AI Compliance Evidence

Reviews and audits ask a simple question: show me what your AI system decided, and prove the record is real. EVE supports evidence collection for governed decisions — signed, verifiable records that a reviewer can check independently — and it produces records useful for review rather than assertions you have to take on faith.

What EVE provides for reviews

• Signed decision records — each governed decision can emit an evidence envelope bound to the decision (Ed25519 production, HMAC-SHA256 fallback).
• Independent verification — reviewers verify records offline in Python, Node, or the browser with the public key.
• Deterministic, reproducible decisions — because no LLM is in the decision path, a decision can be reproduced from the same input and policy version.
• Control mapping — red-team and policy artifacts can map controls to frameworks to help organize review, described as mappings, not certifications.

SDK example

from eve_coreguard import EVE, verify_decision_record

eve = EVE()
result = eve.govern_tool_call(
    tool="approve_claim",
    arguments={"claim_id": "clm_88", "amount": 12000},
    context={"tenant_id": "org_abc", "principal_id": "adjuster_2", "session_id": "sess_6"},
)
record = result["certificate"]

# A reviewer verifies without trusting EVE:
assert verify_decision_record(record, public_key_pem=pubkey).valid is True

Links

• Cryptographic properties: /seo/landing/cryptographic-ai-audit-logs.md
• Decision audit trail: /seo/landing/ai-decision-audit-trail.md
• Red-team evidence: /seo/landing/ai-red-team-testing.md

Readiness

Signed evidence and offline verification are SUPPORTED. The governance decisions the evidence describes are PILOT_READY. Red-team and artifact subsystems that help produce review records are customer-pilot ready at supported boundaries.

Limitations

• Evidence attests authenticity and integrity of the record, not the correctness or legal sufficiency of the decision.
• Control-to-framework mappings are descriptive and are not a certification; EVE does not by itself make a system compliant with any standard.
• Independent verification requires the Ed25519 public key; the HMAC fallback is symmetric and not independently verifiable.

Next step

Run a pilot and collect signed evidence on your own decisions; verify a sample offline before any review.