Evidence, Assurance and Audit

All courses / AI Governance / Module 3 / Chapter 11

Learning objectives

After the lesson the participant can:

• Distinguish attestation from evidence and name the four characteristics of evidence as code.
• Describe the contents of an evidence bundle and the two design decisions that make the chain trustworthy.
• Design an inference log that separates the record of events from content containing personal data.
• Draft an evidence-pack index and an audit test procedure with a design test and an operating effectiveness test.

Key concepts

Attestation versus evidence

Attestation is a person asserting that a control operated. Evidence is a machine-generated artefact that demonstrates it. The auditor's question about which model served decisions on a given date should be answered from evidence within an hour.

Evidence manifest

The record that ties the chain together for one release: hashed subjects such as model, dataset and prompt bundle, evaluation reports, controls mapped to obligations and artefacts, approvals, a cryptographic attestation and retention periods.

Events separated from content

The event record, proving the system operated within its declared bounds, is kept for the regulatory period in append-only storage. Content with personal data is pseudonymised at ingestion, held under shorter retention and linked by a reference under a documented access procedure.

Evidence pack

A set of artefacts generated by query for one system and period. Its index lists each audit question, the artefacts that answer it and their hashes, and records the query and generator commit so that a second auditor can regenerate it.

AI-specific incident classification

A step in the incident process for every production incident touching an AI system, recording the answer and the reasoning whatever the outcome, so that the fifteen-day deadline of Article 73 can be met and a negative assessment can be reviewed.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Evidence as code lets auditors spend their time on questions that need judgement. Which three questions about your AI systems can no event log answer?
2. Hansa Mutual recorded that Article 73 did not apply to its incident. What is the value of recording a negative assessment, and who reads it?
3. For Modes 0 to 2 the evidence is largely what the supplier lets the organisation export. What should your contracts say about audit logs, and what is the strongest evidence you hold today for those modes?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which two design decisions make the evidence chain trustworthy, according to the chapter?

   1. Evidence is reviewed by legal counsel, and stored in the supplier's cloud
   2. Evidence is kept in a wiki, and approved by two engineers
   3. Evidence is written once and never edited, and it is signed inside the pipeline with an identity bound to the run
   4. Evidence is summarised quarterly for the forum, and signed with a key that the release manager holds on a hardware token
   Show the answer

   C. Evidence is written once and never edited, and it is signed inside the pipeline with an identity bound to the run
   Artefacts sit in an append-only store with retention locks and each manifest references the previous one. Signing uses an identity bound to the pipeline run, not a key an engineer holds.

2. In audit test procedure TP-AI-014, why does the auditor recompute the weekly override rate from raw events?

   1. Because the oversight design forbids dashboards for override metrics
   2. Because it tests the metric pipeline as well as the control, so a broken dashboard cannot hide a broken control
   3. Because raw events are retained for longer than the published metrics
   4. Because the supplier's instructions for use require a manual recalculation of every published metric before each audit
   Show the answer

   B. Because it tests the metric pipeline as well as the control, so a broken dashboard cannot hide a broken control
   Step O4 requires the recomputed rate to match the published metric exactly. That tests the metric pipeline together with the control, which is why the chapter says it carries the most value alongside O5.

3. Within what period must a provider report a serious incident under Article 73 of the AI Act, as the chapter states it?

   1. Immediately after establishing a causal link or its likelihood, and at most fifteen days after becoming aware
   2. Within six months, together with the post-market monitoring report
   3. Within seventy-two hours of detection, as for a personal data breach
   4. Within thirty days of the governance forum's decision that the incident is serious, and never before that decision
   Show the answer

   A. Immediately after establishing a causal link or its likelihood, and at most fifteen days after becoming aware
   The chapter gives the deadline as immediately after establishing a causal link or its reasonable likelihood and in any case within fifteen days of awareness, with shorter deadlines for the gravest incidents.