Audit AI regulatory obligation evidence integrity

Audit point-in-time AI-system classification, counsel-supplied obligation applicability, control evidence and incident-reporting clocks without pretending to infer law.

Statistical audit & measurement Audit CTOs Tech CEOs IT managers Team leads Investors

What it's for

Turns AI regulatory readiness into an evidence-backed control room: leaders see exactly which systems, obligations, controls and reporting clocks need repair.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

Field	Type	Role	Required
ai_systems	array of objects (11 fields)	Evidence	Yes
as_of_ms	number ≥ 0	Your calibration	Yes
control_evidence	array of objects (10 fields)	Evidence	Yes
incident_reports	array of objects (8 fields)	Evidence	Yes
max_detail_rows	integer ≥ 1, ≤ 500	Numerical control	Optional
minimum_evidence_coverage	number ≥ 0, ≤ 1	Your calibration	Optional
obligations	array of objects (12 fields)	Evidence	Yes

Each `obligations` record

Field	Type	Required
applicable_risk_class_ids	array of string (≥ 1 item)	Yes
applicable_use_case_ids	array of string (≥ 1 item)	Yes
counsel_approved	boolean	Yes
effective_from_ms	number (≥ 0)	Yes
effective_until_ms	number,null (≥ 0)	Yes
evidence_verified	boolean	Yes
id	string (non-empty)	Yes
jurisdiction_id	string (non-empty)	Yes
maximum_control_evidence_age_days	number (≥ 0)	Yes
reporting_deadline_hours	number,null (≥ 0)	Yes
required_control_ids	array of string	Yes
required_evidence_type_ids	array of string	Yes

Example input

{
  "ai_systems": [
    {
      "classification_method_hash": "sha256:classification-v4",
      "classified_at_ms": 900,
      "deployed_at_ms": 1000,
      "evidence_verified": true,
      "id": "recruiting-assistant",
      "incident_ledger_complete": true,
      "inventory_complete": true,
      "jurisdiction_ids": [
        "eu"
      ],
      "retired_at_ms": null,
      "risk_class_id": "counsel-high",
      "use_case_ids": [
        "recruiting"
      ]
    }
  ],
  "as_of_ms": 2000,
  "control_evidence": [
    {
      "control_id": "human-review",
      "evidence_type_id": "control-test",
      "evidence_verified": true,
      "id": "test-2026-08",
      "independently_reviewed": true,
      "observed_at_ms": 1900,
      "system_id": "recruiting-assistant",
      "test_passed": true,
      "valid_from_ms": 1800,
      "valid_until_ms": null
    }
  ],
  "incident_reports": [],
  "obligations": [
    {
      "applicable_risk_class_ids": [
        "counsel-high"
      ],
      "applicable_use_case_ids": [
        "recruiting"
      ],

Truncated for display — the full payload is 61 lines.

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

Example output

{
  "assumptions": [
    "Qualified counsel supplies the complete point-in-time obligation registry, jurisdiction/use/risk applicability, evidence requirements and reporting clocks; Gitrevio does not infer law from system behavior.",
    "The AI-system inventory, classification method, control evidence and incident ledger are complete, immutable and tenant-scoped; the latest evidence must be effective, timely, passed, independently reviewed and verified."
  ],
  "counts": {
    "active_ai_systems": 1,
    "applicable_system_obligation_pairs": 1,
    "compliant_pairs": 1,
    "control_evidence_records": 1,
    "incident_reports": 0,
    "registered_obligations": 1
  },
  "decision": "ai_regulatory_obligation_evidence_ready_for_counsel_attestation",
  "evidence": {
    "gate_pass": true,
    "minimum_required_fraction": 0.95,
    "verified_fraction": 1
  },
  "failure_counts": {},
  "integrity_pass": true,
  "limitations": [
    "Passing establishes consistency with the submitted obligation model, not legal compliance, regulatory approval, conformity certification, privilege, safety or permission to deploy.",
    "The audit cannot discover omitted laws, systems, incidents, jurisdictions or fraudulent evidence and never assigns legal fault, intent, misconduct or employment suitability to a person."
  ],
  "method": "point_in_time_counsel_supplied_ai_obligation_control_reporting_audit_v1",
  "obligation_diagnostics": [
    {
      "applicable_jurisdiction_id": "eu",
      "control_diagnostics": [
        {
          "control_id": "human-review",
          "evidence_id": "test-2026-08",
          "failed_gates": []
        }
      ],
      "failed_gates": [],
      "obligation_id": "counsel-obligation-v4",
      "required_control_count": 1,
      "system_id": "recruiting-assistant"
    }
  ],
  "reporting_diagnostics": [],
  "truncated_detail_rows": 0

Truncated for display — the full payload is 45 lines.

How it works

Statistical audit & measurement — Check whether a number is fit to decide on: coverage, timing, reconciliation, and the gaps a dashboard hides.

1 Join active AI systems to the counsel-approved obligation registry by jurisdiction, risk class, use case and effective interval.
2 Select the latest effective control evidence known by the audit time, then gate age, test result, independent review, provenance and required evidence-type coverage.
3 Reconcile incident materiality and reporting timestamps to the registered deadline while blocking future-dated evidence and reporting every failed gate.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Assumptions & guardrails

Metric definitions, weights, aggregate grain, sampling, missingness, dependence, and comparison windows correspond to the management claim being audited.
Counsel owns a complete versioned obligation registry; engineering owns a complete immutable system inventory; assurance owns control tests; legal operations owns the complete incident ledger.
Association, instability, or measurement quality is not a causal effect and must not be converted directly into an individual employment decision.
Passing means the submitted evidence is internally ready for counsel attestation, not that Gitrevio has determined legal compliance, safety, conformity or permission to deploy.

Minimum evidence

ai_systems: required and organization-defined
obligations: required and organization-defined
control_evidence: required and organization-defined
incident_reports: required and organization-defined
as_of_ms: required and organization-defined

How to validate it

Validate on future periods or held-out aggregate units, compare with a simple baseline, and require stability across plausible metric definitions and decision thresholds.

Calibrating it to your org

Same for everyone

The mathematical kernel, validation rules, method version, and JSON output semantics are organization-independent; no tenant-trained coefficients or company benchmark is embedded in the function.

Specific to you

tenant-scoped point-in-time system-to-obligation applicability and latest-effective-evidence reconciliation that preserves legal source/version lineage
system and obligation perimeter, counsel applicability/risk taxonomy, effective dates, evidence types/freshness/independence, incident completeness, reporting clocks, audit time, evidence verification and escalation ownership

Calibration workflow

1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "audit pointintime aisystem classification counselsupplied obligation" }
  → finds "audit_ai_regulatory_obligation_evidence_integrity"

gitrevio_capability_describe
  { "capability_id": "audit_ai_regulatory_obligation_evidence_integrity" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "audit_ai_regulatory_obligation_evidence_integrity", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

Forecast AI regulatory change liability

Forecast counsel-defined regulatory-change frequency, lognormal remediation work and cost, capacity queues, shared jurisdiction shocks, enforcement exposure and liability CVaR.

Forecasting & survival

Optimize AI compliance control portfolio

Select reusable AI compliance controls and one plan per obligation using Beta-binomial residual risk, shared jurisdiction loss, exact shared costs/resources and a CVaR Pareto frontier.

Constrained optimization

Audit agentic action control integrity

Audit operational AI-agent actions from bounded least-privilege permission scope through independently tested authorization, approval, sandbox, monitoring, rollback or compensation, and kill-switch controls, counting unique value exposure once.

Statistical audit & measurement

Audit AI configuration release integrity

Audit that the exact immutable AI configuration bundle evaluated and approved is the bundle exposed in every staged rollout, with consecutive parent lineage, complete blast-radius declaration, effective runtime controls, monotone traffic and a tested prior-version rollback path.

Causal inference & experiment design

Audit AI data rights provenance integrity

Audit every AI training, fine-tuning, retrieval, evaluation, logging and persisted-output use against an immutable rights grant and the complete derivative lineage, including time, revocation, deletion, purpose, jurisdiction, consent, derivative and evidence gates.