BlogTesting
Acceptance criteria for AI systems: when is an LLM application good enough?
Write the criteria as failure types, not as a list of expected answers. Give each one a severity and a required pass rate before testing starts: no failures at all for the few you can never accept, a minimum rate for the rest. Then measure each rate on enough cases, with repeated runs, and accept a criterion only when the whole confidence interval is on the right side of the requirement. If the requirement still lies inside the interval, the test has not decided yet: more cases will settle it if the measured rate is above the requirement, and if it is not, the system needs work. The acceptance check below shows which of these outcomes your own numbers give.
Criteria as failure types
A classic acceptance criterion says what the right output is. For an AI system it works better to say what must not go wrong, because there are many right answers and a countable number of ways to fail. Typical criteria for a customer service assistant: it states a wrong price, amount or date; it contradicts the policy in the source document; it answers a question outside its scope instead of declining; it misses a request to speak to a person; it reveals another customer's data.
Find these failure types by reading real or pilot outputs with a domain expert first. Shreya Shankar and colleagues found that people refine their criteria while they grade outputs, which they call criteria drift. So read a sample, agree the criteria from what you found, and freeze them before the acceptance test.
Severity and thresholds, set before testing
Give each failure type a severity and a required pass rate. IMDA's starter kit for testing LLM applications says each organisation must determine its own thresholds and should set them before testing, with a threshold of zero for egregious harms. Setting them first keeps the numbers from being argued over after the results are in.
| Failure type | Severity | Required pass rate |
|---|---|---|
| Reveals another customer's data | Critical | 100%, no failure allowed |
| Wrong amount, price or date | High | At least 99% |
| Contradicts the source policy | High | At least 97% |
| Misses a request for a person | Medium | At least 95% |
| Answers out of scope instead of declining | Medium | At least 90% |
These figures illustrate the format; they are not a recommendation. The right requirement depends on what a failure costs you, whether a person would catch it, and how the process performed before the AI system.
A criterion that allows no failure cannot be proven by testing alone. A clean run only bounds the failure rate: with 300 cases and none failing, the 95% interval for the failure rate still reaches up to 1.3%. Critical criteria therefore also need controls outside the model, such as access rules that make the failure impossible.
Measure each rate with an interval
A pass rate from a test set is an estimate. If 90 of 100 cases pass, the true rate for this kind of question could be noticeably lower or higher. The Wilson score interval, which behaves well with small samples and with rates near 100%, puts the 95% interval for 90 of 100 at 82.6% to 94.5%.
That gives three outcomes for each criterion. The criterion is met if the lower end of the interval reaches the requirement. It is not met if the upper end is below it. If the requirement lies inside the interval, the test has not decided yet, and more cases will narrow it. With a requirement of 85%, 90 of 100 is undecided; at exactly the same pass rate, 196 cases would settle it, and in whole cases 180 of 200 does.
Cases are treated as independent. Count a case as passed only if it passed on every run you require.
- Measured pass rate
- 90.0%
- Lower end of the interval
- 82.6%
- Upper end of the interval
- 94.5%
- Cases needed at this pass rate
- 196
Criterion met: even the lower end of the interval reaches the required pass rate.
Criterion not met: even the upper end of the interval is below the required pass rate.
Not decided yet: the required pass rate lies inside the interval. More cases at the same pass rate would settle it.
Not decided yet, and more cases at this pass rate will not clear the requirement. The system needs to improve, or the requirement needs a second look.
Enter whole numbers of cases, no more passed cases than cases run, and a required pass rate between 1 and 99.9.
The check treats cases as independent. If several cases come from the same document or conversation, the real interval is wider, and our guide to eval sample sizes shows how to account for that.
Repeated runs and consistency
Run each case several times at production settings. A case that passes on one run and fails on the next is not a flaky test to delete; it tells you how often a user would see the failure. Count the case as the unit: five runs of 100 cases are not 500 independent cases.
For a system that acts, such as an agent that issues refunds, consider requiring that every run of a case passes. In the original 2024 τ-bench paper, gpt-4o solved about 61% of retail tasks in a single trial, but fewer than 25% of tasks in all eight trials. A requirement on the single-run rate would have hidden that.
Putting the criteria into a contract
If an agency or vendor builds the system, agree the failure types, the requirements and the way they are measured before the build starts, and keep the test set on your side. The vendor can get a sample to develop against, while the cases used for acceptance stay unseen, so the system is not tuned to the exact test. At acceptance, run the set through the interface your users will have, and record for each failure the input, the output and the criterion it broke.
Agree up front what happens after an undecided result: usually a larger test run, or a fixed period of supervised use with a sample checked by hand. How formal acceptance works legally depends on your type of contract, so check that with your legal adviser; this is not legal advice.
Questions
What if a criterion is not met?
Read the failing cases before anything else. They usually group into one or two causes, such as a missing document, a prompt instruction the model ignores or a retrieval problem. Fix the cause, then rerun the whole set rather than only the failed cases, because fixes often break something else.
Can we accept with an undecided result?
As a business decision, yes, if the risk is low and you check a sample of live conversations afterwards. Write down that the result was undecided and when you will look again. For high-severity criteria, add cases until the result is clear.
Should the criteria be the same in every language?
The criteria, yes. Measure them separately per language, though, because quality often differs between languages and a combined rate can hide a weak one.
Why the Wilson interval and not plus or minus a few points?
The simple normal approximation behaves badly with small samples and with rates close to 100%, which is exactly where acceptance requirements sit, and it can even reach above 100%. The Wilson interval stays between 0 and 100% and is more reliable there.
More from the blog
How to test AI systems
A test strategy for LLM applications, RAG assistants and agents: test levels, oracles, repeated runs, test data and the CT-AI techniques that carry over.
Eval sample size
How to put confidence intervals on eval results, compare two prompts or models case by case and size a test set for the difference you need to detect.
Regression testing for LLM applications
What to run when a prompt, model, document index or provider changes: a frozen set of cases, deterministic checks first, validated judges and a case-by-case comparison.
Error analysis for LLM apps
How to read about 100 traces with a domain expert, turn free-text notes into a counted failure taxonomy and decide which failures deserve an eval.
Sources
- IMDA: Starter Kit for Testing LLM-Based Applications for Safety and Reliability (January 2026)
- Shankar et al.: Who Validates the Validators?
- Edwin B. Wilson: Probable inference, the law of succession, and statistical inference (1927)
- Evan Miller: Adding Error Bars to Evals
- Yao et al.: τ-bench, a benchmark for tool-agent-user interaction
Talk to an engineer
Bring one piece of work you would like to improve. The call takes 30 minutes and needs no access to your systems or your data.
Booking runs on Google Calendar.
Prefer to write first? Leave your email and a few lines, and we reply with times.
Look for the draft in your email program
Send it from there, and an engineer replies in person with times for a 30-minute call. If no draft has opened, write to us at miki@cloudsail.com.