In brief

Eric Zielinski argues that most enterprise AI-governance programs manage the systems surrounding a model—risk classifications, registries, output monitoring, vendor attestations and red-team exercises—without providing visibility into how the model actually reaches decisions. This limitation becomes critical when AI is used for security operations, coding, incident response or other high-consequence workflows: organizations may know that a model produced a harmful result but cannot determine whether the cause was an incorrectly weighted feature, poisoned training data, prompt injection or a reproducible blind spot. The problem is compounded by growing dependence on proprietary AI embedded in security platforms and business software, where customers remain responsible for the consequences despite having no access to the underlying model.

To address this gap, Zielinski is releasing CIRCUIT—Circuit-Informed Risk & Control, Understanding, Inventory & Transparency—as an open-source AI-interpretability governance framework. It includes a maturity score ranging from opaque models to continuous circuit-level analysis, a machine-readable registry for documenting evidence about each AI system, and a risk score that combines interpretability, deployment risk and the consequences of model decisions. CIRCUIT also maps its controls to frameworks such as the NIST AI RMF, the EU AI Act, ISO/IEC 42001 and MITRE ATLAS, while providing a vendor questionnaire intended to expose transparency limitations. Released under the Apache 2.0 license, the project seeks contributions from security practitioners who can test its scoring model, expand regulatory mappings and refine its controls for real-world deployments.

Source: FIRST

‍