A policy you cannot evidence is a promise.
Show the regulator a rule, a record and a named owner, before they ask.
Your business uses AI in drafting, customer contact, hiring support and analysis. You are asked to evidence control over all of it. A written policy cannot show that a rule was followed, by whom, on what data.
of UK organisations in IBM's study had no AI access controls (vendor research, 2025).
IBM Cost of a Data Breach, UK, 2025of organisations with AI agents say an agent has exceeded its permissions (vendor-sponsored survey of 445 organisations).
Cloud Security Alliance and Zenity, April 2026of UK financial services firms using AI say they only partly understand it.
Bank of England and Financial Conduct Authority, 2024Six problems that reach your desk, in the words they usually arrive in.
of UK organisations in IBM's study had no AI access controls, so a written rule had nothing behind it.
IBM, UK, 2025 (vendor research)The Data (Use and Access) Act 2025 widened the rules on automated decisions, and the ICO must produce a statutory code on AI and automated decisions (regulations in force 12 May 2026). What it costs you: a standing review burden with no fixed target.
Without a current list and a map of data flows, impact assessments are written from memory. What it costs you: assessments that do not match reality, and exposure you cannot size.
The ICO has said that approving an AI-generated ranking without independent analysis is not meaningful human involvement (Recruitment Rewired, March 2026). What it costs you: a human step that does not count as one.
Each request means gathering screenshots, policies and emails. What it costs you: specialist time, inconsistent answers and delay.
Courts and regulators have acted on invented citations. The High Court's June 2025 judgment on fabricated authorities referred lawyers to their regulators. What it costs you: personal and professional exposure.
Agents are given access to systems and then act on their own. The National Cyber Security Centre advises scoped credentials, logging and the ability to stop an agent. What it costs you: actions with no owner and no record.
Regulators have moved from asking whether you have a policy to asking how it behaved.
The questions now are practical. Did a person see the inputs before approving the output? Was the risk assessed before switch-on? Can you show it? Most businesses can show the first of three things, a rule. Few can show the second, a record that it was followed, or the third, a named person who owns it. The task is less to write more policy than to put the rule where the work happens and keep the record as a by-product.
Compiled from ICO, Financial Conduct Authority and Solicitors Regulation Authority statements, 2025 to 2026. This is a view, not legal advice.
Guard and Evidence work as a pair: rules enforced, and the record that proves it.
Rules and Log are in early access. Evidence Packs and Compliance Mapping are available. We confirm in writing what you receive.
Rules states what is allowed by task, data type and risk, including where AI must not be used. Guard applies them to connected, routed AI.
About RulesPersonal data held backData Protection redacts or holds back personal and sensitive data before a request reaches an approved model, and records what it held.
About Data ProtectionA record kept as AI runsLog keeps a tamper-evident record of what AI saw, produced and who approved it, in your AWS or Azure account, or hosted by GenWA on AWS as agreed.
About LogEvidence on requestEvidence Packs produce the register, data-flow map, control matrix and exception log for the period asked.
About Evidence PacksControls mapped to standardsCompliance Mapping maps your controls to ISO/IEC 42001, UK GDPR and the 2025 Act, SOC 2 and Cyber Essentials, and names gaps. It supports compliance and is not legal advice.
About Compliance MappingA named person on every action that mattersConsequential actions are held for a named approver, and the approval is recorded. People decide on credit, hiring and medical matters, not AI.
About Exception LogDocuments are generated alongside AI use, and flagged to a person for approval.
The record is produced as the work happens, and anything consequential waits for a named approver.
Four steps in order: a document is generated alongside AI use, flagged, approved by a person, and recorded.
- 1Document generated
A record is produced alongside the AI use, as the work happens.
- 2Flagged
Anything that needs a decision is sent to the person who owns it.
- 3Approved by a person
A named person approves, changes or rejects it. AI does not sign off.
- 4Recorded
The decision, the approver and the date are kept with the document.
Three moves for Compliance and General Counsel.
Three routes, matched to how your team works.
An AI policy and controls review, written with you and mapped to the standards your clients and insurers ask about.
See advisoryProductGuard and Evidence together: rules enforced and evidence generated, hosted in your AWS or Azure account, or by GenWA on AWS as agreed.
See Guard and EvidenceIncubatorFor a job such as customer letters or complaints, we build and run an agent function with your approval steps built in. You keep the rules and the record.
See the IncubatorThe three colleagues who make the evidence real.
Owns the risk appetite the rules express and reviews the exception log.
Owns impact assessments and the data-flow map, and checks what is held back.
Connects the systems so the rules apply and the record is complete.
For the CTO and CIOA chatbot invented a refund policy, and the airline was held to it.
In 2024 a Canadian tribunal ruled that Air Canada was responsible for wrong information given by its website chatbot, which had invented a bereavement refund rule. The airline had argued the bot was a separate entity. The tribunal disagreed. The lesson for a compliance lead is that accountability stays with the business, and a record of what the system was allowed to say would have been the starting point.
Moffatt v Air Canada, 2024 BCCRT 149 (British Columbia Civil Resolution Tribunal). Public incident. GenWA had no involvement.
Want to see an evidence pack?
Book a demo and we will walk through a pack built from example data.
Straight answers.
How can I evidence AI controls to a regulator, insurer or auditor?
Show three things: an enforced rule, a record that it was followed and a named owner. GenWA produces Evidence Packs from the record, control-mapped to ISO/IEC 42001, UK GDPR and the 2025 Act, SOC 2 and Cyber Essentials. The regulator or auditor decides what is sufficient.
What is in an Evidence Pack?
A register of AI in use, a data-flow map, a control matrix showing whether each control is working, and an exception log of breaches, blocks and overrides with owners. The pack is produced for the period or process requested rather than rebuilt for each request.
Will an auditor accept evidence that comes from a vendor?
It is a record of your own rules, approvals and exceptions, laid out so a reviewer can follow it. The auditor decides what is sufficient. We prepare the evidence; accredited bodies issue certification, and GenWA does not hold or claim any.
Does GenWA replace our governance, risk and compliance tool?
No. Keep it. Evidence Packs are designed to be used alongside it. Whether and how they connect to a specific tool is confirmed with our technical team before we promise anything.
What does the Data (Use and Access) Act change for AI?
It widened the rules on automated decisions, with safeguards such as being told, contesting and meaningful human involvement. The ICO has a duty to produce a code on AI and automated decisions. Check dates and detail with your own legal adviser.
Does GenWA use AI to make decisions about people?
No. AI is not used for decisions on credit, hiring or medical matters. People decide. AI can prepare material, and the approval is recorded with the name of the person who gave it.
What is live today and what is still being built?
Evidence Packs and Compliance Mapping are available. Rules and Log are in early access. Plain-English rule writing and tested model switches are being built next. We confirm in writing what you receive and do not describe a building item as live.
See what you would show before you are asked.
Evidence supports your own compliance work. It is not legal advice, and accredited bodies issue any certification.