Artifact identifier
A stable identifier that distinguishes the artifact inside the review package.
Minimum Evidence Record for AI Systems Under Review.
A deterministic field model for artifacts intended to survive procurement, ATO, customer assurance, or independent governance examination.
ISSUEDJuly 28, 2026STATUSPublic referenceCITATIONAGICOMPLY Evidence Standard v1.0
PURPOSE
Make each artifact attributable, reviewable, and reconstructable.
The standard defines the minimum fields AGICOMPLY expects when organizing an evidence package. It does not determine legal applicability, certify compliance, or establish that a control operated effectively.
Download record templateTHIRTEEN MINIMUM FIELDS
The record a reviewer should be able to reconstruct.
AI system and version
The defined system, release, model, interface, or configuration the artifact concerns.
Source
Where the artifact originated and how it was obtained.
Evidence owner
The accountable internal role or organization responsible for the artifact.
Approver
The attributable role or person who approved the relevant decision, where applicable.
Collection date
When the artifact entered the assessment boundary.
Freshness or validity condition
The period, event, or system change that requires revalidation.
Review element supported
The defined requirement, control, question, or review condition the artifact may support.
Verification action
What the reviewer examined, compared, recalculated, or confirmed.
Reviewer conclusion
Supported, partially supported, unresolved, contradictory, stale, or not applicable within the defined scope.
SHA-256 content hash
A content-integrity reference for the supplied artifact.
Change or invalidation trigger
The event that may cause the evidence relationship to require re-examination.
Chain-of-custody reference
The ledger sequence, package identifier, or handling record linking the artifact to the assessment.
USAGE RULES
What this standard establishes.
- Every artifact is connected to a defined system and review context.
- Every included relationship records a verification action and reviewer conclusion.
- Content integrity is separated from accuracy, completeness, currency, and control effectiveness.
- Unresolved conditions remain visible rather than being converted into a score.
WHAT IT DOES NOT ESTABLISH
No certification by implication.
- Legal compliance or regulatory applicability
- Continuous operation of an underlying control
- Independent attestation or certification
- Authorization to operate
1.0
Initial public release defining minimum record fields, evidence limitations, and citation format.