EU AI Act and ISO/IEC 42001 Evidence Pack

• Head of Compliance or GRC
• CISO
• CTO
• Data Protection Officer

Enterprise customers and auditors are starting to ask SaaS and AI vendors for evidence about their AI systems: what they do, how they were tested, how risks are managed and how people oversee them. The information exists in tickets, notebooks, test logs and engineers' heads, but not in a form counsel or an auditor can review.

We build an evidence pack for one or more AI features. We start with an inventory: what each system does, which models and data it uses, who uses it and where it runs. We then gather the technical evidence and, where gaps exist, produce it: architecture and data flow records, evaluation and red-team results, security test reports, logging and monitoring design, human oversight points and an incident process. Each item is mapped to relevant EU AI Act obligations, ISO/IEC 42001 Annex A controls and NIST AI RMF functions in a traceability matrix. Risk classification notes are prepared for your counsel to decide. The pack is designed to be maintained as features change, not rebuilt for each audit.

• AI system inventory with purpose, models, data, users and deployment
• Technical documentation of architecture, data flows and model choices
• Security and safety testing records with versions and fixes
• Human oversight and logging design records
• Traceability matrix to EU AI Act obligations, ISO/IEC 42001 Annex A controls and NIST AI RMF
• Gap list with owners, and a process to keep the pack current

1. 01Inventory AI systemsWe list each AI feature with its purpose, users, models, data sources and deployment.
2. 02Gather existing evidenceWe collect architecture notes, evaluations, test reports, incidents and policies from your teams.
3. 03Fill testing gapsWhere testing is missing, we run focused security and safety tests and record the results.
4. 04Map to requirementsEvidence is mapped to EU AI Act obligations, ISO/IEC 42001 controls and NIST AI RMF functions.
5. 05Counsel and GRC reviewYour counsel reviews the risk classification notes, and your GRC lead approves the pack and gap list.
6. 06MaintainOwners and triggers are set so the pack is updated when features, models or data change.

1. Inventory
   • AI system register
   • Model and data source catalogue
2. Evidence collection
   • Connectors to repositories, issue trackers and test logs
   • Interview templates for engineering and product
3. Testing
   • Security and safety test runs
   • Evaluation result store with versions
4. Mapping
   • Requirement library for EU AI Act, ISO/IEC 42001 and NIST AI RMF
   • Traceability matrix
5. Review and maintenance
   • Counsel and GRC review workflow
   • Change triggers and owner assignments

Your counsel decides risk classification under the EU AI Act, and your GRC lead approves the pack and accepts or assigns each gap. Certification decisions rest with your accredited auditor.

• Code repositories such as GitHub or GitLab
• Issue trackers such as Jira or Linear
• GRC tools such as Vanta or Drata, or a spreadsheet register
• Evaluation and observability tools
• Document storage such as Confluence, Notion or SharePoint

• No compliance or certification claims made in the pack
• Every statement linked to a source document or test record
• Classification notes clearly marked for counsel decision
• Access to the pack limited to named roles
• Version history kept for every update

• Designed to support, not replace, legal assessment under the EU AI Act and certification audits against ISO/IEC 42001.
• NIST AI RMF mapping helps US-facing customers compare your evidence with their own risk programmes.

• SaaS & AI Product Companies

  Continuous AI Security Regression in CI

  Run versioned prompt-injection, jailbreak and data-leakage suites in CI on every prompt, model, tool or index change, and block releases that regress past agreed severity thresholds.

• SaaS & AI Product Companies

  Security Questionnaire Answering Assistant

  Draft answers to security and AI due-diligence questionnaires from your own policies, reports and past answers, with citations, confidence and owner approval before anything goes to a customer.

• SaaS & AI Product Companies

  LLM Application Penetration Test (OWASP LLM Top 10)

  A scoped pentest of your LLM feature and the app around it: prompt injection, data disclosure, output handling, excessive agency and system-prompt leakage, with reproducible evidence.

• Banking

  AI Governance Evidence Pack for Banks

  Inventory the bank's AI and ML systems and assemble the evidence boards, auditors and supervisors ask for: purpose, data, testing, monitoring, incidents and accountable owners.