Skip to content
Tall archive shelving lined with identical document boxes, receding into the dark under one pool of light.

Service 08 · AI Audits & Compliance

Agents in regulated work, evidence on file

Your controls assume a person wrote the commit. An agent-written one breaks that.

Book a readiness review
  • Agents stay in your regulated work
  • Produce the evidence your standard already asks for
  • Captured as the work runs, alongside delivery
  • Named gaps, each with an owner

Example record

A control, and the record behind it

So your assessor reads evidence pulled from the work as it ran. A gap is named, with an owner.

The assessor reads the record as it was written.

control · change approval and reviewSample log

  • Change approved by a named person

    sign-off record, linked

    Evidence

  • Review by a session that did not write the code

    review attached to the change

    Evidence

  • Secret paths refused

    refusals logged with reasons

    Evidence

  • Action log retention

    owner: your platform team

    Gap
A lead seal crimped onto a steel wire through the hasp of a shipping container door.

What an assessor asks for

Your trail, built while the work ran

Rebuild it afterwards and you pay several times as much, for a trail with the gaps an assessor is trained to find.

The question that arrives late

Most teams bring agents into delivery first and meet the regulator second. The meeting goes badly for a reason you can avoid.

A steel inspection punch standing on a metal plate, its mark struck into the surface.
  1. A

    Change control assumes an identified, authorised person

  2. B

    PCI DSS 4.0.1 wants traceability over in-scope changes

  3. C

    SOC 2 wants an approval trail. DORA wants control over ICT changes

  4. D

    ISO 27001 A.8.32 wants controlled change. HIPAA wants an audit trail on health data

  5. E

    Each asks who authorised the change

  6. F

    An agent-written change with no named approver is the gap they find first

Where the EU AI Act comes in

So your record-keeping and oversight evidence is on file when counsel asks. 4 sign-offs with named owners support it, and on their own do not make a system compliant.

  • Articles 12 and 14 ask high-risk AI systems for logs and human oversight

  • A signed delivery trail counts as evidence toward that

  • A named person who can override, on the record

  • Your counsel decides which obligations apply to your system

Capabilities

How we close the gap

01Control mappingEach control in scope, set against the evidence your agent pipeline produces and the evidence it lacks. The gap is usually narrower than expected, in 2 or 3 places.
02Evidence extractionThe action log, the sign-off trace and the pipeline record, pulled into the form an assessor accepts. So you can hand the evidence over, instead of only holding it.
03Gap closureA missing control becomes a committed check, so it still holds in 4 months.
04Continuous monitoringControls verified on a schedule. "Is this still enforced?" becomes a query you run, instead of an interview.
05Model risk and AI use inventoryModels, versions, providers, regions, the data that reaches them and the processes that depend on them. Asked for more often, and rarely kept current.

Model

What we fix, and what you decide

What we fix

  1. F1Each control mapped to evidence, or to a gap with an owner
  2. F2Evidence is pulled from the log and the pipeline
  3. F3Gaps close as committed checks
  4. F4Model, version, provider, region and data flow are inventoried
  5. F5Controls are verified on a schedule

What you decide

  1. C1Which frameworks are in scope, and which assessor
  2. C2Remediation by us, or findings handed to your team
  3. C3Retention policy on the action log

We do not issue certifications. We produce the evidence and close the gap, so your answers are ready before the assessor asks.

Related

Where to go next

Next step

Assessments have dates.

Send us the date and the scope. What you get back is what closes before it, and a named owner for each gap left open.

Book a readiness review →