Verifiable AI Governance.
The Guide.
Almost all organizations already have an AI policy. Very few can demonstrate that it was implemented in a specific system, on a specific date, under the leadership of a specific person. This guide explains how to bridge that gap.
Verifiable AI Governance:
From saying what should happen to demonstrating what happened.
"All high-risk models undergo an evaluation before being deployed."
"Model v3.2 passed the E-114 evaluation on March 14. It was approved by the risk manager. Fingerprint 7f2a…: anyone can verify that it hasn't changed."
Until recently, a well-written policy was enough. Four changes have come at once, and now it falls short.
Agents that act
AI creates tickets, executes code, and moves data. Any action without evidence of who authorized it poses an operational and legal risk.
Changing Models
What was evaluated in January may not be what is in effect in June. Without version-specific evidence, the evaluation becomes obsolete within weeks.
Regulations Requiring Testing
The EU AI Act and ISO/IEC 42001 are audited based on facts: records, versions, and human oversight—not on intentions.
Customers who ask questions
Major clients and the public sector want to know how the services they contract are managed. A verifiable answer brings the conversation to a close.
Not all evidence pointsto the same conclusion.
Each level answers a question.
Confusing the levels is the most common mistake when designing a verifiable governance program. Each level adds a layer of assurance and has a clear boundary.
Integrity
Cryptographic fingerprint of the asset. What is being examined today is exactly what existed when it was registered.
It doesn't say who did it or whether it was right.
Identity and Authority
Who recorded the evidence, in what capacity, and under what policy?
It doesn't say that person reviewed the content in detail.
Human oversight
What was reviewed, what changed, what was approved or rejected. What is required by Article 14 of the EU AI Act.
It does not replace the quality of the review; it makes it verifiable.
Weather
When evidence was available. This makes it possible to demonstrate that an assessment preceded a deployment.
The V-Seal™ registry seal is not an eIDAS-qualified time stamp.
Five pieces that change at different tempos.
A single record of evidence.
An organization's AI is not a single entity. Verifiable governance treats each component separately and links them in the V-Seal™ registry.
Systems and Models
- Inventory and Purpose
- Risk Level
- Versions and Reviews
- Approvals
Agents
- Identity and Authority
- Limitations and Tools
- Significant Actions
- Human Interventions
Code
- Changes and Review
- AI-to-Human Ratio
- Deployments
- Branches
Data and Documentation
- Legal Basis and Conservation
- Technical Documentation
- Policies in Controlled Versions
Human Decisions
- Approvals and Rejections
- Exceptions with a Time Limit
- Incidents and Closures
How V-Seal™ Works: The seal is formed, and the contents do not escape beyond its perimeter.
Fingerprint
SHA-256 of the asset or manifest. The file is neither uploaded to nor stored on V-PROOF.
Context
System, version, policy, person in charge, AI-to-human ratio, and oversight, all related to the footprint.
Stamp
Record with a unique reference and date. Any subsequent change breaks the correspondence.
Verification
A third party checks the public portal without an account: "Match" or "Not found."
Verifiable governance and compliance:
Each framework has its own requirements, but the evidence is the same.
It's not just another frame. It's a way to show off the ones you already have or will have.
You don't have to run everything on the first day.
You have to prove yourself first.
Programs fail because of ambition: they try to cover the entire field of AI before they have a single piece of verifiable evidence. The opposite approach works.
Inventory
What AI systems are available, who is responsible for each one, and what level of risk they pose.
Diagnosis
Which obligations are already in effect, what evidence exists, and which are merely declaratory. One week.
A system
The one with the highest risk or the one customers ask about most often. It is managed from start to finish.
Early Evidence
Evaluation, approval, release, and monitoring—all recorded and verifiable. Then, repeat.
Questions people usually ask before getting started.
How is it different from a GRC tool or a SIEM?
A GRC system organizes policies, risks, and controls; a SIEM collects security events. Neither produces evidence that a third party can verify without relying on the tool itself. Verifiable governance builds on both and adds that layer: a digital fingerprint, context, and an independent log.
Does it replace an audit or certification?
No. It changes the timeline and reliability: instead of reconstructing evidence using emails and screenshots, the auditor verifies records that include a digital signature, date, and the person responsible.
What leaves the perimeter of my organization?
The digital signature and governance context that you choose to record. The content of the asset—whether it is a document, template, data, or code—is neither sent to nor stored in V-PROOF. You can view it piece by piece in Confianza.
What happens if the document or form changes after it has been stamped?
Any change results in a different hash, and the modified copy returns a "Not found" error. The original version remains verifiable; a new, legitimate version is stamped as such, and the chain between the two remains intact.
Is it the same as an electronic signature?
No. A qualified electronic signature verifies the signer’s identity under eIDAS. The V-Seal™ verifies the integrity of a record, its governance context, and the time at which it existed in the registry. They are complementary.
Does it work with the AI we purchase from third parties?
Yes, and that is the most common scenario. It governs the organization's use of the system: purpose, evaluation, approval, configuration, monitoring, and incidents.