S3.09 - Evidence_readiness

S3.09 ? Evidence readiness

flowchart LR
    A[Fragmented records and weak retention] --> B[RAIDT\nRun-level evidence framework]
    A2[Governance claims without review-ready proof] --> B
    B --> C[[Evidence readiness\nRecords exist, are complete, accessible, protected]]
    H[Healthcare, enterprise AI, audit practice, metadata templates] --> C
    C --> D[Run-level evidence pack]
    C --> E[RAIDT score profile]
    C --> I[Reviewer reconstruction]
    D --> F[Reviewability and contestability]
    E --> G[Governance readiness]
    I --> G
    D --> J[Organisational learning]
    E --> K[Policy alignment]

? Star S3 - Run-Level Evidence Logic

Star context: Within Star S3, this item explains whether the evidence needed to govern a run is actually available for reconstruction, comparison, challenge, and institutional review. It sits alongside evidence object, reconstructability, and audit trail by asking a prior question: is the run evidentially ready to be examined at all?

Academic picture

Definition / background

Evidence readiness describes whether the records needed to review a run exist, are complete enough for scrutiny, are accessible to the right people at the right time, and are protected in a way that preserves their governance value. In plain terms, it asks whether an organisation is genuinely prepared to show what happened in a particular generative AI use episode rather than merely claim that it was governed.

Conceptually, evidence readiness sits between record creation and formal review. A record may exist without being review-ready: it may be partial, stored in the wrong place, stripped of context, unavailable to auditors, or insufficiently protected against tampering or deletion. Evidence readiness therefore differs from simple record retention. It is about usable evidential condition, not only about presence.

This matters in GenAI governance because runs are often fast, iterative, and socio-technical. Prompts, outputs, approvals, user interventions, model settings, retrieval context, and post-processing steps may all affect whether a run can later be understood and challenged. If those elements are not ready for review, governance collapses back into assertion. RAIDT addresses this by treating the run as the unit of governance and by asking whether the evidence pack for that run can support reconstruction, scoring, and challenge.

Within RAIDT, evidence readiness belongs inside run-level evidence logic because it determines whether the framework can operate as intended. A run-level evidence pack is only meaningful if its contents are present and usable. Likewise, a five-pillar score profile is more defensible when the underlying evidence is review-ready. Evidence readiness therefore supports the transition from principles to demonstrable governance across Responsibility, Auditability, Interpretability, Dependability, and Traceability.

Why this concept matters

Evidence readiness solves a basic but often overlooked governance problem: organisations may have policies, tools, and good intentions, yet still be unable to show what happened in a specific run when a supervisor, auditor, regulator, examiner, or affected stakeholder asks to see it. The concept avoids confusion between having some documentation and being genuinely prepared for review.

If evidence readiness is missing, several risks appear immediately. Reviewers cannot reconstruct decisions properly. Contestability becomes weak because challenges cannot be checked against the underlying record. Auditability degrades because logs, prompts, outputs, or approvals may be incomplete or inaccessible. Organisational learning is also reduced, because failed or high-risk runs cannot be compared systematically with successful ones.

For organisations using GenAI in real work, this matters because governance pressure usually appears after deployment decisions have already been made. RAIDT makes evidence readiness operational by connecting it to the run, the evidence pack, and the score profile. That means the question is no longer, "Do we care about evidence?" but rather, "For this run, are we actually ready to show and examine the evidence?"

Key idea: Evidence readiness matters because RAIDT can only govern a run through evidence if that evidence is complete, accessible, and reviewable when scrutiny occurs.

What this item captures

Whether the records needed to review a run have actually been created.
Whether those records are sufficiently complete to support reconstruction and challenge.
Whether authorised reviewers can access the evidence without excessive delay or dependence on individual memory.
Whether the evidence has been protected through retention, versioning, integrity controls, and appropriate access management.
Whether a run-level evidence pack can be assembled in a defensible way.
Whether missing evidence should reduce confidence in the resulting RAIDT score profile.
Whether the organisation is operationally prepared for audit, supervision, incident review, or policy learning.

Practical example / likely audience question

Audience question

What if evidence is missing?

Answer

The concern behind this question is that governance frameworks often look strongest when everything has been logged perfectly, but organisational reality is usually messier. In practice, prompts may not be retained, approvals may sit in email, outputs may be copied into another system, and model settings may not be captured consistently. The question therefore tests whether RAIDT can still be useful when evidence conditions are imperfect.

The direct answer is that missing evidence should not be hidden or explained away. In RAIDT, gaps in evidence readiness are themselves governance findings. If a required record is missing, inaccessible, or unreliable, the relevant pillars should score lower because the organisation has less basis for claiming responsible, reviewable use. The missing record also becomes an explicit improvement action for future runs.

For example, imagine a team using a GenAI assistant to draft policy briefings. If the final output is saved but the prompt history, reviewer comments, and approval trail are absent, the organisation may still possess an artefact but not a review-ready evidence pack. RAIDT handles this better than a generic AI governance approach because it ties the weakness to a specific run, shows which evidence objects are absent, and reflects the gap transparently in the score profile instead of leaving it as a vague concern.

Practical example in RAIDT terms

Consider a healthcare trust using a generative AI tool to draft a patient discharge summary for clinician review. The run-level issue is not simply whether the model produced readable text, but whether the trust can later show how that draft was produced, checked, amended, and authorised in that specific clinical context.

The evidence needed includes the prompt or instruction template, the source patient data used to frame the task, the model or system version, timestamps, the generated output, the clinician edits, the approval record, and the storage location that preserves integrity and access control. If some of these are missing, evidence readiness is weak even if the final summary appears acceptable.

In RAIDT pillar terms, Responsibility is affected because human oversight cannot be demonstrated clearly; Auditability is affected because the run cannot be reconstructed in a robust way; Interpretability is affected because the logic of the output cannot be explained against the available context; Dependability is affected because repeatable assurance is weakened; and Traceability is affected because the evidence chain is broken. Evidence readiness improves governance readiness by ensuring that the run can be reviewed after the fact without relying on informal recollection.

Detailed link to RAIDT

Evidence readiness links to RAIDT in four ways.

First, it supports RAIDT's core idea that governance should be grounded in evidence about actual runs rather than broad claims about systems or policies.
Second, it determines whether a run can be reconstructed and assessed at the run level using usable proof objects.
Third, it affects the quality of both the evidence pack and the score profile, because incomplete or inaccessible evidence reduces the defensibility of both.
Fourth, it strengthens reviewability, contestability, audit readiness, and organisational learning by making post hoc examination possible.

Evidence readiness ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

This chain matters because RAIDT is only as strong as the evidential condition of the records it relies upon. Evidence readiness is therefore not an optional administrative extra; it is a precondition for the framework's operational credibility.

Link to the five RAIDT pillars

Responsibility

Evidence readiness supports Responsibility by making it possible to show who initiated, reviewed, amended, approved, or relied upon a run. Without review-ready records, responsibility can be claimed but not demonstrated.