AI policy is not evidence: how to prove AI compliance

Most regulated UK firms now have an AI policy. It sets out which tools are approved, what staff may and may not put into them, and who signs off on higher-risk uses. Writing one is a sensible first step, and increasingly an expected one.

But a policy describes what is supposed to happen. It says nothing about what actually happened. That gap is where the risk now sits.

A policy is a promise, not a record

Think about what an AI policy really is: a document stating your intentions. It is the equivalent of a sign on the wall reading "staff must wash hands". Useful as a control. Useless as proof that hands were washed.

When something goes wrong, or when someone asks you to demonstrate good governance, the policy cannot answer the questions that matter:

• Which member of staff used which AI tool, and when?
• What model processed the request, and did it touch personal or client data?
• Was a high-risk use flagged, escalated and approved before it went ahead?
• When a request breached policy, was it actually stopped, or merely discouraged?

A PDF in a shared drive answers none of these. It states the rule; it does not show the rule being followed. And "we have a policy" is fast becoming an unconvincing answer to people who are entitled to ask for more.

Who is now asking for proof

The shift from policy to evidence is being driven from several directions at once.

Regulators. The EU AI Act sets explicit expectations around record-keeping and logging for in-scope systems (Article 12), with retention of those logs for at least six months where deployers are concerned (Article 26(6)). Under UK GDPR you must be able to demonstrate accountability, not merely assert it. The FCA's Consumer Duty and SYSC 9 record-keeping obligations expect firms to evidence that their systems and controls work in practice. For regulated professions, the SRA Code carries similar expectations. None of these are satisfied by a statement of intent. The FCA's July 2026 Mills Review reinforces the direction, describing a move from AI that assists to AI that acts autonomously, and recommending the regulator secure and adapt its perimeter as it does.

Clients. Procurement and supplier due diligence questionnaires increasingly ask not whether you have a policy, but how you enforce it and what records you keep. Enterprise buyers want assurance they can pass on to their own regulators and customers.

Insurers. As AI-related liability becomes a live underwriting question, the firms that can show a clean, verifiable record of controlled AI use are in a different conversation from those who can only point to a document.

Boards. Directors carry personal accountability for oversight. "We trust our staff to follow the policy" is not oversight. A board wants to see that controls operate, and to be able to prove it if challenged.

What "evidence" actually means for AI use

Evidence is not a longer policy or a tidier register maintained by hand. To stand up to scrutiny it needs three properties.

First, it must be contemporaneous — generated automatically at the moment of use, not reconstructed afterwards from memory or spreadsheets. A log assembled after an incident is exactly the kind of record people distrust.

Second, it must be tamper-evident. Anyone reviewing it needs confidence that it has not been quietly edited, backdated or selectively deleted. A record that could have been altered proves nothing.

Third, it must be independently verifiable. A client or regulator should be able to confirm the record's integrity themselves, without taking your word for it.

The test is simple: could a sceptical third party trust this record even though you produced it?

In practice, the evidence does not need to capture the content of every prompt. The metadata — who used what, when, on which model, with which risk flags raised — is usually what governance and regulation actually require, and it carries far less data-protection baggage than logging the content itself.

How a tamper-evident record fills the gap

This is the problem Evaident is built to solve. It produces a single tamper-evident record of AI use across your organisation. Each event is sealed to the one before it using HMAC-SHA256, so any later alteration breaks the chain and becomes detectable. You are not asking anyone to trust that the log is intact — the cryptography shows whether it is.

By default it captures metadata, not content: who, when, which tool, which model, and which risk flags were raised. Content capture is available where you need it, but it is opt-in rather than the default, which keeps your data-protection footprint small.

When you need to show your work, Evaident generates stamped evidence packs — a summary PDF alongside CSV or JSON data and a chain-integrity certificate, re-verified at the moment of generation. A client, board or regulator can verify that pack independently. This maps directly onto the record-keeping and retention expectations of the EU AI Act, UK GDPR, FCA Consumer Duty and SYSC 9, and the SRA Code. (It supports your compliance work; it is not legal advice.)

There is an important distinction here. Connectors and logs evidence AI use after the fact — they tell you what happened once it has already happened. The Evaident Gateway goes further: it enforces your policy in real time for API tools and in-house agents, and records every block as evidence. So when your policy says a particular use is not allowed, you can prove not only that the rule existed but that it was actually applied.

This is what it means to prove AI compliance in practice: not a policy on file, but an AI audit trail a third party can check. If you are not yet sure where your exposure sits, start by finding the AI you have not approved, in what shadow AI is and how to discover it, and, for regulated firms, how to evidence AI use in an FCA firm.

From sign on the wall to system of record

A written AI policy remains necessary. It sets expectations and gives staff a clear line to follow. But on its own it is the weakest form of assurance: a promise about behaviour, with nothing behind it.

The firms that come through the next few years of AI scrutiny in good shape will be the ones that can move from "here is our policy" to "here is the proof". A tamper-evident record turns your policy from a document into a system of record — something a regulator, client, insurer or board can actually rely on.

If you want to understand where your current AI use is exposed, start with our exposure check, or see how the plans compare on pricing.