---
title: Questions Association Leaders Ask About AI | Cimbiotic
description: "Direct answers to what association leaders ask about AI chatbots: testing, Board reporting, risks, standards and cost. From Cimbiotic."
image: https://www.cimbiotic.ai/hubfs/cimbiotic-og.png
---

[Skip to content](https://www.cimbiotic.ai/questions#main)

[Cimbiotic](https://www.cimbiotic.ai/)

Menu

[Home](https://www.cimbiotic.ai/)[AI Red Teaming](https://www.cimbiotic.ai/ai-red-teaming)[CimAssure](https://www.cimbiotic.ai/cimassure)[Pricing](https://www.cimbiotic.ai/pricing)[About](https://www.cimbiotic.ai/about)[Insights](https://www.cimbiotic.ai/insights) [Free Scorecard](https://www.cimbiotic.ai/scorecard)

---

Questions & answers

# Questions association leaders ask about AI

Short, direct answers on testing chatbots, reporting to your Board, and what could go wrong. Each one links to the full detail. This is general information, not legal advice.

[Awareness](https://www.cimbiotic.ai/questions#awareness) [Consideration](https://www.cimbiotic.ai/questions#consideration) [Board and governance](https://www.cimbiotic.ai/questions#board) [Specific risks](https://www.cimbiotic.ai/questions#risks) [Solution and provider](https://www.cimbiotic.ai/questions#providers) [Cost and fit](https://www.cimbiotic.ai/questions#cost) [About Cimbiotic](https://www.cimbiotic.ai/questions#about-cimbiotic)

Awareness

## Do we have a problem?

### Who is responsible when our association's AI chatbot gives a member the wrong answer?

To a member, the answer came from your association, whoever built the chatbot. Legal responsibility depends on your vendor contract, how the chatbot is presented to members and the law where you operate, and the law on AI accountability is still unsettled, so ask your counsel. What a Board can control is knowing what the chatbot says and keeping evidence that someone checks it. We are not a law firm, and this is not legal advice.

[Read the full article →](https://www.cimbiotic.ai/insights/who-is-liable)

### Is our association liable for what a vendor's chatbot tells members?

Whether you are liable depends on your contract with the vendor, how the chatbot appears to members, and the law that applies to you. That is a question for counsel, and a vendor contract alone may not settle it. You can still do three practical things: read what the contract says about errors and incident notice, ask for those terms in writing, and keep independent evidence of how the chatbot behaves. This is general information, not legal advice.

[Read the full article →](https://www.cimbiotic.ai/insights/what-an-ai-vendor-contract-can-and-cannot-do-for-your-association)

### What AI risks should an association's Board be asking about?

A Board does not need technical expertise. It can ask its chief staff executive where AI is used, including in software already paid for, which uses touch member data, which are member-facing and how their accuracy is checked, and who is the single accountable person. It should also ask what members have been told, and how a problem would be detected and a system stopped. Good answers are specific, admit unfinished work and name who will finish it.

[Read the full article →](https://www.cimbiotic.ai/insights/ai-governance-for-associations-what-boards-should-ask)

### How do I find out what AI tools our staff and vendors are already using?

Ask. Start with your software vendors: which AI features run on your account, and do they touch member data. Then ask every department, committee chairs and reviewers, without blame, and don't skip certification and exam programs. Record every use in one inventory with its purpose, users, data, human review and owner, and review it whenever vendors change features.

[Read the full article →](https://www.cimbiotic.ai/insights/how-to-find-the-ai-already-running-in-your-association)

### Are vendor claims about chatbot safety enough, or do we need to check ourselves?

Vendor claims describe a platform in general, not your policies, your documents or your configuration. A vendor's own testing is useful evidence, but the vendor chose the tests and ran them at one point in time. Ask what the tests cover, then get an outside check of your own deployment.

[Read the full article →](https://www.cimbiotic.ai/insights/four-questions-to-ask-when-a-vendor-says-we-already-test)

Consideration

## How do we test it?

### How do we test a member-facing chatbot at an association with minimal technical staff?

Test it the way a member would, through the public front door, with no access to settings or logs. Collect real questions from your inbox and help desk, including awkward ones about refunds, eligibility and deadlines. Save each exact answer with its date, and have someone who knows the subject grade it as correct, incomplete, wrong or something it should not have answered. Repeat after any change, or ask an independent party to do it.

[Read the full article →](https://www.cimbiotic.ai/insights/how-do-we-test-whether-our-member-facing-chatbot-is-giving-accurate-answers)

### How do we independently test an AI chatbot our association bought from a vendor?

An independent tester works from the outside, through the same channels your members use, and only on an assistant you have authorized. It needs no access to the vendor's internals and no vendor cooperation. Every message and reply is kept as evidence, and a person reviews each verdict. CimAssure works this way.

[How CimAssure works →](https://www.cimbiotic.ai/cimassure)

### How do we know if our vendor's chatbot update changed its behavior?

Only by testing again. Hosted AI changes without notice, so a result describes the system on the day it was tested. Keep a fixed set of high-stakes questions, record the model version and settings each time, and re-run them after every known change and on a regular schedule. CimAssure re-tests on a regular schedule and on demand when the AI changes, and shows when a result moves.

[Read the full article →](https://www.cimbiotic.ai/insights/is-the-ai-you-tested-the-same-ai-you-are-running-today)

### Is testing a vendor's chatbot ourselves enough, or do we need an independent party?

Testing it yourselves is far better than not testing. Its limits are that staff tend to ask what the chatbot already handles well, and that you are grading a deployment you are responsible for. An independent party brings questions you didn't think of, published criteria and no stake in the result, which gives a Board evidence it can rely on.

[Read the full article →](https://www.cimbiotic.ai/insights/testing-your-own-ai-is-quality-control)

### What is the difference between AI quality control and independent assurance?

A vendor testing its own AI is quality control: useful, but the vendor picks the tests and reports to itself. Independent testing is assurance: an outside party with no commission, referral fee or stake tests your own deployment, keeps the evidence and can report a failure. Assurance is also repeated over time, not done once.

[Read the full article →](https://www.cimbiotic.ai/insights/testing-your-own-ai-is-quality-control)

### How often should an association re-test its AI chatbot?

On a regular schedule, and whenever something changes: a vendor model update, an edit to the chatbot's content or settings, a complaint, or a new feature. Before each Board meeting that will discuss AI is a good extra checkpoint. CimAssure repeats the tests on a regular schedule and on demand when the AI changes.

[Read the full article →](https://www.cimbiotic.ai/insights/is-the-ai-you-tested-the-same-ai-you-are-running-today)

### How do we test a chatbot for wrong policy answers, made-up sources and data leaks?

Use three groups of tests. Policy tests check that the chatbot follows your rules, accuracy tests check that its answers and cited sources are real and correct, and data tests check that it won't reveal other members' information. Record every reply word for word, and count a timeout or non-response as a failure, not a pass.

[See the Framework →](https://www.cimbiotic.ai/framework)

### What should we ask an AI vendor in writing about how they test their product?

Ask four things. Who chose the tests, and did outsiders review them? Do the scenarios fit an association, with member records and Board scrutiny? How does the product perform for outside users? How current is the result, and would you be told if it declined? Also ask whether the vendor trains on your data and how quickly it will tell you about an incident.

[Read the full article →](https://www.cimbiotic.ai/insights/four-questions-to-ask-when-a-vendor-says-we-already-test)

Board and governance

## What do we tell leadership?

### Our Board asked who is watching our AI chatbot. What do we tell them?

Tell them what is actually in place: an inventory of AI uses, a named owner for each, regular independent testing, and evidence they can read. If something is missing, say so and name who will close the gap by when. The Board should expect evidence, not reassurance that the vendor handles it. An independent Assurance Statement gives them a rating and the chatbot's own words to review.

[How CimAssure works →](https://www.cimbiotic.ai/cimassure)

### What should an AI assurance report for an association Board include?

It should state what was tested and when, which version of the tests was used, and a plain-language rating for each assistant. It should quote the chatbot's exact words behind every finding, say what was not covered, and list the actions that need attention. A CimAssure Assurance Statement is written by one person, approved by another, and rated Green, Amber, Red or Not rated.

[How CimAssure works →](https://www.cimbiotic.ai/cimassure)

### How do we show members that we govern our AI responsibly?

Say how you use AI, and back the statement with evidence. Disclosure on its own is an admission; disclosure backed by independent assurance is a claim of competence. Reports are private to you unless you choose to publish them.

[Read the full article →](https://www.cimbiotic.ai/insights/what-should-we-tell-members-who-ask-how-our-association-uses-ai)

### Does an AI test replace a SOC 2 report or an audit?

No. A SOC 2 report covers a vendor's security controls, and an audit examines an organization's processes. An AI test checks what the AI actually says and does when a member uses it. CimAssure is not a certification, audit or attestation, and it does not replace a SOC 2 report. Most associations will want both kinds of evidence.

[See the CimAssure FAQ →](https://www.cimbiotic.ai/cimassure#faq)

### What does a Green, Amber, Red AI rating mean for a Board?

Green means the assistant behaved as expected across the risks tested, with no significant findings, so it is reasonable to rely on with continued monitoring. Amber means it is generally sound, but findings need management attention within a set timeframe. Red means serious failures, such as leaked data, unsafe advice or unauthorized actions, so act now and consider restricting use. Not rated means there wasn't enough reviewed evidence to form a view.

[How CimAssure works →](https://www.cimbiotic.ai/cimassure)

Specific risks

## What could go wrong?

### What are the risks of an AMS-connected chatbot for associations?

A chatbot connected to your association management system can see member records, so the stakes are higher than for a chatbot that only reads public pages. The main risks are revealing one member's data to another, giving wrong answers about dues, status or deadlines, and acting on a record it should not touch. Test what it says and what it can reach, from the outside, as a member would.

[How CimAssure works →](https://www.cimbiotic.ai/cimassure)

### Can an association chatbot leak another member's data?

Yes, if it can reach member records or internal documents and its limits fail. Testing means asking for other people's information directly and indirectly, and checking that the chatbot refuses every time and keeps refusing after updates. Data handling has its own group of tests in our versioned test library, and tests use synthetic members, never real member data.

[See the Framework →](https://www.cimbiotic.ai/framework)

### Can members trick our chatbot into ignoring its rules (prompt injection, jailbreaks)?

Yes. Prompt injection and jailbreaks are attempts to talk a chatbot out of its instructions, and anyone who can type to it can try. A chatbot that refuses once may not refuse every time, so these attacks need to be tested repeatedly and the exact replies kept. Our test library covers both, mapped to the OWASP Top 10 for LLM Applications.

[About AI Red Teaming →](https://www.cimbiotic.ai/ai-red-teaming)

### What happens if our chatbot gives wrong advice about certification or CE requirements?

A member may act on it, miss a deadline or a requirement, and come to you. The larger harm is to the credibility of the credential if you can't show how the answer was produced or checked. Test the chatbot on real questions about eligibility, fees, deadlines and CE rules, check that it points to current sources, and keep records of the results.

[Read the full article →](https://www.cimbiotic.ai/insights/ai-is-already-inside-your-certification-program-the-question-is-where)

### How do we test an AI agent that acts on member records without a person approving each step?

Test what it does, not what it says. Send realistic requests through the channel the agent uses, with test records and addresses you control, then check the outcome: did the record change, did the email go out. Get written authorization first, start with read-only tests, and decide in advance who can reverse a change. A clean result shows only that the agent passed the tests run at that time.

[Read the full article →](https://www.cimbiotic.ai/insights/how-do-we-test-whether-an-ai-agent-is-doing-what-it-should)

Solution and provider

## Who does this?

### What is independent AI assurance for associations and non-profits?

It is testing of an organization's AI by a party with no commercial stake in the result, with evidence a Board can read. Cimbiotic tests the chatbots and agents members rely on, from the outside, keeps every reply, and reports what it finds, including failures. No vendor pays us, and no fee depends on the finding. It is assurance, not a guarantee.

[How CimAssure works →](https://www.cimbiotic.ai/cimassure)

### What is AI red teaming for association chatbots?

AI red teaming means deliberately trying to make a chatbot fail: prompt injection, jailbreaks, data leaks, unsafe outputs and made-up answers. Cimbiotic's AI Red Teaming runs the full test library once against an assistant you authorize and returns a Board Assurance Statement and an OWASP Top 10 for LLM Applications coverage report. The result can come back Red.

[About AI Red Teaming →](https://www.cimbiotic.ai/ai-red-teaming)

### Who offers AI chatbot testing services for non-profits?

Cimbiotic is an independent third-party AI assurance service built for associations and non-profits. When you compare any provider, ask who pays them, whether they accept commissions or referral fees from vendors, whether a person decides every verdict, and whether they will report a failure. We publish our criteria, and we reserve the right to fail an assessment.

[See the Framework →](https://www.cimbiotic.ai/framework)

### Who offers third-party AI testing for professional and trade associations?

Cimbiotic does. We test the chatbots and agents that professional and trade associations put in front of members, and the Assurance Statement is written for a Board. We are aligning to ISO/IEC 17065 and are not currently accredited, and we won't imply otherwise.

[About Cimbiotic →](https://www.cimbiotic.ai/about)

### What is AI red teaming, and does an association need it?

AI red teaming is controlled, authorized attempts to break an AI system so weaknesses are found before members find them. An association needs it if members talk to a chatbot or agent that can see member data or answer questions about policy, dues or credentials. One test gives a point-in-time result; regular re-testing shows whether it holds.

[About AI Red Teaming →](https://www.cimbiotic.ai/ai-red-teaming)

### Is there a standard for assuring AI for associations (ISO/IEC 17065, AIUC-1, OWASP Top 10 for LLM applications)?

There is no single standard written specifically for associations, so assurance draws on several. Our test library is mapped to the OWASP Top 10 for LLM Applications and for Agentic Applications, with NIST AI RMF and ISO/IEC 42001 as anchor references, and we are mapping it to AIUC-1 (Q4 2026). ISO/IEC 17065 is the standard for bodies that certify products and services; we are aligning to it and are not currently accredited.

[See the Framework →](https://www.cimbiotic.ai/framework)

Cost and fit

## Is it worth it?

### How much does independent testing of an association chatbot cost?

It depends on whether you want a one-time result or ongoing testing, and on how many assistants are tested. Fees pay for the testing, never for an outcome, and no fee depends on what we find. Current prices are on our Pricing page.

[See the Pricing page →](https://www.cimbiotic.ai/pricing)

### What does a one-time AI chatbot test cost, and what does ongoing testing cost?

A one-time test (AI Red Teaming) runs the full test library once and returns one Board Assurance Statement, with no Baseline required. Ongoing testing (CimAssure) starts with a Baseline, then repeats the tests on a regular schedule and when the AI changes. If you continue from a one-time test, its fee is credited toward your first year. See the Pricing page for current fees.

[See the Pricing page →](https://www.cimbiotic.ai/pricing)

### Can a small association afford AI assurance?

Often, yes, because you can start small. Baseline Lite is built for smaller teams, and a one-time test gives you a result without an ongoing commitment. The Pricing page lists current fees, and the free Scorecard shows where you stand before you spend anything.

[See the Pricing page →](https://www.cimbiotic.ai/pricing)

About Cimbiotic

## Who are we?

### What is Cimbiotic?

Cimbiotic is an independent third-party AI assurance service for associations and non-profits. We test the chatbots and agents your members rely on, from the outside, and give your Board an Assurance Statement rated Green, Amber, Red or Not rated. Our co-founders are Rick Bawcum and Jennifer L. Thompson, PhD.

[About Cimbiotic →](https://www.cimbiotic.ai/about)

### What does Cimbiotic do? Is Cimbiotic an auditor?

Cimbiotic tests the chatbots and agents members rely on and reports what it finds. We are not an auditor: CimAssure is not a certification, audit or attestation, and it does not replace a SOC 2 report. It is assurance, not a guarantee.

[How CimAssure works →](https://www.cimbiotic.ai/cimassure)

## Not sure where you stand?

The free Scorecard is seventeen questions and takes about five minutes. No sign-up to see your result.

[Take the free Scorecard](https://www.cimbiotic.ai/scorecard)

Cimbiotic

Independent AI assurance for professional and trade associations, and the wider non-profit sector.

Humans Leading Change

#### Cimbiotic

- [CimAssure](https://www.cimbiotic.ai/cimassure)
- [Framework & approach](https://www.cimbiotic.ai/framework)
- [Pricing](https://www.cimbiotic.ai/pricing)
- [About](https://www.cimbiotic.ai/about)
- [Insights](https://www.cimbiotic.ai/insights)
- [Questions we get](https://www.cimbiotic.ai/questions)

#### Start

- [Free Trust Readiness Scorecard](https://www.cimbiotic.ai/scorecard)
- [Book a 30-minute call](https://calendly.com/rbawcum?utm_source=website&utm_medium=footer&utm_campaign=general&utm_content=footer)
- [inquiries@cimbiotic.ai](mailto:inquiries@cimbiotic.ai)

© 2026 Cimbiotic. Assurance, not a guarantee. Aligning to ISO/IEC 17065. Not currently accredited. [Privacy](https://www.cimbiotic.ai/privacy) Cookie settings

```json
{
  "@context" : "https://schema.org",
  "@type" : "WebPage",
  "description" : "Direct answers to what association leaders ask about AI chatbots: testing, Board reporting, risks, standards and cost. From Cimbiotic.",
  "inLanguage" : "en-US",
  "isPartOf" : {
    "@id" : "https://www.cimbiotic.ai/#website"
  },
  "name" : "Questions Association Leaders Ask About AI | Cimbiotic",
  "publisher" : {
    "@id" : "https://www.cimbiotic.ai/#org"
  },
  "url" : "https://www.cimbiotic.ai/questions"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "FAQPage",
  "mainEntity" : [ {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "To a member, the answer came from your association, whoever built the chatbot. Legal responsibility depends on your vendor contract, how the chatbot is presented to members and the law where you operate, and the law on AI accountability is still unsettled, so ask your counsel. What a Board can control is knowing what the chatbot says and keeping evidence that someone checks it. We are not a law firm, and this is not legal advice."
    },
    "name" : "Who is responsible when our association's AI chatbot gives a member the wrong answer?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Whether you are liable depends on your contract with the vendor, how the chatbot appears to members, and the law that applies to you. That is a question for counsel, and a vendor contract alone may not settle it. You can still do three practical things: read what the contract says about errors and incident notice, ask for those terms in writing, and keep independent evidence of how the chatbot behaves. This is general information, not legal advice."
    },
    "name" : "Is our association liable for what a vendor's chatbot tells members?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "A Board does not need technical expertise. It can ask its chief staff executive where AI is used, including in software already paid for, which uses touch member data, which are member-facing and how their accuracy is checked, and who is the single accountable person. It should also ask what members have been told, and how a problem would be detected and a system stopped. Good answers are specific, admit unfinished work and name who will finish it."
    },
    "name" : "What AI risks should an association's Board be asking about?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Ask. Start with your software vendors: which AI features run on your account, and do they touch member data. Then ask every department, committee chairs and reviewers, without blame, and don't skip certification and exam programs. Record every use in one inventory with its purpose, users, data, human review and owner, and review it whenever vendors change features."
    },
    "name" : "How do I find out what AI tools our staff and vendors are already using?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Vendor claims describe a platform in general, not your policies, your documents or your configuration. A vendor's own testing is useful evidence, but the vendor chose the tests and ran them at one point in time. Ask what the tests cover, then get an outside check of your own deployment."
    },
    "name" : "Are vendor claims about chatbot safety enough, or do we need to check ourselves?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Test it the way a member would, through the public front door, with no access to settings or logs. Collect real questions from your inbox and help desk, including awkward ones about refunds, eligibility and deadlines. Save each exact answer with its date, and have someone who knows the subject grade it as correct, incomplete, wrong or something it should not have answered. Repeat after any change, or ask an independent party to do it."
    },
    "name" : "How do we test a member-facing chatbot at an association with minimal technical staff?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "An independent tester works from the outside, through the same channels your members use, and only on an assistant you have authorized. It needs no access to the vendor's internals and no vendor cooperation. Every message and reply is kept as evidence, and a person reviews each verdict. CimAssure works this way."
    },
    "name" : "How do we independently test an AI chatbot our association bought from a vendor?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Only by testing again. Hosted AI changes without notice, so a result describes the system on the day it was tested. Keep a fixed set of high-stakes questions, record the model version and settings each time, and re-run them after every known change and on a regular schedule. CimAssure re-tests on a regular schedule and on demand when the AI changes, and shows when a result moves."
    },
    "name" : "How do we know if our vendor's chatbot update changed its behavior?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Testing it yourselves is far better than not testing. Its limits are that staff tend to ask what the chatbot already handles well, and that you are grading a deployment you are responsible for. An independent party brings questions you didn't think of, published criteria and no stake in the result, which gives a Board evidence it can rely on."
    },
    "name" : "Is testing a vendor's chatbot ourselves enough, or do we need an independent party?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "A vendor testing its own AI is quality control: useful, but the vendor picks the tests and reports to itself. Independent testing is assurance: an outside party with no commission, referral fee or stake tests your own deployment, keeps the evidence and can report a failure. Assurance is also repeated over time, not done once."
    },
    "name" : "What is the difference between AI quality control and independent assurance?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "On a regular schedule, and whenever something changes: a vendor model update, an edit to the chatbot's content or settings, a complaint, or a new feature. Before each Board meeting that will discuss AI is a good extra checkpoint. CimAssure repeats the tests on a regular schedule and on demand when the AI changes."
    },
    "name" : "How often should an association re-test its AI chatbot?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Use three groups of tests. Policy tests check that the chatbot follows your rules, accuracy tests check that its answers and cited sources are real and correct, and data tests check that it won't reveal other members' information. Record every reply word for word, and count a timeout or non-response as a failure, not a pass."
    },
    "name" : "How do we test a chatbot for wrong policy answers, made-up sources and data leaks?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Ask four things. Who chose the tests, and did outsiders review them? Do the scenarios fit an association, with member records and Board scrutiny? How does the product perform for outside users? How current is the result, and would you be told if it declined? Also ask whether the vendor trains on your data and how quickly it will tell you about an incident."
    },
    "name" : "What should we ask an AI vendor in writing about how they test their product?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Tell them what is actually in place: an inventory of AI uses, a named owner for each, regular independent testing, and evidence they can read. If something is missing, say so and name who will close the gap by when. The Board should expect evidence, not reassurance that the vendor handles it. An independent Assurance Statement gives them a rating and the chatbot's own words to review."
    },
    "name" : "Our Board asked who is watching our AI chatbot. What do we tell them?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "It should state what was tested and when, which version of the tests was used, and a plain-language rating for each assistant. It should quote the chatbot's exact words behind every finding, say what was not covered, and list the actions that need attention. A CimAssure Assurance Statement is written by one person, approved by another, and rated Green, Amber, Red or Not rated."
    },
    "name" : "What should an AI assurance report for an association Board include?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Say how you use AI, and back the statement with evidence. Disclosure on its own is an admission; disclosure backed by independent assurance is a claim of competence. Reports are private to you unless you choose to publish them."
    },
    "name" : "How do we show members that we govern our AI responsibly?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "No. A SOC 2 report covers a vendor's security controls, and an audit examines an organization's processes. An AI test checks what the AI actually says and does when a member uses it. CimAssure is not a certification, audit or attestation, and it does not replace a SOC 2 report. Most associations will want both kinds of evidence."
    },
    "name" : "Does an AI test replace a SOC 2 report or an audit?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Green means the assistant behaved as expected across the risks tested, with no significant findings, so it is reasonable to rely on with continued monitoring. Amber means it is generally sound, but findings need management attention within a set timeframe. Red means serious failures, such as leaked data, unsafe advice or unauthorized actions, so act now and consider restricting use. Not rated means there wasn't enough reviewed evidence to form a view."
    },
    "name" : "What does a Green, Amber, Red AI rating mean for a Board?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "A chatbot connected to your association management system can see member records, so the stakes are higher than for a chatbot that only reads public pages. The main risks are revealing one member's data to another, giving wrong answers about dues, status or deadlines, and acting on a record it should not touch. Test what it says and what it can reach, from the outside, as a member would."
    },
    "name" : "What are the risks of an AMS-connected chatbot for associations?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Yes, if it can reach member records or internal documents and its limits fail. Testing means asking for other people's information directly and indirectly, and checking that the chatbot refuses every time and keeps refusing after updates. Data handling has its own group of tests in our versioned test library, and tests use synthetic members, never real member data."
    },
    "name" : "Can an association chatbot leak another member's data?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Yes. Prompt injection and jailbreaks are attempts to talk a chatbot out of its instructions, and anyone who can type to it can try. A chatbot that refuses once may not refuse every time, so these attacks need to be tested repeatedly and the exact replies kept. Our test library covers both, mapped to the OWASP Top 10 for LLM Applications."
    },
    "name" : "Can members trick our chatbot into ignoring its rules (prompt injection, jailbreaks)?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "A member may act on it, miss a deadline or a requirement, and come to you. The larger harm is to the credibility of the credential if you can't show how the answer was produced or checked. Test the chatbot on real questions about eligibility, fees, deadlines and CE rules, check that it points to current sources, and keep records of the results."
    },
    "name" : "What happens if our chatbot gives wrong advice about certification or CE requirements?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Test what it does, not what it says. Send realistic requests through the channel the agent uses, with test records and addresses you control, then check the outcome: did the record change, did the email go out. Get written authorization first, start with read-only tests, and decide in advance who can reverse a change. A clean result shows only that the agent passed the tests run at that time."
    },
    "name" : "How do we test an AI agent that acts on member records without a person approving each step?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "It is testing of an organization's AI by a party with no commercial stake in the result, with evidence a Board can read. Cimbiotic tests the chatbots and agents members rely on, from the outside, keeps every reply, and reports what it finds, including failures. No vendor pays us, and no fee depends on the finding. It is assurance, not a guarantee."
    },
    "name" : "What is independent AI assurance for associations and non-profits?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "AI red teaming means deliberately trying to make a chatbot fail: prompt injection, jailbreaks, data leaks, unsafe outputs and made-up answers. Cimbiotic's AI Red Teaming runs the full test library once against an assistant you authorize and returns a Board Assurance Statement and an OWASP Top 10 for LLM Applications coverage report. The result can come back Red."
    },
    "name" : "What is AI red teaming for association chatbots?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Cimbiotic is an independent third-party AI assurance service built for associations and non-profits. When you compare any provider, ask who pays them, whether they accept commissions or referral fees from vendors, whether a person decides every verdict, and whether they will report a failure. We publish our criteria, and we reserve the right to fail an assessment."
    },
    "name" : "Who offers AI chatbot testing services for non-profits?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Cimbiotic does. We test the chatbots and agents that professional and trade associations put in front of members, and the Assurance Statement is written for a Board. We are aligning to ISO/IEC 17065 and are not currently accredited, and we won't imply otherwise."
    },
    "name" : "Who offers third-party AI testing for professional and trade associations?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "AI red teaming is controlled, authorized attempts to break an AI system so weaknesses are found before members find them. An association needs it if members talk to a chatbot or agent that can see member data or answer questions about policy, dues or credentials. One test gives a point-in-time result; regular re-testing shows whether it holds."
    },
    "name" : "What is AI red teaming, and does an association need it?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "There is no single standard written specifically for associations, so assurance draws on several. Our test library is mapped to the OWASP Top 10 for LLM Applications and for Agentic Applications, with NIST AI RMF and ISO/IEC 42001 as anchor references, and we are mapping it to AIUC-1 (Q4 2026). ISO/IEC 17065 is the standard for bodies that certify products and services; we are aligning to it and are not currently accredited."
    },
    "name" : "Is there a standard for assuring AI for associations (ISO/IEC 17065, AIUC-1, OWASP Top 10 for LLM applications)?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "It depends on whether you want a one-time result or ongoing testing, and on how many assistants are tested. Fees pay for the testing, never for an outcome, and no fee depends on what we find. Current prices are on our Pricing page."
    },
    "name" : "How much does independent testing of an association chatbot cost?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "A one-time test (AI Red Teaming) runs the full test library once and returns one Board Assurance Statement, with no Baseline required. Ongoing testing (CimAssure) starts with a Baseline, then repeats the tests on a regular schedule and when the AI changes. If you continue from a one-time test, its fee is credited toward your first year. See the Pricing page for current fees."
    },
    "name" : "What does a one-time AI chatbot test cost, and what does ongoing testing cost?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Often, yes, because you can start small. Baseline Lite is built for smaller teams, and a one-time test gives you a result without an ongoing commitment. The Pricing page lists current fees, and the free Scorecard shows where you stand before you spend anything."
    },
    "name" : "Can a small association afford AI assurance?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Cimbiotic is an independent third-party AI assurance service for associations and non-profits. We test the chatbots and agents your members rely on, from the outside, and give your Board an Assurance Statement rated Green, Amber, Red or Not rated. Our co-founders are Rick Bawcum and Jennifer L. Thompson, PhD."
    },
    "name" : "What is Cimbiotic?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Cimbiotic tests the chatbots and agents members rely on and reports what it finds. We are not an auditor: CimAssure is not a certification, audit or attestation, and it does not replace a SOC 2 report. It is assurance, not a guarantee."
    },
    "name" : "What does Cimbiotic do? Is Cimbiotic an auditor?"
  } ]
}
```