What makes AI governance evidence independently verifiable
Governance software promises immutable audit trails, and almost all of them mean the same thing, which is trust our database. What independent verifiability actually requires, why the difference is categorical and the question to ask any vendor.
What makes AI governance evidence independently verifiable?
Evidence is independently verifiable when a third party can confirm it existed at a claimed time and has not changed since, without trusting the party that produced it or needing access to that party's systems. That takes cryptography rather than access controls, meaning content addressed by hash so any alteration is detectable, anchoring and timestamps held outside the producer's infrastructure so the producer cannot quietly rewrite history, digital signatures with external keys so authorship and sign-off are provable, and verification tooling the third party can run themselves, ideally open source. Most governance software offers "immutable" audit trails instead, meaning append-only logs inside the vendor's own infrastructure, and however well built those are, verifying them still means trusting the vendor. The difference is categorical, not a matter of degree, and it decides whether your record still stands when someone has a reason to doubt it.
Every AI governance product promises a durable record. The words vary, with immutable, tamper-evident, audit-ready and system of record the usual set, but underneath them nearly the whole category means one thing, an append-only log inside the vendor’s own infrastructure. That design is fine right up until the moment the record is doubted, and records get doubted in exactly the situations they exist for. This guide explains what it takes for governance evidence to survive that moment, and why the difference between immutable and verifiable is categorical rather than a matter of degree.
The trust problem with “immutable”
An internal audit trail, however well engineered, makes a promise of the form “we did not change this, and our systems would not let us”. Both halves of the promise are made by the party holding the record. When a regulator, a court, a counterparty in a dispute or a sceptical customer examines that record, the question they are entitled to ask is why they should believe the holder, and an answer that describes the holder’s own access controls does not reach the question. It restates the promise. This is not an accusation against any vendor, it is just what internal means, because verification requires trusting the system being verified.
What independent verifiability requires
Independence means the check works without the producer. Four properties get you there.
Content addressed by hash. Each piece of evidence is fingerprinted, so any alteration, however small, is detectable by anyone holding the fingerprint. Structures like Merkle trees extend this from single documents to whole collections, so one compact anchor commits to everything beneath it.
Anchoring and timestamps outside the producer’s control. The fingerprints, and the times they existed, are lodged with parties and services the producer does not control. This is the property that closes the rewriting-history problem, because the producer cannot alter what it no longer solely holds.
Signatures with external keys. Authorship and sign-off, meaning who attested to what, are carried by digital signatures whose keys do not live inside the producer’s database, so an attestation is provable rather than merely recorded. For records with long lives, signature schemes chosen to survive future advances in computing, including post-quantum schemes, are part of taking the lifetime seriously.
A verifier the third party can run. The check itself must be available to the doubter, ideally as open-source tooling, because a verification that only the producer can perform is the trust problem wearing a costume.
With all four in place, the conversation changes shape. Instead of “trust us, our logs are append-only”, the record’s holder can say “here is the evidence, here are the anchors and timestamps held outside our control, here is the verifier, check it yourself”. The doubter does not need to trust the holder, the holder’s vendor or anyone’s database administration. That is the categorical difference.
What verifiability does and does not prove
Verifiability proves integrity, meaning the record existed at the claimed time and has not changed since. It does not prove the governance described in the record was adequate, and no cryptography can. The two proofs work together. A reader assessing your governance needs the content to be assessable at all, which requires knowing it is what it was, and only then does the substantive judgement begin. A vendor implying that cryptographic evidence certifies governance quality has confused the layers, and so has a buyer dismissing verifiability because it “only” proves integrity. Integrity is the load-bearing floor.
There is one more consequence worth noticing, which is that a verifiable record outlives its custodian. Because the anchors, timestamps and verifier live outside any one party, the record remains checkable even if the software vendor, or for that matter your own records team, is long gone. For evidence whose useful life is measured in years, that is not a corner case.
Where Aicura fits
Aicura built its proof layer on these properties. The Evidence Vault is append-only and sealed, evidence is anchored with Merkle trees and externally timestamped, attestations are signed with external keys including post-quantum schemes and the verifier, evverify, is open source, so a regulator, auditor or customer can check the record without trusting Aicura, and the record’s durability does not depend on Aicura’s survival. That is the design behind the phrase we use for it, which is evidence you don’t have to trust us for.
Aicura provides guidance, not legal advice, and does not certify, audit or issue a compliance verdict. What the verified record shows about your governance is for its readers to judge.
Common questions
Isn’t an append-only database good enough? For day-to-day operations, usually. For the moment the record is challenged, no, because the challenge is precisely that the party holding the database could have altered it, and an append-only design inside that party’s own infrastructure cannot answer the challenge from outside. Verifiability exists for the day the record matters most.
Does verifiable evidence prove our governance was good? No, and the distinction is worth holding onto. Verifiability proves the record is what it was, meaning these documents existed at these times and have not changed. Whether the governance they describe was adequate is a judgement the reader makes. Proof of integrity and proof of quality are different things, and evidence needs the first for the second to even be assessable.
Why does post-quantum signing matter for governance records? Because governance evidence has a long life. A record sealed today may need to hold up a decade from now, after advances in computing may have weakened the signature schemes common today. Signing with schemes designed to survive that future is how a record is built for the lifetime it actually has.
What should we ask a vendor about their audit trail? One question does most of the work, which is whether a third party can verify the evidence without access to the vendor’s systems. If the answer describes permissions, backups or the append-only design of their database, the trail is internal and the answer is no. If the answer involves hashes, external anchoring, external timestamps, signatures and a verifier you can run, it is yes.
A note on this page
This guide explains a property of evidence and why it matters, in general terms. Whether verifiable evidence is required, useful or persuasive in a particular legal or regulatory setting is a question for your advisors in that setting. It is general information, not legal advice.
Related guides
- What counts as AI audit evidence — What the evidence needs to show, before how it is proven.
- How to keep AI governance records
- How to evaluate an AI governance platform
Evidence you don't have to trust us for
Aicura's Evidence Vault is append-only and sealed, anchored with Merkle trees, externally timestamped and signed with external keys including post-quantum schemes, with the open-source evverify verifier so a third party can check the record without trusting Aicura.