AI Prototype Diligence Research Note

AI Prototype Diligence Research Note

Question

How should a founder, investor, or buyer classify evidence when generative tools can produce a credible demonstration quickly?

What the sources establish

The NIST AI Risk Management Framework is a voluntary cross-sector framework for incorporating trustworthiness into the design, development, use, and evaluation of AI systems. Its Generative AI Profile proposes actions tailored to risks that generative systems create or amplify. NIST does not certify a product through ordinary use of the framework.

FINRA's 2026 GenAI report says existing securities obligations continue to apply when member firms use GenAI. It discusses formal approval, supervision, documentation, testing, monitoring, prompt and output logs, model versions, privacy, accuracy, bias, cybersecurity, and human review. Its direct regulatory scope is FINRA member firms.

The SEC's robo-adviser guidance states that registered robo-advisers remain subject to the substantive and fiduciary obligations of the Advisers Act. It is an example of technology changing delivery without removing the obligations of the underlying activity.

The interagency 2026 model risk guidance emphasizes risk-based development, validation, monitoring, governance, and controls for covered banking organizations. It supersedes SR 11-7, is expected to be most relevant to larger supervised banking organizations, and excludes generative and agentic AI from direct scope.

Steve Blank's Investment Readiness Level writing argues for evaluating hypotheses, experiments, data, learning, and business-model evidence rather than presentation polish.

Disagreement and uncertainty

No source creates a universal maturity ladder for every AI startup. Venture Step's mockup, functional prototype, pilot, controlled production, and scaled product categories are an editorial synthesis.

A strong technical evaluation does not prove customer demand. Customer enthusiasm does not prove safe or compliant production. Both dimensions must remain visible.

Editorial use

Use the evidence ladder to ask stage-appropriate questions about customer behavior, data rights, failure handling, monitoring, authority, economics, and the exact regulatory perimeter.

Do not call a benchmark, demo, pilot, or framework alignment proof of safety, compliance, product-market fit, or investment quality.