Proving AI decisions to your board: a 1-page evidence checklist

Most boards do not need a 40-page AI policy. They need one page of evidence that answers a single question: if someone challenged a decision our AI made, could we prove what happened - and that nobody changed the record? Gartner, PwC, Deloitte and EY all now publish board-level AI oversight guidance to the same effect.

This checklist is that one page. Share it with your audit, risk and compliance committee. If every box is ticked, your organisation can answer "yes" with confidence.

The 1-page evidence checklist

For every automated decision your organisation makes, you should be able to show:

• Signed with your key. Each decision is sealed with your organisation's own Ed25519 key, not the vendor's. The signature proves origin and integrity.
• Hash-chained. Every record links to the one before it. Tamper with any entry and the break is detectable by re-checking the chain - no database required.
• Time-anchored. An independent RFC 3161 timestamp proves when the decision was signed.
• Logic captured. Model version, relevant inputs (references, not raw PII), confidence/risk scores and the routing outcome are recorded.
• Verifiable offline. An auditor can verify a receipt against your published key with no account and no trust in the platform.
• Sovereign. The evidence lives in an open format on infrastructure you control.
• Erasable, provably. When retention expires, content is cryptographically erased while a signed proof keeps the chain anchor.

These six properties are explained in depth in The Forensic Witness: why automated decisions need an independent record.

Why "trust the dashboard" is not enough

A live dashboard shows how a system is behaving now. It does not prove what a specific decision was at a specific time, or that the log behind it hasn't been edited. When a regulator asks, the dashboard is a snapshot; the audit trail is the record.

A record you can only inspect by logging into the vendor's console is not auditable. Auditable means an auditor can prove your claims against you.

Using this with Decision Keep

Decision Keep produces exactly this evidence for every automated decision: signed, chained, time-anchored, and verifiable offline against your published key. Each record is sovereign to your infrastructure, so the board's evidence never leaves your control.

• Verify a sample receipt with no account.
• Read the receipt specification.
• Book a demo to map this checklist to your stack.