An audit is a mark-to-market on your controls: the question is not whether you believe your AI estate is governed, but whether you can settle the claim with evidence.
Why EU AI Act Evidence Matters Now
For two years, “AI governance” has been a philosophy debate — frameworks, principles, acceptable-use memos. That window is closing. The EU AI Act’s high-risk obligations begin applying on August 2, 2026, with the product-safety tranche following on August 2, 2027. NIST’s AI Risk Management Framework and the AICPA’s SOC 2 Trust Services Criteria are pulling the same thread from the voluntary and contractual side. The three converge on one operational question: what AI runs here, and what can it touch?
That is no longer a philosophy question. It is an evidence question. And evidence has a settlement standard that opinions do not. When an auditor asks you to demonstrate that an AI agent did not process a restricted dataset, “we have a policy against that” is an assertion. Assertions do not clear. What clears is provenance — a record of who ran what, on which device, against which labeled data, and what control fired.
Most organizations are long assertions and short evidence. That is an unhedged position, and the settlement date is now on the calendar.
| Signal | Figure | Source |
|---|---|---|
| High-risk AI obligations apply | August 2, 2026 | EU AI Act, Art. 113 |
| Product-safety high-risk deadline | August 2, 2027 | EU AI Act, Art. 113 |
| Agent incidents from internal violations (through 2028) | ≥80% | Gartner |
| Enterprises operating ungoverned agents in their estate | 88% | Ospiri research |
Attestation vs. Assertion: What Actually Clears an Audit
An assertion is a claim about state. Attestation is a verifiable record of what happened. A screenshot of a governance dashboard is the former dressed as the latter — it shows you what a console believed at the moment you pressed capture, not what a process did on disk at 2 a.m. three sprints ago. Auditors have learned to price that difference.
| Dimension | Dashboard screenshot (assertion) | Kernel artifact (attestation) |
|---|---|---|
| Who invoked the agent | Inferred from SaaS login | Bound to the OS user and process |
| Which device | Often unknown for local tools | Endpoint-resolved, per host |
| Which data was touched | Not captured below the API | File path + sensitivity label at open |
| What control applied | “Policy exists” | Verdict recorded inline: allow / block / sandbox |
| Tamper-evidence | Editable image | Signed, append-only event |
| Auditor treatment | Supporting color | Primary evidence |
The gap between these two columns is the gap between passing and re-scoping the audit. A control you can only describe is a control the auditor discounts to zero.
The Anatomy of the Audit Request
When the assessor arrives, the request is not “show me your AI policy.” It is a sequence of increasingly specific questions, and the drop-off point is where most estates fail:
- Inventory. Enumerate every AI agent — sanctioned and shadow — running across the fleet. Most teams answer for SaaS seats and stall at local tools like Cursor, Claude Desktop, and standalone MCP servers.
- Reachability. For each agent, what data, credentials, and systems can it reach? Browser and API logs describe network chatter; they are blind to the local filesystem.
- Attribution. Tie a specific action to a specific identity on a specific device. UEBA can approximate this for humans; agents act unattended, at machine speed, with no session to profile.
- Enforcement proof. When policy said no, show that something actually intervened — not that an alert was later filed.
- Integrity. Prove the record itself was not edited after the fact.
The failure is rarely at step one. It is at steps two through five, where narrative runs out and only kernel-level ground truth carries.
Scoring Your Evidence Position
Treat audit readiness the way you would a portfolio’s risk — as a measurable exposure, not a feeling. A simple frame:
Evidence Completeness = (Coverage × Provenance) + (Granularity × Tamper-Resistance)
Each factor is scored 0–1; the product punishes a zero in any single term, which is the point. Full coverage of a record nobody can trust still settles at zero.
| Factor | What it measures | Fails when |
|---|---|---|
| Coverage | Share of agents observed, incl. local + shadow | Endpoint agents are invisible |
| Provenance | Action tied to identity + device + data | Only aggregate SaaS metadata exists |
| Granularity | File-, label-, and syscall-level detail | Evidence stops at the network edge |
| Tamper-Resistance | Signed, append-only artifacts | Records are editable exports |
Run this before the auditor does. A near-zero term is where you allocate this quarter’s budget.
What Kernel-Grade Evidence Is — And Isn’t
The architectural answer is to generate the evidence where the action actually resolves: at the kernel, alongside your existing EDR, not above it at the prompt or the API. When a process opens a file marked sensitive, the record captures process, file, label, action, and verdict as one signed event. That is the artifact an auditor treats as primary.
| Control family | Kernel artifact provides | Maps to |
|---|---|---|
| Inventory & traceability | Per-endpoint agent enumeration | EU AI Act record-keeping; SOC 2 CC7 |
| Data governance | File + sensitivity label at access | AI Act data-governance duties |
| Runtime enforcement | Inline allow / block / sandbox verdict | NIST AI RMF MANAGE function |
| Integrity | Append-only, signed events | SOC 2 CC5 control activities |
What it is not: a replacement for agent IAM, data classification, or your full information-governance program. It does not author your policy. It proves your policy ran. Kept honest, it is the difference between attestation and assertion — and it plays alongside the identity and DLP layers you already own rather than trying to be them.
What CISOs Should Do This Quarter
| Step | Action | Output | Effort |
|---|---|---|---|
| 1 | Inventory every AI agent, including local and shadow | Ranked agent estate with owners | Low — zero-install discovery |
| 2 | Score evidence completeness on the four factors | A defensible gap map | Low — one working session |
| 3 | Turn on kernel-level capture for high-risk endpoints | Signed process/file/label/verdict records | Medium |
| 4 | Assemble an evidence pack mapped to AI Act / NIST / SOC 2 | Auditor-ready artifact set | Medium |
Sequence by exposure, not by vendor convenience. The endpoints touching regulated data earn enforcement first; the rest can mature in parallel.
The Bottom Line
An audit does not ask what you believe about your AI estate — it asks you to settle the claim, and screenshots do not clear. The EU AI Act, NIST AI RMF, and SOC 2 have converted “what AI runs here and what can it touch?” from a philosophy question into an evidence question with a fixed settlement date in 2026. The organizations that pass will be the ones holding kernel-grade provenance — process, file, label, action, verdict — not the ones holding a tidy dashboard. Attestation clears; assertion gets discounted to zero. If your team is sizing this for the first audit cycle under the AI Act, request a working session. We will walk through your environment, score your evidence completeness on the four factors, and scope a deployment — in 90 minutes.