AI Governance Evidence Infrastructure
AI takes action.
Can you reconstruct
what happened?
For financial-services teams reviewing an AI-assisted action, examine the records connecting the request, applicable controls, approval authority and outcome.
Start with one historical decision.
AI Evidence Readiness Assessment
For regulated financial services teams reviewing a consequential AI action. Example use cases include an account recovery incident, an identity workflow review or a disputed approval. Examine what the supplied records establish, what is missing and what remains unknown.
Review one to three agreed AI workflows.
US$2,500 one fixed engagement
We attempt to reconstruct one selected historical decision from available records for the entire engagement. You receive an Evidence Readiness Record, written findings, up to five prioritised gaps, a target evidence design and a 45-minute findings call.
- Payment
- 50% upfront. Balance due seven calendar days after report delivery.
- Delivery
- Within ten business days once the agreed intake is complete, the upfront payment has cleared and delivery capacity is confirmed.
Scope, data handling, invoice currency and applicable tax treatment are agreed in the proposal before work begins. Do not send sensitive records before handling arrangements are agreed.
Agree the scope
Select one to three AI workflows and the historical decision to examine.
Examine the records
Look for links between the action, inputs, model identity, policy version, approval authority and outcome.
Prioritise the gaps
Separate process changes from the evidence instrumentation needed for a scoped pilot.
What does the evidence support?
- MISSING
- Artifacts not supplied or located.
- UNKNOWN
- Conclusions the records cannot support.
The Evidence Readiness Record separates supported findings from missing artifacts and unsupported conclusions. Historical reconstruction depends on the records supplied; it cannot recreate events that were never captured.
From assessment to evidence infrastructure
After the assessment, additional reconstruction, authority and control design, or a pilot can be separately scoped. A scoped pilot agrees the events to capture and controls to evaluate. Hash chaining and available timestamp material support checks for changes to captured records. They do not prove that a decision was correct or that every event was captured.
Content reviewed .
Explore the infrastructure, resources and FAQs
Built for regulated environments. Runtime decision evidence, policy-linked records, and independent verification, designed for financial services, insurance, and government institutions where AI decisions carry material regulatory or operational consequences.
Can you connect the recommendation to the action?
An incident review may need records from the AI system, policy checks, approval process and service that executed the action. The assessment examines whether those records connect to the same decision, and makes missing links explicit.
How it works
Four steps from
capture to verification.
Synthetic demonstration. Illustrative deployment scenario with invented records and abbreviated hashes. No live service status or executed verification is shown.
Evidence for the review question.
Evidence Integrity
Captured records are SHA-256 hash-chained. Ledger roots can be anchored with RFC 3161 timestamps, separately from capture. Independent verification checks record hashes, chain links and timestamp evidence for alterations.
Read the verification methodology →Independent Verification
Where enabled, records can be verified with standard cryptographic tools without relying on access to KairoNull systems. The purpose is to reduce dependence on the system that originally produced the evidence.
Check the synthetic sample →Audit Readiness
Evidence exports on demand as a structured bundle for boards, auditors, and regulatory review. KairoNull supports AI governance evidence workflows without claiming that a cryptographic format guarantees regulatory acceptance in every jurisdiction.
See a synthetic bundle →EU AI Act Article 12
Logging Checklist
A practical checklist for reviewing logging scope, traceability and retention. It separates regulatory questions from optional integrity checks and gives no legal opinion or compliance guarantee.
- Questions for reviewing automatic logging and traceability
- Optional integrity checks: hash chaining and timestamp evidence
- A practical test of independent record verification
- Scope questions to discuss with your legal or compliance team
Get the checklist
Questions every buyer asks
Straight answers. No marketing language.
Does this integrate with our existing AI stack?
The assessment uses supplied, authorised records and includes no production integration. A subsequent pilot can scope API or SDK integration for one workflow. The hosted service is not generally available, and capture coverage depends on the events the integration actually sends.
Is the evidence cryptographically secure?
KairoNull uses SHA-256 hash chaining and timestamping to make changes to recorded evidence detectable. Verification can be performed independently where the verification material is available. This is an integrity mechanism, not a claim that cryptography makes an underlying AI decision correct.
Will regulators accept this as evidence?
KairoNull is designed to support AI logging, traceability, governance evidence, and audit review under applicable frameworks. We do not claim that regulators universally require SHA-256, RFC3161, or any particular cryptographic implementation, nor that using KairoNull guarantees regulatory acceptance. Acceptance depends on the applicable framework, deployment, controls, and examination context.
How long does deployment take?
Timing depends on your workflow, integration and security review. We agree the scope and schedule before work begins. The AI Evidence Readiness Assessment reviews one to three workflows and delivers an Evidence Readiness Record and a findings call.
Where is data stored, and can we run this on-premise?
The current ledger runs in a single EU project in Ireland, as described on the Security page. Other regions and on-premises deployments are not standard services. Assessment handling and any pilot hosting requirements must be agreed before sensitive records are shared.
Can we export the evidence for regulators or auditors?
The assessment delivers written findings and an Evidence Readiness Record. A separately scoped pilot can agree an export with the available records and integrity material. The public technical bundle is synthetic; it demonstrates bounded checks and does not establish regulatory acceptance.