AI Evidence Architecture
I build the evidence layer that lets AI systems prove what they did.
The logging, provenance and documentation auditors and regulators will demand — designed before it becomes an emergency.
Deadlines Are Already Set
EU AI Act (Regulation 2024/1689) →
Annex III high-risk obligations apply 2 December 2027; Annex I obligations 2 August 2028 (moved by the Digital Omnibus, in force 27 July 2026).
Art. 50 transparency duties for deployers are already in force since 2 August 2026.
The SDAIA AI Adoption Framework (Nov 2025) is a mandatory baseline for public-sector entities and a procurement filter for vendors.
The National AI Risk Management Framework was published April 2026.
UAE Central Bank 2026 responsible AI/ML guidance; Qatar Central Bank AI guideline; ADGM rulebook AI provisions. In scope: every licensed institution.
The delay is not relief. Evidence architecture takes about twelve months to build, and the technical standards are still being drafted. That gap is the work.
What Evidence Actually Means
AI system inventory — every model, agent, and pipeline in use, versioned and located.
Risk classification — which systems are high-risk, under which framework, and why.
Decision and event logging — what the system did, when, and on what input.
Provenance and lineage — where each claim came from, through whom, and whether the chain holds.
Human-oversight evidence — who reviewed what, and the audit trail that proves it.
Technical documentation pack — the artifacts an auditor can actually open and verify.
Built on Open Source, Already Running
The four tools map directly onto the evidence functions. They exist, they're open source, and they ship.
Three Ways In
Evidence Review
Where you stand today against the frameworks that apply to you — a concrete gap list, not a slide deck.
Book on Topmate →Evidence Architecture Sprint
A working evidence layer: inventory, logging, provenance, and documentation — scoped to your highest-risk system.
Start a Sprint →Full Engagement
Enterprise-scale evidence architecture for the European Mittelstand — sovereign, GDPR-compliant, airgap-ready.
Discuss with SHCV.IT →