Two of this month's five free Independent AI Audits are still open, included when you start an AI health check.Check eligibility →
Control harnesses

When someone asks how your AI is controlled, the answer is usually spread across emails and memory.

Evidence. The record that shows your controls were followed.

Evidence keeps the proof that Guard produces. It records what AI saw, produced and who approved it, then builds reports against the regulations, your policies and outside policies. It is designed with Guard as a pair: Guard acts, Evidence keeps the proof.

Book a demoDownload the brochure
The problem it solves

Most proof of AI control is written after the fact.

24%

of businesses using AI have security practices that cover it.

DSIT Cyber Security Breaches Survey, 2026
A blank page at the worst time

A renewal, a tender or a visit arrives and the record has to be assembled by hand.

Controls with no trail

A rule may exist, but there is nothing to show it was applied to a given document, call or message.

Approvals nobody can find

It is hard to show who signed off a consequential item, when, and on what authority.

Two products, one job

Guard enforces your rules. Evidence proves they were followed.

Guard checks calls, customer messages and documents, and blocks, challenges or flags what does not align. Evidence records each step in the Log and turns it into the reports a regulator, insurer or customer asks for. Evidence alone gives you records with nothing enforcing them. Guard alone gives you controls you cannot show. Together, the harness both holds and proves. Both draw on GenWA frame, our control tower and knowledge base.

A harness is the set of rules, tools, checks and limits around an AI model or agent. GenWA deploys and implements harnesses; we do not build the AI harness.

What Evidence produces

A record built as AI is used, and the reports built from it.

Evidence is built on the Log, the record of events. Each item below is a product within Evidence.

Log

The record of events: a permanent record of what AI saw, produced and who approved it, held in your cloud.

See the LogIntelligence Layer

Being built: trends and answers drawn from the Log, each linked to the entries behind it.

See the Intelligence LayerEvidence Packs

Ready reports for a period, a tender or a visit, assembled from the record rather than written afterwards.

See Evidence PacksCompliance Mapping

Your controls mapped to the frameworks and regulations you select.

See Compliance MappingData-Flow Map

Where information goes when AI is used, and which approved models it reaches.

See the Data-Flow MapControl Matrix and Exception Log

Each rule, who owns it and how it is checked, with every block, challenge and sign-off and the reason for it.

See the Control Matrix
From use to proof

Documents are produced alongside AI use and flagged for approval.

Each flagged item keeps its approver, its reason and its outcome, so the record is complete when it is needed.

Animated chart of documents generated alongside AI use and flagged to a person for approval

  1. 1Document generated

    A record is produced alongside the AI use, as the work happens.

  2. 2Flagged

    Anything that needs a decision is sent to the person who owns it.

  3. 3Approved by a person

    A named person approves, changes or rejects it. AI does not sign off.

  4. 4Recorded

    The decision, the approver and the date are kept with the document.

GenWA Guard and Evidence. Steps shown in order.
Intelligence Layer
  • What did AI produce for a given customer, and who approved it?
  • Which rules were applied to a given document, call or message?
  • Which systems and approved models handled this information?
Trends it is designed to show
  • Exceptions that repeat in the same team or workflow.
  • Approvals that wait longest for a named person.
  • Rules that block most often, and why.
Intelligence Layer: answers from your AI record, each linked to the entries behind it.

The Intelligence Layer is a product within Evidence and is being built. It is designed to sit on the Log and your records, so boards, insurers and regulators get answers you can check before you repeat them.

How it works

From rule to report without writing it up afterwards.

RecordGuard and your connected AI tools write each check, block and approval to the Log.
MapThe record is mapped to the frameworks, regulations and policies you choose.
ReportYou generate a report for the question in front of you, such as an insurer, a customer or a regulator.
Sample report

Choose your role and download a branded example report.

Pick a role and get an example report in GenWA branding that shows what that role is asked about AI and how Evidence answers it. It uses illustrative data, not a real customer, and is made in your browser; nothing is sent.

What a CEO is asked about AI

Justify the spend. Answer the question.

  • How can a chief executive show the board that AI is under control?
  • We already have an AI policy. Why do we need anything more?
  • Does this slow the business down?
  • What does AI cost a business of our size, and who should own the number?

What a Compliance and General Counsel is asked about AI

A policy that is enforced, and a record to show for it.

  • How can I evidence AI controls to a regulator, insurer or auditor?
  • What is in an Evidence Pack?
  • Will an auditor accept evidence that comes from a vendor?
  • Does GenWA replace our governance, risk and compliance tool?

What a CFO is asked about AI

One number a month, to the pound.

  • How can a CFO see total AI spend in one number?
  • Why can't procurement control this on its own?
  • How do I forecast a cost that follows use?
  • What would a saving come from?

What a COO is asked about AI

Consistent output. A named owner on every workflow.

  • How do I run AI agents like any other part of the operation?
  • Who is accountable if an agent gets it wrong?
  • Our pilots work well enough. Why add controls now?
  • What is live today and what is being built?

What a CTO and CIO is asked about AI

The AI usage log you should have had from day one.

  • How do I give teams model choice while keeping control and a log?
  • Should we build our own control layer?
  • Does GenWA find every AI tool in the business?
  • What happens when a model is retired or a better one launches?

What a Chief Growth Officer is asked about AI

Growth that scales without scaling risk.

  • How can marketing use AI at scale without brand or claims risk?
  • Our agency already produces content. Do we need Grow?
  • Will the check slow my team down?
  • Does Grow handle consent and opt-out for outbound?

What a Board is asked about AI

You are accountable for how the business uses AI, but all you see is management's assurance.

  • What should a board ask about AI?
  • What is the AI Effectiveness Index?
  • Is AI governance a board matter or a management matter?
  • Does Provision 29 of the Corporate Governance Code apply to AI?

What a Investor is asked about AI

Portfolio companies adopt AI on their own tools, and I cannot compare their exposure or answer diligence questions.

  • How can an investor assess AI risk across portfolio companies?
  • Should founders handle AI governance themselves?
  • What does the Accelerator cost, and how do we pay?
  • What does an investor receive from the audit?

Illustrative sample, not customer data. The PDF is made in your browser; nothing is sent.

Evidence time calculator

Estimate the hours Evidence could give back when you are asked for proof.

Enter how often you are asked for evidence and how long it takes to assemble by hand. The calculator shows the hours a year that go on gathering rather than answering, and how they change if reports are generated from the record. It is an illustration from the figures and assumptions you enter, not a quote, a forecast or a promise of saving.

Evidence time calculator

Audits, customer questionnaires, insurer or regulator requests.
Include everyone who helps find, check and format it.
Your estimate of how much of each request a record kept as AI is used could answer. Test it on a real request.

Indicative, from the numbers you enter

Hours a record could cover each year86.4 hours
Hours by hand each year144 hours
Hours still needing a person57.6 hours
Assumptions
  • A record covers the same share of every request.
  • A person still checks and signs off whatever the record produces.

Items marked assumption can be edited. No figures are stored or sent.

How this is worked out

Hours by hand a year = requests a year x hours each. Hours a record could cover = hours by hand x share covered. Hours still needing a person = the rest.

Frameworks we work with

A record mapped to the standards and rules you answer to.

  • ISO/IEC 42001 (the international standard for managing AI)
  • UK GDPR (UK data protection law)
  • SOC 2 (an independent security audit standard)
  • Cyber Essentials (the UK government-backed security scheme)
  • Financial Conduct Authority Consumer Duty (its customer outcomes rules)
  • National Cyber Security Centre guidance
Evidence by sector
FinanceFinancial Conduct Authority and Prudential Regulation AuthorityConsumer Duty, the Senior Managers and Certification Regime, complaints and consumer credit rules, and model risk expectations for banks and insurers. Reports for supervisors and complaints handling.
DataUK GDPR and the Data (Use and Access) Act 2025Personal data, automated decisions and the right to contest them, and the Information Commissioner's Office guidance on AI. Records of automated decisions and how they can be contested.
Legal and accountancySolicitors Regulation Authority, accountancy bodies and the Financial Reporting CouncilClient confidentiality, supervision of AI-assisted work, and accountability that stays with the firm. Evidence for professional indemnity insurers and regulators.
Health and careCare Quality Commission and the NHS Data Security and Protection ToolkitSpecial-category health data, inspection evidence, and clinical judgement that stays with people. Inspection evidence kept ready.
Retail and consumerCard payment security, consumer law and advertising rulesThe card payment security standard, Competition and Markets Authority consumer law, Advertising Standards Authority codes, and marketing consent rules. Evidence for complaints and card scheme questions.
Technology and manufacturingCustomer security questionnaires and security schemesCyber Essentials, ISO/IEC 42001 and SOC 2 evidence that customers and insurers now ask for, plus protection of source code and designs. Evidence for customer and insurer questionnaires.
Who it is for

Built for the people who are asked to prove it.

Chief risk officer

Shows how AI risk is controlled, with exceptions and approvals on the record.

Head of compliance

Answers regulators, insurers and customers from a record that was built as work happened.

Operations director

Keeps evidence gathering out of the day job, with reports generated rather than assembled.

By business type

Evidence is shaped to the size and structure of your business.

Choose the tab that sounds most like your business.

Answer the insurer or the tender without a law-firm retainer

When a customer, insurer or tender asks how you control AI, you often have no in-house team to answer. Evidence keeps the record and builds the report cost-effectively, so legal and compliance skills are in the business rather than on a retainer. It supports your compliance work and does not replace legal advice where you need it.

See what suits small businesses

A record that outlasts any one person

Knowledge of how AI is controlled can sit in one head. Evidence writes down what AI did and who approved it, so a lender, a buyer or the next generation can see how the business is run.

Security questionnaires answered from the record

Larger customers and investors send detailed questions about AI. Evidence answers them from what actually happened rather than from memory, so a sale or a funding round does not wait on a scramble.

One record across many teams

Teams keep notes of AI use in different places. Evidence brings them into one record with the same fields, so the head of compliance can answer a regulator or insurer without chasing ten people.

See what suits mid-market firms

Show what happened on a particular day

A supervisor asks what was said, decided and approved on a given day. Evidence keeps the Log of events and builds packs mapped to the rules you select, with the approver, the reason and the outcome for each item.

One record the board can read

Many business units and many systems make AI use hard to explain. Evidence holds one record across the AI you connect, and builds reports for each audience. The Intelligence Layer is being built to answer questions from it.

See what suits enterprises
Ways of working with us

Start with advice, run the product, or build with the incubator.

Advice

Our advisers, human and agentic, review what you could prove today, and design the records and mapping you need.

See advisoryProduct

Evidence runs in your AWS or Azure account, or hosted by GenWA on AWS as agreed, and builds the Log and the reports as AI is used.

See the productsIncubator

We build new AI workflows with the record designed in, so evidence exists from day one.

See the incubator
Insights

Keep reading

A climber seen from behind with a large coil of rope across his back and carabiners clipped to his harness, in front of a rock face. Guard Harnesses: the controls that make AI safe to put to work What a harness is, what it does, what happens without one, and why deploying it well is a skill of its own. Lukasz PiotrowskiBy Lukasz Piotrowski · 5 min read

Read all insights

Questions buyers ask

Straight answers on Evidence.

What is GenWA Evidence?

GenWA Evidence is a product that records what your AI saw, produced and who approved it, and turns that record into reports for regulators, insurers and customers. It is designed to be used with Guard.

What is the difference between Guard and Evidence?

Guard acts: it checks, blocks, challenges and flags. Evidence remembers: it records each step and builds the reports. They are two products designed to be used together.

What is the Log?

The Log is the record of events: a permanent record of what AI saw, produced and who approved it. It is the source Evidence Packs are generated from.

What does an Evidence Pack contain, and which frameworks does it map to?

A pack is a report for a period or a question. It draws on the Log, the Data-Flow Map, the Control Matrix and the Exception Log. We map to ISO/IEC 42001, UK GDPR, SOC 2, Cyber Essentials, Financial Conduct Authority Consumer Duty and National Cyber Security Centre guidance, plus sector rules. We map to them; we do not certify.

What is the Intelligence Layer?

The Intelligence Layer is a product within Evidence that is being built. It is designed to turn the Log and your records into trends and answers, each linked to the entries behind it.

Can I see a sample report?

Yes. Choose a role on this page and download a branded example report built on illustrative data. It is made in your browser and nothing is sent.

Where is the record kept, and will Evidence make us certified?

The record is kept in your AWS or Azure account, or hosted by GenWA on AWS as agreed. Personal data is redacted before approved outside model calls. Evidence does not make you certified: we prepare the evidence, accredited bodies issue certification, and this is not legal advice.

See the record your AI should be leaving.

Book a demoDownload the brochure

Control-mapped, not certified. We prepare the evidence; accredited bodies issue certification. This supports compliance and is not legal advice.