When someone asks how your AI is controlled, the answer is usually spread across emails and memory.
Evidence. The record that shows your controls were followed.
Evidence keeps the proof that Guard produces. It records what AI saw, produced and who approved it, then builds reports against the regulations, your policies and outside policies. It is designed with Guard as a pair: Guard acts, Evidence keeps the proof.
Most proof of AI control is written after the fact.
of businesses using AI have security practices that cover it.
DSIT Cyber Security Breaches Survey, 2026A renewal, a tender or a visit arrives and the record has to be assembled by hand.
A rule may exist, but there is nothing to show it was applied to a given document, call or message.
It is hard to show who signed off a consequential item, when, and on what authority.
Guard enforces your rules. Evidence proves they were followed.
Guard checks calls, customer messages and documents, and blocks, challenges or flags what does not align. Evidence records each step in the Log and turns it into the reports a regulator, insurer or customer asks for. Evidence alone gives you records with nothing enforcing them. Guard alone gives you controls you cannot show. Together, the harness both holds and proves. Both draw on GenWA frame, our control tower and knowledge base.
A harness is the set of rules, tools, checks and limits around an AI model or agent. GenWA deploys and implements harnesses; we do not build the AI harness.
A record built as AI is used, and the reports built from it.
Evidence is built on the Log, the record of events. Each item below is a product within Evidence.
The record of events: a permanent record of what AI saw, produced and who approved it, held in your cloud.
Being built: trends and answers drawn from the Log, each linked to the entries behind it.
Ready reports for a period, a tender or a visit, assembled from the record rather than written afterwards.
Your controls mapped to the frameworks and regulations you select.
Each rule, who owns it and how it is checked, with every block, challenge and sign-off and the reason for it.
Documents are produced alongside AI use and flagged for approval.
Each flagged item keeps its approver, its reason and its outcome, so the record is complete when it is needed.
Animated chart of documents generated alongside AI use and flagged to a person for approval
- 1Document generated
A record is produced alongside the AI use, as the work happens.
- 2Flagged
Anything that needs a decision is sent to the person who owns it.
- 3Approved by a person
A named person approves, changes or rejects it. AI does not sign off.
- 4Recorded
The decision, the approver and the date are kept with the document.
- What did AI produce for a given customer, and who approved it?
- Which rules were applied to a given document, call or message?
- Which systems and approved models handled this information?
- Exceptions that repeat in the same team or workflow.
- Approvals that wait longest for a named person.
- Rules that block most often, and why.
The Intelligence Layer is a product within Evidence and is being built. It is designed to sit on the Log and your records, so boards, insurers and regulators get answers you can check before you repeat them.
From rule to report without writing it up afterwards.
Choose your role and download a branded example report.
Pick a role and get an example report in GenWA branding that shows what that role is asked about AI and how Evidence answers it. It uses illustrative data, not a real customer, and is made in your browser; nothing is sent.
What a CEO is asked about AI
An AI strategy that is not fully costed or funded Projects that move quickly but do not show commercial return A business plan disrupted by new AI competitors Transformation without clear owners or milestones Teams whose skills and structure lag behind the tools
- How can a chief executive show the board that AI is under control?
- We already have an AI policy. Why do we need anything more?
- Does this slow the business down?
- What does AI cost a business of our size, and who should own the number?
What a Compliance and General Counsel is asked about AI
AI use without a known owner or data-flow map Policies that are not reflected in daily work Records that cannot show who reviewed a consequential output Supplier AI whose coverage and limitations are unclear Assurance expectations changing faster than internal skills
- How can I evidence AI controls to a regulator, insurer or auditor?
- What is in an Evidence Pack?
- Will an auditor accept evidence that comes from a vendor?
- Does GenWA replace our governance, risk and compliance tool?
What a CFO is asked about AI
AI costs spread across licences, consumption and teams Forecasts built on assumptions AI has changed Pressure to cut costs while funding growth Benefits that count saved minutes without showing cash impact Funding, fundraising or exit preparation without clear AI evidence
- How can a CFO see total AI spend in one number?
- Why can't procurement control this on its own?
- How do I forecast a cost that follows use?
- What would a saving come from?
What a COO is asked about AI
No complete view of how teams are using AI Workflows built around tools rather than operational needs Output that needs repeated checking or correction Unclear supervision, escalation and exception handling Pilots that cannot be run consistently by the operation
- How do I run AI agents like any other part of the operation?
- Who is accountable if an agent gets it wrong?
- Our pilots work well enough. Why add controls now?
- What is live today and what is being built?
What a CTO and CIO is asked about AI
Every AI question lands on technology leadership Changing models and tools outrun architectural decisions Board expectations exceed the available skills and capacity Experiments lack a secure, repeatable test environment Tool adoption bypasses data, access and release controls
- How do I give teams model choice while keeping control and a log?
- Should we build our own control layer?
- Does GenWA find every AI tool in the business?
- What happens when a model is retired or a better one launches?
What a Chief Growth Officer is asked about AI
Content volume increasing faster than evidence of return Generic output weakening the brand and customer story Teams learning tools without a shared growth strategy Customer acquisition costs and attribution that are hard to explain AI changing where customers search and discover providers
- How can marketing use AI at scale without brand or claims risk?
- Our agency already produces content. Do we need Grow?
- Will the check slow my team down?
- Does Grow handle consent and opt-out for outbound?
What a Board is asked about AI
A business plan that has not been tested against AI change Investment choices without a costed route to value Management reports that describe activity rather than outcomes Unclear accountability for skills, agents and consequential decisions An organisation structure designed for yesterday’s work
- What should a board ask about AI?
- What is the AI Effectiveness Index?
- Is AI governance a board matter or a management matter?
- Does Provision 29 of the Corporate Governance Code apply to AI?
What a Investor is asked about AI
SaaS businesses whose differentiation is being challenged by AI Portfolio companies moving at different speeds with little comparable evidence Deal sourcing and diligence that consume scarce team time AI claims that do not translate into a defensible valuation story A value-creation plan without a funded AI operating strategy
- How can an investor assess AI risk across portfolio companies?
- Should founders handle AI governance themselves?
- What does the Accelerator cost, and how do we pay?
- What does an investor receive from the audit?
Illustrative sample, not customer data. The PDF is made in your browser; nothing is sent.
Estimate the hours Evidence could give back when you are asked for proof.
Enter how often you are asked for evidence and how long it takes to assemble by hand. The calculator shows the hours a year that go on gathering rather than answering, and how they change if reports are generated from the record. It is an illustration from the figures and assumptions you enter, not a quote, a forecast or a promise of saving.
Evidence time calculator
Indicative, from the numbers you enter
- A record covers the same share of every request.
- A person still checks and signs off whatever the record produces.
Items marked assumption can be edited. No figures are stored or sent.
How this is worked out
Hours by hand a year = requests a year x hours each. Hours a record could cover = hours by hand x share covered. Hours still needing a person = the rest.
A record mapped to the standards and rules you answer to.
- ISO/IEC 42001 (the international standard for managing AI)
- UK GDPR (UK data protection law)
- SOC 2 (an independent security audit standard)
- Cyber Essentials (the UK government-backed security scheme)
- Financial Conduct Authority Consumer Duty (its customer outcomes rules)
- National Cyber Security Centre guidance
Built for the people who are asked to prove it.
Shows how AI risk is controlled, with exceptions and approvals on the record.
Answers regulators, insurers and customers from a record that was built as work happened.
Keeps evidence gathering out of the day job, with reports generated rather than assembled.
Evidence is shaped to the size and structure of your business.
Choose the tab that sounds most like your business.
Answer the insurer or the tender without a law-firm retainer
When a customer, insurer or tender asks how you control AI, you often have no in-house team to answer. Evidence keeps the record and builds the report cost-effectively, so legal and compliance skills are in the business rather than on a retainer. It supports your compliance work and does not replace legal advice where you need it.
See what suits small businessesA record that outlasts any one person
Knowledge of how AI is controlled can sit in one head. Evidence writes down what AI did and who approved it, so a lender, a buyer or the next generation can see how the business is run.
Security questionnaires answered from the record
Larger customers and investors send detailed questions about AI. Evidence answers them from what actually happened rather than from memory, so a sale or a funding round does not wait on a scramble.
One record across many teams
Teams keep notes of AI use in different places. Evidence brings them into one record with the same fields, so the head of compliance can answer a regulator or insurer without chasing ten people.
See what suits mid-market firmsShow what happened on a particular day
A supervisor asks what was said, decided and approved on a given day. Evidence keeps the Log of events and builds packs mapped to the rules you select, with the approver, the reason and the outcome for each item.
One record the board can read
Many business units and many systems make AI use hard to explain. Evidence holds one record across the AI you connect, and builds reports for each audience. The Intelligence Layer is being built to answer questions from it.
See what suits enterprisesStart with advice, run the product, or build with the incubator.
Our advisers, human and agentic, review what you could prove today, and design the records and mapping you need.
See advisoryProductEvidence runs in your AWS or Azure account, or hosted by GenWA on AWS as agreed, and builds the Log and the reports as AI is used.
See the productsIncubatorWe build new AI workflows with the record designed in, so evidence exists from day one.
See the incubatorKeep reading
How the supporting tools fit together
GenWA Frame brings together your policies, business knowledge and our methodology to guide the work.
The Log records what connected AI saw, produced and who approved it.
The Intelligence Layer is being built to turn those records into trends and answers linked to their source. We agree which tools are available and appropriate for your engagement.
Find out more about the GenWA FrameStraight answers on Evidence.
What is GenWA Evidence?
GenWA Evidence is a product that records what your AI saw, produced and who approved it, and turns that record into reports for regulators, insurers and customers. It is designed to be used with Guard.
What is the difference between Guard and Evidence?
Guard acts: it checks, blocks, challenges and flags. Evidence remembers: it records each step and builds the reports. They are two products designed to be used together.
What is the Log?
The Log is the record of events: a permanent record of what AI saw, produced and who approved it. It is the source Evidence Packs are generated from.
What does an Evidence Pack contain, and which frameworks does it map to?
A pack is a report for a period or a question. It draws on the Log, the Data-Flow Map, the Control Matrix and the Exception Log. We map to ISO/IEC 42001, UK GDPR, SOC 2, Cyber Essentials, Financial Conduct Authority Consumer Duty and National Cyber Security Centre guidance, plus sector rules. We map to them; we do not certify.
What is the Intelligence Layer?
The Intelligence Layer is a product within Evidence that is being built. It is designed to turn the Log and your records into trends and answers, each linked to the entries behind it.
Can I see a sample report?
Yes. Choose a role on this page and download a branded example report built on illustrative data. It is made in your browser and nothing is sent.
Where is the record kept, and will Evidence make us certified?
The record is kept in your AWS or Azure account, or hosted by GenWA on AWS as agreed. Personal data is redacted before approved outside model calls. Evidence does not make you certified: we prepare the evidence, accredited bodies issue certification, and this is not legal advice.
See the record your AI should be leaving.
Control-mapped, not certified. We prepare the evidence; accredited bodies issue certification. This supports compliance and is not legal advice.