The five artefacts of an AI governance evidence file

This series has spent months building one document at a time: a policy, a tool inventory, a training attendance record, a readiness score, a review cycle. Each piece treated its own artefact as the point. None of them named what all five add up to when someone actually asks an organisation to prove, not claim, that its AI governance is real. Under the EU AI Act's Article 4 AI literacy obligation, and under the plainer test any board, funder or auditor applies anyway, a demonstration is not a sentence in an annual report. It is a file.

This piece names the five artefacts that file has to contain, and why leaving any one of them out quietly undermines the other four.

Why one document is never enough on its own

A policy with no training record behind it proves an organisation wrote something down, not that anyone read it or acted on it. A training attendance record with no competency check behind it proves people showed up, not that they learned anything they can actually apply. A readiness score with no review record behind it proves a snapshot from one point in time, frozen exactly there, with no evidence the organisation has kept looking since. Each artefact answers a different half of the same question, and a demonstration built on only one or two of them collapses under the first follow-up question a genuinely sceptical auditor, board member or funder asks.

The five artefacts

• The AI policy, the permitted-use table, the red-line list, the escalation path and its 24-hour rule, all of it built earlier in this series, is what shows an organisation has actually decided what is and is not allowed, rather than leaving the question to whoever happens to be using a tool that day.
• The tool inventory, the least glamorous artefact this series has covered and arguably the one that unlocks all the others, is what shows the policy maps onto what staff are actually using, not a theoretical list of approved software nobody checks against reality.
• The training attendance record, trivial to keep at the moment of delivery and impossible to reconstruct afterwards, is what shows the policy and the literacy obligation behind it were actually delivered to real people, not just written and filed.
• The competency or readiness assessment, the score this series built dimension by dimension, is what shows staff came away from training actually able to do something, closing the gap between attendance and literacy that attendance alone can never close.
• The review record, the output of the fixed six-month cycle and any early reviews it triggered, is what shows the whole file has kept moving since it was first assembled, rather than describing an organisation as it existed on the day someone happened to write the policy.

A demonstration is not five documents sitting in five separate folders. It is one file that answers the same question five different ways: can you show it, not just tell it.

What holding all five together actually buys

The five artefacts already exist, in some form, in most organisations that have worked through this series. What changes when they sit in one place, cross-referenced and current, is response time. An organisation that can produce the file in the minutes after being asked has a fundamentally different relationship with the question than one that needs weeks to reconstruct an attendance record nobody kept properly, or discovers its tool inventory has not been touched since the year it was written. The assembly itself, not any single artefact inside it, is what turns five separate pieces of paperwork into a genuine demonstration.

The practical takeaway

Treat the AI policy, the tool inventory, the training attendance record, the competency assessment and the review record as one evidence file rather than five separate documents, keep all five current and cross-referenced in one place, and test response time by asking how quickly the file could actually be produced if someone asked for it tomorrow.

No external statistic cited; this article presents an internal reference framework rather than third-party evidence. The underlying obligation referenced is the EU AI Act's Article 4 AI literacy requirement; readers should confirm current requirements with their own regulator or counsel.