Evidence Pack
A comprehensive bundle of documentation, logs, and artifacts that demonstrate AI system compliance for auditors.
Definition
An evidence pack is a structured, verifiable collection of documentation, execution logs, approval records, and integrity artifacts that together demonstrate an AI system's compliance with regulatory requirements. Unlike static documentation that describes intended processes, an evidence pack contains proof that those processes actually executed: audit trails showing human approvals occurred, logs demonstrating policy enforcement, and checksums enabling independent verification that records have not been tampered with.
The EU AI Act requires not just that organizations implement compliance measures, but that they can demonstrate implementation to market surveillance authorities and auditors. Article 18 requires providers to keep documentation and logs at the disposal of national competent authorities for ten years. Article 26 requires deployers to keep automatically generated logs. Throughout the regulation, the emphasis is on provable, documented compliance rather than mere assertions. When auditors arrive, whether internal auditors conducting readiness assessments, external auditors performing certification reviews, or market surveillance authorities conducting enforcement investigations, they ask for evidence. Can you prove your risk management system operates? Show me the audit trail. Can you demonstrate human oversight functions? Show me the approval records. Can you verify these records have not been altered? Show me the integrity proofs.
A comprehensive evidence pack typically includes: Annex IV technical documentation (the required documentation for high-risk systems), audit trails (chronological records of system operations, decisions, and human interactions), approval records (evidence of human oversight actions including approvals, rejections, escalations, and overrides), monitoring reports (performance metrics, drift detection results, and incident records), and integrity artifacts (manifests listing all included files with cryptographic checksums enabling verification).
The key distinction between compliance documentation and an evidence pack is verifiability. An evidence pack includes integrity verification mechanisms: manifests with cryptographic hashes, timestamps from trusted sources, append-only storage proofs, all of which allow auditors to independently confirm that evidence has not been modified after the fact.
Citable answer
Citation object
Definition
An evidence pack is a structured, verifiable collection of documentation, execution logs, approval records, and integrity artifacts that together demonstrate an AI system’s compliance with regulatory requirements. It contains proof that the documented processes actually executed: audit trails showing human approvals occurred, logs demonstrating policy enforcement, and manifests with cryptographic checksums enabling independent verification that records have not been altered.
Scope and exceptions
- Applies when
- Use this evidence model when preparing for an internal audit, an external certification review, a market-surveillance inquiry, or a customer due-diligence request covering an AI system in production.
- Exceptions
- Static policy documents and design records describe intent. They join the pack as context; the load-bearing content is the execution evidence and its integrity artifacts.
Decision framework
- Annex IV technical documentation for the system under review.
- Audit trails: chronological records of system operations, decisions, and human interactions.
- Approval records: human oversight actions including approvals, rejections, escalations, and overrides.
- Monitoring reports: performance metrics, drift detection results, and incident records.
- Integrity artifacts: manifests listing every included file with cryptographic checksums.
Minimum evidence
- A manifest of included records with hashes and a stated verification method.
- Trusted timestamps and retention metadata for each record class.
- The approval records tied to the decisions under review, with reviewer identity and authority.
- The completeness statement: which systems, period, and population the pack covers.
Worked regulated workflow
Proving human oversight for one sampled decision
Scenario: An auditor samples one agent-prepared decision and asks for proof that the documented oversight control operated.
Workflow: The pack resolves the decision to its execution record: the policy verdict, the Decision Request, the reviewer identity and rationale, the resulting state change, and the downstream receipt. The manifest lists each record with its hash, and the auditor recomputes the hashes to confirm the records match what was sealed at collection time.
Questions buyers ask
- What is the difference between compliance documentation and an evidence pack?
- Verifiability. Documentation describes intended processes. An evidence pack contains the records showing those processes executed, plus manifests, hashes, and timestamps that let a reviewer independently confirm the records were not modified after the fact.
- What does the EU AI Act require organizations to keep?
- Article 18 requires providers to keep documentation at the disposal of national competent authorities for ten years, and Article 26 requires deployers to keep automatically generated logs. The regulation emphasises provable, documented compliance throughout.
- What belongs in an AI evidence pack?
- Annex IV technical documentation, audit trails, approval records, monitoring reports, and integrity artifacts: a manifest of every included file with cryptographic checksums.
- How does an auditor verify an evidence pack?
- By recomputing the manifest hashes against the delivered records, checking timestamps and chain of custody, and confirming the stated population and period match the records supplied.
Primary sources
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- AI Act Service Desk: Article 18
- KLA Evidence Room sample
Freshness:
How KLA Control Plane implements this
Evidence Room assembles execution records, policy verdicts, and approval decisions into a Sealed Evidence Bundle: a manifest with hashes and signatures that a reviewer can verify offline. Execution Lineage supplies the underlying decision records.
- Capability
- /platform/execution-lineage
- Technical reference
- /resources/ai-agent-evidence-bundle-manifest-schema
- Practical artifact
- EU AI Act evidence pack checklist
Scope boundary: Legal retention interpretation, regulator-facing submission, and the underlying business systems of record remain owned by the organization.