When AI influences a decision, an examiner, auditor or internal reviewer needs a coherent account of what happened. The questions depend on the workflow and applicable obligations. Preparing an evidence file after a problem is harder when the relevant decisions, source material and approvals were never recorded.
Questions an examiner may ask
What decision did AI support? Which information was available? Who had authority to approve the action? What testing supported release, and what changed afterward? Organize the file so each question leads to retained evidence. Begin with the business task, intended users, consequences of error, named owner and excluded uses. A simple data-flow view establishes the systems involved without assuming the examiner already knows the implementation.
Show how acceptance was reached
Retain the test method, representative cases, results and significant exceptions. Record who reviewed the evidence and which limitations were accepted. The record should distinguish a test of model output from a test of the complete business workflow. A successful response is not evidence that a downstream action completed correctly.
Connect operation and change
Keep configuration versions, material updates, approvals and monitoring records associated with the same workflow. Show how incidents or repeated corrections changed the test set or operating procedure. Avoid storing only the latest configuration; a past decision may need to be explained using the version that was active at the time.
Organize for retrieval, not document volume
Create an index with links to each required record, its owner, location and version. A reviewer should not need to search chat histories or infer which spreadsheet is current. Where a record is missing, show the gap and its owner rather than substituting a generic policy document.
Keep the distinction between evidence and a statement of intent. A policy says that releases are tested; a dated test report and approval record show whether a particular release was tested. Both have a place in the file. The practical goal is a coherent account that can be checked, not the largest possible collection of attachments.
Use a retrieval exercise to find gaps
Choose a case and ask a reviewer to locate the applicable scope, inputs, source references, action authority and outcome. Record what cannot be reconstructed. Tailor the evidence requirements with the relevant risk and legal teams; there is no single universal examination pack that guarantees acceptance across sectors or jurisdictions.
Before the next decision
Planning checklist
- Purpose, owner and permitted-use record
- Data flow and access decisions
- Acceptance evidence and limitations
- Operating history and change approvals
Sources and further reading
Sources checked 5 October 2026. The design recommendations in this guide are AID’s analysis. Sector obligations depend on the use case and jurisdiction.
Apply this to a defined workflow
AID’s Model Governance & Audit Pack can structure the evidence record and identify missing implementation artifacts.
