When an audit asks how an AI decision was reached, most teams assemble screenshots, log exports, and spreadsheet reconstructions after the fact. That evidence relies on the auditor trusting the operator. Certified Execution Records replace it with a portable, cryptographically signed artifact that any auditor, or their independent verifier, can check without access to your systems. This is the difference between audit narrative and audit evidence.
Side-by-side comparison
| Dimension | Assembled evidence (logs, screenshots, exports) | Certified Execution Records |
|---|---|---|
| Trust model | Auditor must trust the operator's reconstruction | Auditor verifies signatures against a public key |
| Effort per audit | Hours to days of reconstruction per decision | Record is produced at execution time, retrieved in seconds |
| Tamper resistance | None; assembled after the fact | Any modification breaks the certificate hash |
| Cross-framework reuse | Rebuilt per framework (SOC 2, ISO 42001, EU AI Act) | One artifact supports all frameworks |
| Data exposure to auditor | Raw prompts and outputs shared | Cryptographic commitments only, in confidential mode |
| Survives operator | No; disappears with the system | Portable JSON, verifiable indefinitely |
| Regulator acceptance | Case-by-case, discretionary | Aligns with EU AI Act Article 12 record-keeping |
Frameworks this evidence supports
A single Certified Execution Record can serve multiple audit programs at once. NexArt evidence maps to:
- EU AI Act: Article 12 record-keeping and traceability for high-risk systems.
- ISO/IEC 42001: AI management-system evidence for controls and operational records.
- NIST AI RMF: Measure and Manage functions, especially traceability and monitoring.
- SOC 2: change management, monitoring, and integrity of automated processing.
NexArt does not issue compliance certifications; it provides the evidence artefact your auditor accepts.
Frequently asked
Will auditors actually accept a Certified Execution Record?
Yes. A CER is a verifiable digital artefact with a canonical hash and an independent Ed25519 signature. Auditors verify it the same way they verify signed PDFs, code-signing certificates, or notarised timestamps. NexArt publishes the verification procedure and public key so any auditor can reproduce the check.
Do I need to certify every AI call?
No. Most teams certify only regulated or high-stakes decisions, such as customer-affecting outputs, automated approvals, or agent runs in scope for a specific framework. Everything else can remain in normal logs.
Does the auditor need to trust NexArt?
No. Verification uses the attestation node's public key and standard cryptographic libraries. The auditor does not need a NexArt account, and does not need to trust NexArt's software beyond checking a well-known signature.
Add verifiable execution to your AI stack
Produce Certified Execution Records anyone can verify without access to your infrastructure.
Related