AI governance readiness check · 5 minutes

Can your AI audit evidence leave the building?

Most AI governance tool evaluations start with features. They should start with one question: can your evidence leave the building? Answer it before the demos, and half of the shortlist decides itself.

An audit trail stored outside your control is an assertion, not evidence.
Start the checkTwelve questions. No account. Your result appears in the browser, instantly.
Three models

Deployment comes before features

Every governance tool lives in one of three places. Which one you can accept is set by your data, your policies and whoever will examine the evidence — not by the vendor's roadmap.

SaaS

The vendor hosts the tool and the evidence. Fastest to start; acceptable when the evidence may sit with a processor — ideally inside the EU.

Private cloud

The tool runs inside your own cloud tenancy or data centre. Evidence never leaves an account you control; the vendor ships software, not storage.

Air-gapped

No outbound connection at all. Updates arrive as signed packages, evidence is generated and sealed inside your network.

Twelve questions

Answer for the organisation, not for one project

Pick what is true today, not what is planned. Where you don't know, say so — “don't know” is a finding too.

0 of 12 answered0%

Where you are today

1. How many AI systems does your organisation use or build?

Count in-house models, AI features in products, and AI services employees use for work.

2. Is there an inventory of those systems?
3. Do you use AI supplied by vendors — inside SaaS products, APIs or purchased models?
4. Where does your AI audit evidence live today?

Risk assessments, test results, approvals, model documentation, logs.

Your constraints

5. What is the highest data classification your AI systems touch?
6. Which of these may not leave your organisation?

Tick every one that applies. “Leave” includes storage at a vendor, even inside the EU.

7. What does your policy say about cloud AI and external SaaS?
8. Have you ever rejected a tool because of where it stores data?
9. Do any of your AI systems run in networks without internet access?

What the evidence must survive

10. Who will examine the evidence?

Tick every one that applies.

11. Must you prove the evidence has not been altered — and can you today?
12. When must the evidence be ready for an examiner?

Answer all twelve to see your result.

Questions

About the check

Why start an AI governance tool evaluation with deployment rather than features?

Because deployment is a constraint and features are preferences. If your policy prohibits cloud AI, or your technical documentation may not leave the organisation, every SaaS tool on the shortlist is out regardless of its features. Settling where the evidence may live first removes those tools before anyone spends time on demos.

What is the difference between private cloud and air-gapped?

A private-cloud deployment runs inside a tenancy or data centre you control, but may still reach the internet for updates or licensing. An air-gapped deployment has no outbound connection at all: software and regulation updates arrive as signed packages, and evidence is generated and verified inside the network.

Why does integrity of evidence matter?

An external auditor or regulator does not only read evidence; they ask whether it could have been changed after the fact. Hashes, signatures or write-once storage make that question answerable. Integrity cannot be added retroactively — evidence created without it stays unprovable.

How is the score calculated?

The evidence-readiness score adds five items: knowing how many AI systems you have (10), a maintained inventory (25), vendor AI covered (15), evidence in one controlled place (25) and provable integrity (25). The deployment model is not part of the score; it is set by the most restrictive of your constraint answers.

Is this an EU AI Act assessment?

No. It is a deployment and evidence check that applies to any governance framework — the EU AI Act, ISO/IEC 42001 or internal policy. To classify a specific AI system under the EU AI Act, use our separate free self-assessment.

Atheros AI is an audit-ready EU AI Act compliance platform. This check is vendor-neutral: the deployment model it recommends applies to any tool you evaluate, ours included.