Evidence Register
A starter list of the evidence an auditor would request for an AI system in the GCC, by control family. Use it with the T08 audit checklist and fill in the last two columns as requests are made and answered.
The same data is available as a CSV file: evidence_register.csv.
| Ref | Family | Evidence item | Wiki control | Format | Requested date / owner | Received date / status |
|---|---|---|---|---|---|---|
| E01 | Governance | AI policy approved and dated | AI-CTRL-012 | Policy document | ||
| E02 | Governance | Role and accountability matrix | AI-CTRL-012 | RACI | ||
| E03 | Governance | Board or executive AI risk reports | AI-CTRL-037 | Minutes, packs | ||
| E04 | Inventory | AI inventory (T09) | AI-CTRL-011 | Register export | ||
| E05 | Inventory | Discovery sweep output | AI-CTRL-011 | Procurement / SaaS / cloud list | ||
| E06 | Inventory | Tiering records (T01) | AI-CTRL-011 | Completed forms | ||
| E07 | Privacy | Impact assessments (T02) | AI-CTRL-013 | Signed assessments | ||
| E08 | Privacy | Lawful basis record | AI-CTRL-013 | DPO record | ||
| E09 | Privacy | Rights-request log and test | AI-CTRL-017 | Log, test record | ||
| E10 | Privacy | Bilingual notices (T06) | AI-CTRL-013 | Screenshots, version history | ||
| E11 | Residency | Attestation (T04) | AI-CTRL-007 | Signed form | ||
| E12 | Residency | Cloud region configuration export | AI-CTRL-007 | Config export | ||
| E13 | Vendor | Due diligence (T03) | AI-CTRL-014 | Completed addendum | ||
| E14 | Vendor | Contract clauses | AI-CTRL-014 | Contract extract | ||
| E15 | Oversight | Human review log with overrides | AI-CTRL-023 | Log extract | ||
| E16 | Oversight | Kill-switch test record | AI-CTRL-025 | Test report | ||
| E17 | Safety | Accuracy, robustness, safety test reports (incl. Arabic) | AI-CTRL-039 | Reports | ||
| E18 | Security | Prompt-injection / exfiltration test | AI-CTRL-005; AI-CTRL-039 | Pen-test report | ||
| E19 | Fairness | Bias test records (T10) | AI-CTRL-041 | Records, code hash | ||
| E20 | Fairness | Explanation records sample | AI-CTRL-041 | Sample | ||
| E21 | Incident | Playbook and notification matrix (T05) | AI-CTRL-035 | Documents | ||
| E22 | Incident | Tabletop exercise report | AI-CTRL-035 | Report | ||
| E23 | Incident | Incident register | AI-CTRL-035 | Register | ||
| E24 | Regulator | Authority register and contact log (T11) | AI-CTRL-013 | T11 | ||
| E25 | Risk | Risk register (T12) | AI-CTRL-037 | Register | ||
| E26 | Assurance | Evidence retention rule | AI-CTRL-038 | Policy | ||
| E27 | Assurance | Prior findings tracker | AI-CTRL-038 | Tracker |