VERITRAIL helps organizations govern AI. That obliges us to govern our own use of AI at least as carefully as we ask our customers to. This statement explains where VERITRAIL uses AI, the rules it follows, and the limits we acknowledge.
Last updated: 21 October 2026
Where VERITRAIL uses AI
| Feature | Role of AI | Role of deterministic logic |
|---|---|---|
| VERITRAIL Agent and Ask VERITRAIL demo | Interpreting questions, drafting answers, assessments, gap registers and reports | Tool permissions, approval routing, citation checks, prohibited-claim checks, audit logging |
| Maturity self-assessment | None in scoring | Scoring, levels, flags and action plans are rule-based and published |
| Risk triage | None in tiering | Tier suggestions come from published rules with citations |
| Guardrail generator and VERITRAIL Shield | None in runtime policy evaluation | Draft policies are generated from VERITRAIL rules; runtime evaluation is rule-based, versioned and logged |
We use AI where it helps people draft and navigate, and deterministic, published logic where results must be reproducible — such as scores, tiers and runtime decisions.
The rules our AI follows
1. Cite or say so. Every material recommendation cites at least one VERITRAIL control ID, and where relevant an assessment question, policy version, evidence item or indicative framework mapping. If nothing supports a statement, the response is: "No supporting evidence or framework source is available."
2. Label evidence honestly. Self-reported information is User-asserted; derived information is Inferred; only evidence reviewed by a named person is Verified. Missing evidence and critical gaps are named as such.
3. No compliance claims. Our AI does not state that any organization or system is compliant, certified or approved by a regulator. Outputs are checked for such claims, and our standard disclaimer accompanies reports and compliance content.
4. Humans approve high-impact actions. Changing a risk tier, approving an exception, changing production runtime policy, exporting sensitive evidence and sending external communications create a pending approval for a named person. They never execute on the AI's own authority.
5. Redaction first. Sensitive data is masked before any call to an external model and before log writes.
6. Least privilege. Each Agent tool declares its permission level. Tools that write create drafts.
7. Audit. Material actions are recorded in a hash-chained, tamper-evident audit log with a trace ID.
VERITRAIL controls cited
- IS-04 Sensitive data redaction and maskingNIST AI RMF: MEASURE 2.10ISO/IEC 42001: A.7.4, A.6.2.6EU AI Act: Art. 10
- IS-11 Least-privilege tool accessNIST AI RMF: MEASURE 2.7, MANAGE 2.2ISO/IEC 42001: A.6.2.6, A.4.4EU AI Act: Art. 15, Art. 14
- IS-13 Human approval for high-impact actionsNIST AI RMF: GOVERN 3.2, MANAGE 2.2ISO/IEC 42001: A.9.2, A.6.2.6EU AI Act: Art. 14
- SE-08 Immutable action loggingNIST AI RMF: MEASURE 2.8, MANAGE 4.1ISO/IEC 42001: A.6.2.8EU AI Act: Art. 12, Art. 19, Art. 26
- IS-08 Transparency and AI disclosuresNIST AI RMF: MEASURE 2.8, MEASURE 2.9ISO/IEC 42001: A.8.2, A.8.5EU AI Act: Art. 13, Art. 50
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
Transparency to users
AI-generated content in VERITRAIL is identified as such (IS-08). Drafts are labelled as drafts. The Ask VERITRAIL demo states that it is a limited demo and what it can and cannot do.
Known limitations
- AI-generated drafts can be wrong, incomplete or poorly suited to a particular organization. They are inputs to human judgement.
- Pattern-based redaction and prompt-injection detection reduce risk but do not eliminate it.
- Framework mappings are indicative interpretations and may lag changes in standards and law. The control library is versioned and reviewed quarterly.
- We have not verified our content against regulatory changes after 2025; EU AI Act timelines must be checked against the current Official Journal text and amendments.
Governing our own AI
We apply the same framework to VERITRAIL itself. Our commitments: our AI features are recorded in our own inventory with owners and risk tiers; changes to models and prompts follow change control; and the Agent's tools and approval requirements are defined in policy. We will report material changes to this statement on this page.
Questions or concerns
If you believe an VERITRAIL output is wrong, misleading or harmful, please contact us. We review every report.