Short answer: An AI determination record is a self-contained document that states what an AI system is, which governance controls and regulatory requirements apply to it, what evidence proves each control, and where the gaps are. Every finding traces back to its source, and the record is tamper-evident, so auditors and regulators can verify it.
- The record shows what a system is, what applies, and what is proven.
- Every finding traces to a rule, an observation, and a source file.
- Section hashes and a root hash make any alteration detectable.
What the record contains
- A system manifest describing models, tools, data, and capabilities.
- A governance fingerprint summarizing the risk profile.
- Control determinations and the evidence state of each control.
- A risk assessment with severity and mitigation mapping.
- Evidence artifacts with collection date, source, and freshness.
- Control test results and findings with remediation steps.
- Traceability from each finding to a rule, an observation, and a source file.
- Provenance: the engine and rule versions that produced it.
Why tamper-evidence matters
A governance record is only useful if others can trust it. Hashing each section and covering the set with a single root hash means any change breaks verification, which lets an auditor confirm the record has not been altered since it was produced.
How it differs from a questionnaire response
A questionnaire records what someone said. A determination record records what was observed, what was inferred, and what was attested by a named person, and it keeps those categories distinct. That distinction is what makes the record defensible.
Where it comes from
Assessed Govern produces a determination record for each assessed system, ready for a regulator, auditor, or risk committee. Audit firms can bring that evidence into an engagement in Assessed Assurance.
Questions
Who uses an AI determination record?
Risk committees use it for approval decisions, auditors use it as evidence, and regulators use it to evaluate compliance with laws such as the EU AI Act.
How is an AI determination record verified?
Each section is hashed, and a root hash covers all sections. Re-computing the hashes confirms whether any part has changed.
Does the record replace an audit?
No. It gives the auditor a verifiable, evidence-backed starting point. The auditor still forms the opinion.