White paper · September 2026
Evidence-grade AI governance.
Demonstrating control over AI usage under GDPR, DORA, NIS2 and the EU AI Act, without surveilling the workforce.
What is inside
Regulators ask you to demonstrate control, not assert it.
European regulation increasingly asks organisations to show, with evidence, that personal and sensitive data is controlled, including in AI usage. Most AI-usage tools answer with dashboards and screenshots, which depend on trusting the vendor.
This paper describes what evidence-grade means in practice: tamper-evident records, independent verification, minimisation by design, and erasure that does not break the record. It maps each property to the obligations it supports, and to works-council expectations in the Netherlands, Germany and France.
- What the regulations actually ask for
- Why dashboards are not evidence
- Four properties of evidence-grade records
- Hash chains, Merkle seals and signatures, in plain terms
- Minimisation and Article 17 by salt deletion
- Works councils: protection without surveillance
- A practical checklist
Get the white paper
5 pages · PDF · Governance · 2026
