System inventory. Risk tiering. Framework crosswalks.
The complete AI governance surface — built on evidence, not documentation. Every policy enforceable at decision time. Every decision auditable to the specific framework obligation.
Most AI governance programs are documentation in search of enforcement. Veridra is enforcement in search of no more documentation than you actually need.
The gap governance programs run into
A typical enterprise AI governance program has three artifacts: a policy document, a risk register, and a set of model cards. These are necessary. They are not sufficient. When a regulator asks "did your systems follow your policy on this specific decision?", the policy document is an input to the question, not the answer. Veridra is the answer — the cryptographic evidence that a specific system, with a specific risk tier, applied the governance policies in force at the moment the decision was made.
The governance surface, end to end
System inventory with live classification
Every AI system in your enterprise registered with owner, purpose, risk tier, jurisdictional applicability, and the specific regulatory obligations that apply. Changes to any of these are tracked as signed diffs. The inventory is not a spreadsheet; it is a live artifact that becomes part of every decision record.
Risk tiering aligned to regulatory taxonomies
Systems are tiered using the EU AI Act categorization (prohibited / high-risk / limited / minimal) and your own custom schemas in parallel. A system in lending, employment, or critical infrastructure is automatically flagged as high-risk with the full Article 9/12/14/15 obligation set attached.
Framework crosswalks on every decision
A single signed decision record can be examined through multiple regulatory lenses. Which Article 9 risk-management obligations were satisfied? Which NIST AI RMF functions applied? Which SR 11-7 control area? The crosswalk data (in veridra-frameworks) is updated as regulations evolve; your evidence inherits the updates.
Policy-as-code with enforcement at decision time
Governance policies written in Rego, version-controlled in Git, and enforced at the signing gateway. The policy version in effect becomes part of the decision record. Policy changes are reviewed, approved, and themselves signed before taking effect — so the governance process around governance is itself evidenceable.
Integration with existing programs
Veridra does not replace your existing governance program; it supplies the evidence layer your program lacks. Your model risk framework, your ethics review process, your incident response procedures — all continue unchanged, with Veridra becoming the substrate that makes them evidenceable. For organizations using ServiceNow, Archer, or similar GRC platforms, Veridra outputs flow into those systems as the authoritative evidence source.