What Modules 2.1 and 2.2 actually build

The Accelerator Framework's section 2 reserves the Accelerator Testing Team's or Commissioner's right to impose Bespoke criteria, such as quantitative bias metrics or STRIDE threat models, on top of a Participant's chosen assessment model. Two modules exist specifically to answer that request, and both shipped in v2.4 (24 May 2026), so the Bespoke pathway is met out of the box rather than requiring a build.

Module 2.1, Bias and Fairness (5-6 working days of engineering went into it). TypeScript-only fairness metrics run on plain arrays: the four-fifths rule with standard floors, covering demographic parity, equalised odds, disparate-impact ratio, predictive parity and calibration by group. There is no Python runner and no third-party fairness-library dependency. Citations: EU AI Act Annex III; DPL Article 9 sensitive data; OECD AI Principle 1.2. Output: BiasReport-<SYSTEMID>.pdf and .md, plus a new MODULE21BIAS_FAIRNESS audit row.

Module 2.2, Threat Model (4-5 working days). A deterministic TypeScript engine maps system facts to STRIDE rows: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege. Citations: ISO/IEC 27001 A.5, A.8 and A.12; NIST AI RMF Govern, Map and Measure; MITRE ATLAS prompt-injection identifiers. Output: ThreatModel-<SYSTEMID>.pdf, plus a new MODULE22THREAT_MODEL audit row.

Two related modules are not yet in the same state. Module 2.3, the quarterly red-team report, ships through the Reg 10 Sprint engagement rather than as a self-serve module. Module 3.1, drift monitoring, is provisioned on first paid Enterprise tenant signup. Neither gates Bespoke-criteria readiness itself: the section 2 floor is exceeded by Modules 2.1 and 2.2 alone.