What test methods does an age assurance comparison need?
A comparison needs a planned functional test, a vulnerability test at a stated attack potential, a presentation attack test, an equality analysis and a repeat run. The crew should be independent of the developer, the sample should be sized to the claimed failure rate, and the raw data and analysis should be kept so another analyst can repeat the work.
Functional and vulnerability tests are different
A functional test asks whether the detection or the estimate performs within its stated range. A vulnerability test tries to defeat it, including with a presentation attack instrument. A system can pass the first and fail the second, and the public working draft says one successful attack within the stated potential fails the security test.
The sample decides what you can claim
A claim at the enhanced or strict level is a claim about rare failures. Size the sample from the failure rate the indicator implies, recruit to a frame rather than to convenience, and report the groups the sample could not support.
The crew and the analyst matter
The public working draft expects a crew not known to the developer and a test under the analyst's control. An analysis run by the supplier on data it selected is a demonstration, not a comparison.
Keep the run repeatable
Store the data, the code, the system version and the conditions. Report the uncertainty and the repeat run. A ranking built on a difference smaller than the interval is not a result.
Not legal advice; does not certify. The draft is a guidance document in ballot. Check the published text before a decision depends on it.