title: “Evidence Schema” description: “Machine-readable representation of governance evidence.”
Evidence Schema
The Evidence Schema provides the machine-readable structure for representing evidence that supports AI governance activities, assessments, controls, decisions, assurance, and continual improvement. Evidence provides the connection between governance requirements or decisions and the information used to demonstrate that relevant activities, controls, or conditions have been performed or satisfied.Purpose
The Evidence Schema supports consistent representation and traceability of governance evidence. Evidence records may support: * AI system governance * risk treatment * control implementation * control assessment * approval decisions * monitoring * incident management * change management * assurance * improvement activities * governance evaluation The schema provides the structural representation of an evidence record. It does not by itself determine whether evidence is sufficient, appropriate, or conclusive.Evidence relationships
Evidence should remain connected to the governance object, activity, requirement, decision, or claim that it supports. Evidence records may be related to: * AI systems * risks * controls * assessments * approvals * monitoring activities * incidents * changes * assurance activities * governance decisions * improvement activities * retirement activities A representative relationship is: requirement / risk → control → evidence → assessment → assurance This relationship helps preserve traceability between a governance expectation, the control or treatment applied, the evidence produced, and the resulting governance conclusion.Evidence provenance
Evidence should provide sufficient information to establish its origin and context. Depending on the evidence type, relevant information may include: * evidence identity * evidence type * source * owner * creation date * collection date * applicable period * provenance * scope * related governance object * status * retention requirements * access or handling requirements The precise permitted structure is defined by the canonical JSON Schema.Evidence quality
The existence of an evidence record does not automatically establish that the evidence is sufficient. Organizations should evaluate evidence according to the governance purpose for which it is being used. Relevant considerations may include: * relevance * completeness * accuracy * authenticity * currency * provenance * scope * applicability * integrity * retention * accessibility * reliability * relationship to the governance claim being supported Evidence requirements should be proportionate to the significance and risk of the governance activity.Evidence and assessment
Evidence provides a basis for assessment conclusions. A governance assessment may use evidence to determine whether a control, requirement, risk treatment, approval condition, or other governance criterion has been implemented or satisfied. A representative relationship is: control → evidence → assessment → finding → remediation → verification Where deficiencies are identified, subsequent evidence can be used to demonstrate remediation and support verification.Evidence and approval
Evidence may support governance decisions by demonstrating that relevant prerequisites, controls, assessments, or conditions have been satisfied. For example, evidence may be associated with: * classification decisions * risk assessments * control assessments * approval conditions * remediation actions * monitoring requirements * assurance findings This allows an approval decision to remain traceable to the information considered when the decision was made.Evidence and assurance
Assurance activities may review evidence to determine whether governance processes, controls, decisions, and outcomes are appropriately supported. Assurance should consider the quality and relevance of the evidence rather than treating the existence of an evidence record as sufficient by itself. Evidence can therefore participate in the assurance chain: governance claim → evidence → assurance review → finding → conclusionEvidence and evaluation
The AIGO machine-readable evaluation layer may use evidence-related information when evaluating defined governance conditions. The evaluation architecture separates governance records from evaluation logic: governance records → rules → evaluation → result Evidence therefore remains a governance artifact while evaluation rules define the conditions that may be checked. Automated evaluation should not be interpreted as a universal substitute for human evidence review, professional judgment, or assurance activity. An evaluation result should be interpreted within the scope, rules, evidence, and data available to the evaluation.Evidence retention
Evidence should be retained according to applicable organizational, contractual, legal, regulatory, and governance requirements. Retention considerations may include: * retention period * evidence lifecycle status * legal or regulatory requirements * contractual requirements * security requirements * privacy requirements * records-management requirements * relationship to active governance decisions * relationship to assurance activities Retirement or disposal of an evidence record should preserve any required governance history and traceability.Machine-readable governance
The Evidence Schema forms part of the broader AIGO machine-readable governance layer. It can be related to other governed objects, including: * AI systems * risks * controls * assessments * approvals * monitoring * incidents * changes * assurance * management reviews * improvements * retirement These relationships allow evidence to operate as a shared traceability layer across the AIGO governance lifecycle.Validation
Evidence structures participate in the broader AIGO validation and traceability model. Repository validation may include checks relating to: * schema structure * references * traceability * evidence relationships * control coverage * framework consistency * document integrity * repository health * machine-readable governance artifacts A successful validation result provides evidence about the integrity of the validated repository or artifact scope. It does not by itself establish legal compliance, certification, accreditation, or regulatory conformity.Canonical source
Machine-readable schema:schemas/10-evidence/10-AIGO-Evidence-Schema-v0.1.json
Schema documentation:
schemas/10-evidence/10-AIGO-Evidence-Schema-Documentation-v0.1.md