Ordinary cases are necessary but insufficient
Include representative normal work and cases designed to expose known failures. A challenge set should cover the intended use and its limits, not just unusual puzzles.
Worked example
Example protocol-review challenge set
Include a missing acceptance criterion, a subtly wrong unit, contradictory requirements, a clean protocol, a scanned table, an obsolete source, similar requirement identifiers, an unsupported document type, and a case requiring clarification. Track why each case exists.
Repeatability questions
Some AI outputs vary across runs. Decide what variation matters: wording may differ while the substantive finding remains correct, but inconsistent detection of a consequential issue may affect reliance. Use a planned repeat strategy to examine relevant variability. Record configuration and service information available at execution.
Do not count repeated runs of one document as though they were all independent examples of the wider document population. Analyze case diversity and repeated-run behavior separately.
Completed coverage note: “The evaluation includes clean and issue-containing documents across the supported formats. Repeated runs examine stability of issue detection on selected difficult cases. Results are reported by issue type and format; the study does not establish performance for unsupported languages.”
Choose the testing method for the question
Use scripted testing where exact control behavior and repeatable steps matter, such as access denial or record linkage. Unscripted testing can investigate a bounded workflow with documented observations. Exploratory testing combines learning and test design within a charter that states the risk, scope, configuration and findings. Preserve failures and enough context to reproduce material observations; the label alone does not determine evidence adequacy.
Exercise
An assistant passes the same ten cases 100 times. Has it demonstrated broad coverage?
Show suggested answer
It has provided evidence about repeated behavior on those cases. Broader coverage still requires representative variation in documents, failures, users, and context.
Expected records
A risk-based test plan, scripted protocols for required controls, unscripted test records or exploratory charters where suitable, deviations and traceability. Adapt record names and detail to the applicable procedures; these are practitioner examples, not a universal mandatory document list.
Relevant regulations and guidance
Regulations set requirements within their scope; guidance offers recommendations or explains applicable expectations; standards depend on adoption or incorporation. Voluntary frameworks do not establish compliance. The lesson's controls, test designs and example records are practitioner suggestions unless explicitly identified otherwise.
Guidance · U.S. Food and Drug Administration · February 2026
Scope: United States · Medical-device manufacturers assuring software used in production or their quality management system.
Relevance to this lesson: Describes assurance approaches and testing activities for device-production/QMS software.
Publication status: Final / published. Source checked 21 September 2026.
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Source details and applicabilityVoluntary framework · National Institute of Standards and Technology · NIST AI 100-1 · January 2023
Scope: United States · Cross-sector AI governance and risk management, including generative AI.
Relevance to this lesson: Supports documented evaluation methods and limitations of coverage.
Publication status: Final / published. Source checked 21 September 2026.
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Source details and applicability