Checklist preview (excerpt)
3) Human oversight records
- Minimum: oversight SOP + intervention triggers + role definitions
- Strong: review queue records (approve/reject/edit/override + rationale)
- Gold: sampled review outcomes + disagreement handling + training evidence
7) Logging integrity proof & retention
- Minimum: audit event taxonomy + retention policy
- Strong: integrity mechanism documented + periodic verification reports
- Gold: export bundles with manifests + checksums + verification steps
View the worked example
manifest.json (excerpt)
- bundle_id: kla-export-2025-12-16-001
- includes: audit-log.ndjson, review-queue.csv, policy-pack.tar.gz
- checksums: sha256:...
- verify: recompute checksums; validate hash chain
Before you begin
For compliance, risk, product, and ML ops teams shipping agentic Processes into regulated environments.
This checklist organizes the evidence for an audit-readiness review by theme, with minimum, strong, and gold-standard examples.
Use it to spot gaps fast and to standardize what your team can export on demand.
When to use this resource
- You’re getting procurement or audit questions and need a consistent package.
- Your evidence is scattered across tools and you need an exportable bundle.
- You want to map Annex IV claims to actual runtime evidence and review records.
Information to gather
- Your system inventory + owners.
- Locations of key artifacts (risk register, SOPs, runbooks, eval reports).
- Your export mechanism (what you can bundle + how you verify integrity).
Review checklist
Use these checks in the review with your system owner. Confirm the applicable requirements and attach evidence for the decisions your team makes.
- Covers system description, risk management, oversight, validation, monitoring, change control, and logging integrity.
- Defines minimum vs strong vs gold-standard per theme (easy to forward internally).
- Includes export instructions and verification steps (manifest + checksums).
- Links to the actual artifacts/templates used by the team (SOPs, policies, checklists).
Operating controls and evidence
- Govern
Governance as enforceable controls (policy-as-code + approval gates), not spreadsheets.
Change control links every version bump to an approval record.
- Assure
Sampling and near-miss metrics become measurable control effectiveness signals.
Monitoring outcomes are recorded as evidence, not screenshots.
- Prove
Evidence Room exports package telemetry, approvals, and policies with a manifest + checksums.
Append-only audit ledger provides tamper-evident proof of execution and interventions.
Questions about this resource
What is an “evidence pack”?
A verifiable export bundle that contains the artifacts and logs an auditor requests, plus a manifest and checksums so the bundle can be verified independently.
What do auditors ask for most often?
System description and boundaries, risk management and mitigation evidence, human oversight records, validation results, monitoring/incident logs, change approvals, and logging integrity + retention.
What makes an evidence pack “gold-standard”?
Reproducibility and verification: the pack includes a manifest, checksums, and integrity proofs that tie “documentation claims” to “runtime evidence.”
Do we need to include Annex IV?
Annex IV applies to high-risk AI systems. Even when Annex IV isn’t required, an Annex IV-style structure is often useful as an internal audit readiness dossier.
How do we avoid exporting sensitive data?
Use redaction rules and hashed references where appropriate, and document access controls and minimization in the evidence pack.
How often should we run an export drill?
Many teams do a monthly lightweight drill and a quarterly “full pack” drill, then capture corrective actions as evidence.
Download file language: English