AI assurance

AI governance needs evidence, not just policy.

Many organisations begin AI governance with a policy. That is sensible, but it is not enough. Assurance depends on whether the organisation can prove that governance is actually operating.

The policy trap

A policy can describe what should happen. It does not prove that AI systems are registered, risk-tiered, approved, monitored, tested or remediated. When clients, auditors, boards or regulators ask for proof, the question becomes evidential.

What evidence-led AI governance looks like

• AI system records with named owners and business purpose.
• Risk tiering decisions with rationale and approval history.
• Evidence requests linked to controls and claims.
• Control testing and monitoring outputs.
• Findings, treatment actions, due dates and closure evidence.
• Board-ready reporting that explains movement over time.

Why this matters for EU AI Act readiness

EU AI Act readiness requires organisations to move from broad statements to structured governance, risk management and evidence. The ability to demonstrate records, oversight, monitoring and remediation becomes part of the assurance story.