1. Objective
To make AI governance reporting trustworthy, so that boards, auditors, insurers and regulators can rely on it, by requiring that every claim states how it is known.
2. Evidence strength
| Level | Meaning | Example |
|---|---|---|
| Declared | Stated by a person or document. | Owner attests an agent reads no personal data. |
| Configured | Set or compiled in configuration, not yet confirmed in effect. | A data-loss policy has been written and deployed. |
| Observed | Seen in logs, telemetry or platform records. | Usage logs show the agent called only approved tools. |
| Verified | Read back from the enforcing system as being in effect. | The endpoint platform confirms the policy is active on devices. |
3. Requirements
600.1Every governance claim in reporting shall carry an evidence strength label: Declared, Configured, Observed or Verified.
600.2A control shall be reported as "in effect" only when Verified. Controls that are Configured shall be reported as such until read back.
600.3Absence of data shall be reported as "not measured". A failed data collection or an error shall never be presented as an empty or clean result.
600.4Composite scores shall disclose their confidence and list the dimensions that were not measured. A score's rating shall not exceed what its weakest measured dimension supports.
600.5Every reported figure shall be traceable to the underlying records from which it was computed.
600.6Sample, demonstration or illustrative data shall be labeled as such wherever it appears.
600.7The organization shall report AI governance status to its board or equivalent at least annually, using the evidence strength labels.
600.8Evidence shall be retained for the period required by the organization's record-keeping obligations, and at least long enough to support one full audit cycle.
4. Evidence
- Evidence register with strength labels and sources.
- Read-back verification records for controls reported as in effect.
- Board reporting packs.
- Records of collection failures and how they were reported.
5. Basis for conclusions
The most damaging failure in governance reporting is the false green: a control reported as working that is only configured, or a dashboard that shows nothing wrong because data collection failed. Strength labels make the basis of every claim visible. Capping composite scores at the weakest measured dimension prevents strong results in one area from hiding gaps in another.
6. Questions for respondents
- Are four strength levels the right granularity?
- Should Verified evidence be required for specific high-risk controls?