AI Governance Evidence Infrastructure
AI takes action.
Can you reconstruct
what happened?
Examine the evidence connecting AI actions to controls and authority.
Start with one historical decision.
AI Evidence Readiness Assessment
For regulated financial services teams reviewing a consequential AI action. Example use cases include an account recovery incident, an identity workflow review or a disputed approval. Examine what the supplied records establish, what is missing and what remains unknown.
One to three workflows. One selected historical decision.
R25,000 South Africa / US$2,500 internationally
A fixed-scope engagement with an Evidence Readiness Record, written findings and a findings call. We attempt one selected historical decision reconstruction for the engagement.
- Payment
- 50% upfront. Balance due seven calendar days after report delivery.
- Delivery
- Ten business days after complete agreed intake, cleared upfront payment and capacity confirmation.
Scope, data handling and applicable tax treatment are agreed in the proposal before work begins. Do not send sensitive records before handling arrangements are agreed.
Agree the scope
Select one to three AI workflows and the historical decision to examine.
Examine the records
Look for links between the action, inputs, model identity, policy version, approval authority and outcome.
Prioritise the gaps
Separate process changes from the evidence instrumentation needed for a scoped pilot.
What does the evidence support?
- MISSING
- Artifacts not supplied or located.
- UNKNOWN
- Conclusions the records cannot support.
The Evidence Readiness Record separates supported findings from missing artifacts and unsupported conclusions. Historical reconstruction depends on the records supplied; it cannot recreate events that were never captured.
From assessment to evidence infrastructure
A scoped pilot agrees the events to capture and controls to evaluate. Hash chaining and available timestamp material support checks for changes to captured records. They do not prove that a decision was correct or that every event was captured.
Content reviewed .
Explore the infrastructure, resources and FAQs
Built for regulated environments. Runtime decision evidence, policy-linked records, and independent verification, designed for financial services, insurance, and government institutions where AI decisions carry material regulatory or operational consequences.
Can you connect the recommendation to the action?
An incident review may need records from the AI system, policy checks, approval process and service that executed the action. The assessment examines whether those records connect to the same decision, and makes missing links explicit.
How it works
Four steps to
verifiable evidence.
Synthetic demonstration. Illustrative deployment scenario with invented records and abbreviated hashes. No live service status or executed verification is shown.
Evidence, not policy management.
Evidence Integrity
Captured records are SHA-256 hash-chained. Ledger roots can be anchored with RFC 3161 timestamps, separately from capture. Independent verification checks record hashes, chain links and timestamp evidence for alterations.
Read the verification methodology →Independent Verification
Where enabled, records can be verified with standard cryptographic tools without relying on access to KairoNull systems. The purpose is to reduce dependence on the system that originally produced the evidence.
Verify a record →Audit Readiness
Evidence exports on demand as a structured bundle for boards, auditors, and regulatory review. KairoNull supports AI governance evidence workflows without claiming that a cryptographic format guarantees regulatory acceptance in every jurisdiction.
See a sample audit report →EU AI Act Article 12
Logging Checklist
A practical checklist for reviewing logging scope, traceability and retention. It separates regulatory questions from optional integrity checks and gives no legal opinion or compliance guarantee.
- Questions for reviewing automatic logging and traceability
- Optional integrity checks: hash chaining and timestamp evidence
- A practical test of independent record verification
- Scope questions to discuss with your legal or compliance team
Get the checklist
Questions every buyer asks
Straight answers. No marketing language.
Does this integrate with our existing AI stack?
Yes. KairoNull integrates via REST API, webhook receiver, or our SDK (Python, Node.js). It sits above your AI layer, not inside it. Your system must send the events and context you want recorded; capture coverage depends on that integration.
Is the evidence cryptographically secure?
KairoNull uses SHA-256 hash chaining and timestamping to make changes to recorded evidence detectable. Verification can be performed independently where the verification material is available. This is an integrity mechanism, not a claim that cryptography makes an underlying AI decision correct.
Will regulators accept this as evidence?
KairoNull is designed to support AI logging, traceability, governance evidence, and audit review under applicable frameworks. We do not claim that regulators universally require SHA-256, RFC3161, or any particular cryptographic implementation, nor that using KairoNull guarantees regulatory acceptance. Acceptance depends on the applicable framework, deployment, controls, and examination context.
How long does deployment take?
Timing depends on your workflow, integration and security review. We agree the scope and schedule before work begins. The AI Evidence Readiness Assessment reviews one to three workflows and delivers an Evidence Readiness Record and a findings call.
Where is data stored, and can we run this on-premise?
Hosting location and data handling must be agreed for each deployment. We do not promise EU residency or an on-premise service on this public website. Discuss your residency and security requirements before sending sensitive records.
Can we export the evidence for regulators or auditors?
Yes. On-demand audit export produces a structured evidence bundle with the available integrity and verification material. The objective is to give boards, auditors, and regulators a reproducible record of what happened, under which controls, and what evidence supports the conclusion.