Core message governance that cannot be evidenced on request is governance you cannot rely on.
When an auditor, customer, board member or authority asks "show me", most organizations assemble evidence by hand from email threads, shared drives and screenshots. VERITRAIL Assurance makes evidence a by-product of governance: controls are tested on a schedule, decisions are logged tamper-evidently, incidents follow a defined path, and an evidence pack for any material AI system can be produced from the record.
Capabilities
- Control testing programme (SE-01). Test plans per control with design and operating-effectiveness steps, sampling guidance, tester and date recorded.
- Evidence repository and retention (SE-02). Evidence items linked to controls and systems, with retention rules and access control on evidence itself.
- Evidence labelling. Every item is Verified, User-asserted, Inferred, Missing evidence or Critical gap; only a named reviewer can mark an item Verified.
- Tamper-evident action logging (SE-08). Hash-chained logs of AI decisions, policy decisions, tool calls and approvals, with verification.
- AI incident management (SE-04). Incident categories for harmful output, data leakage, unauthorized action, security compromise, fairness concerns and drift; containment links to the Shield kill switch; a notification-assessment step for legal review.
- Monitoring and post-market plans (GL-08, SE-09, SE-12). Performance and drift thresholds, review records and post-deployment monitoring plans for high-risk systems.
- Evidence packs (SE-05). One-click assembly of a system's record, assessments, approvals, tests, policies, monitoring, incidents and corrective actions — each labelled.
- Metrics and management review (SE-03, SE-07) and corrective action tracking (SE-06).
Who it is for
- Second-line risk and compliance testing teams running AI control tests.
- Internal audit planning risk-based AI audits (SE-10).
- AI Governance Leads answering customer questionnaires and preparing for external assessments.
- CISOs and operational risk managing AI incidents.
Outputs
| Output | Contents |
|---|---|
| Evidence pack (PDF, Markdown, JSON index) | Per-system evidence index with labels, gaps and reviewer sign-offs |
| Control test results | Test steps, samples, result, tester, date, linked findings |
| Incident register and post-incident reviews | Timeline, containment, notification decision record, corrective actions |
| Governance KPI pack | Inventory coverage, tier distribution, overdue findings by severity, time-to-produce evidence, drill results |
| Audit log verification report | Hash-chain verification result for the period |
Example: evidence pack index (excerpt)
| Item | Control | Evidence status | Reviewer |
|---|---|---|---|
| Inventory record v7 with owner acceptance | EI-01, EI-03 | Verified | AI Governance Lead |
| Pre-deployment risk and impact assessment | GL-02 | Verified | AI Risk Lead |
| Approval with three conditions | GL-03 | Verified | Governance forum secretary |
| Prompt-injection test report | IS-14 | User-asserted — report referenced but not provided | — |
| Kill-switch drill record | IS-15 | Missing evidence | — |
| Runtime policy v1.3.0 and decision-log extract | IS-12, SE-08 | Verified | Security Architecture |
| Fairness evaluation | IS-05 | Critical gap — High-tier system with no evaluation performed | — |
A pack like this is useful precisely because it shows the gaps. It is not a compliance attestation.
VERITRAIL controls cited
- SE-01 Control testing programmeNIST AI RMF: MEASURE 1.3, MEASURE 4.1ISO/IEC 42001: 9.1, 9.2EU AI Act: Art. 17
- SE-02 Evidence repository and retentionNIST AI RMF: GOVERN 1.4ISO/IEC 42001: 7.5EU AI Act: Art. 18, Art. 19
- SE-04 AI incident management and reportingNIST AI RMF: MANAGE 4.3, MANAGE 2.3ISO/IEC 42001: 10.2, A.8.4EU AI Act: Art. 73, Art. 26
- SE-05 Audit-ready evidence packsNIST AI RMF: GOVERN 1.4, MEASURE 2.9ISO/IEC 42001: 7.5, 9.2EU AI Act: Art. 11, Art. 18
- SE-08 Immutable action loggingNIST AI RMF: MEASURE 2.8, MANAGE 4.1ISO/IEC 42001: A.6.2.8EU AI Act: Art. 12, Art. 19, Art. 26
- SE-12 Model performance and drift monitoringNIST AI RMF: MEASURE 2.4, MEASURE 3.1ISO/IEC 42001: A.6.2.6EU AI Act: Art. 72, Art. 15
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
How it fits
Assurance draws on records from Register, decisions from Control and policy decisions from Shield. The VERITRAIL Agent can draft an evidence index and highlight missing items; exporting sensitive evidence outside the organization requires human approval.
Limitations
VERITRAIL can show what evidence exists and who reviewed it; it cannot attest to the truth of evidence supplied to it. Hash-chained logs are tamper-evident, not tamper-proof, and depend on protecting the log store. Whether an evidence pack satisfies a particular auditor, certification body or authority is their determination.