profile is built from the same five controls. They are deliberately small in number so a firm without a compliance team can complete them, and deliberately evidence-based so the result can be verified rather than self-declared.
1. AI Policy
Set clear rules for how people can use AI at work.
2. Responsible Owner
Name the person responsible for keeping AI use under control.
3. AI Literacy
Help people understand how to use AI safely, confidently and well.
4. AI Inventory
Know which AI tools, agents and automations your business uses.
5. AI Suppliers
Check the suppliers and dependencies behind the AI you rely on.
Why five
Each control answers one question a client, insurer or regulator actually asks. Together they cover what you use, who is responsible, what your people know, what rules apply and what you can prove.
Naming
Control three is AI literacy. We sometimes describe it as fluency, because in practice it is about people using AI well, but AI literacy is the term the obligation uses.