AI compliance work produces two different artifact types. The first is documentation: policies, model inventory, technical documentation, risk assessments, and control narratives, produced by governance platforms such as Credo AI, Holistic AI, IBM watsonx.governance, and OneTrust, often alongside control automation tools such as Vanta or Drata. The second is evidence: records of what individual systems actually did, which auditors sample to test whether the documentation reflects reality. Most programmes are strong on documentation and weak on evidence for AI executions specifically. NexArt covers the evidence side by issuing Certified Execution Records that an auditor can verify independently of the operator's systems.
Category map
These categories are complementary rather than competing. Most enterprise stacks need more than one of them, and the common mistake is assuming one category covers another.
| Category | Representative tools | What it covers | What it does not establish |
|---|---|---|---|
| Governance and documentation platforms | Credo AI, Holistic AI, IBM watsonx.governance, OneTrust AI Governance | Model inventory, technical documentation templates, risk classification, framework mapping, approvals | Documentation is self-authored. It states what should happen, not what happened on a given request. |
| Control automation and compliance management | Vanta, Drata, Secureframe, internal GRC suites | Control monitoring, policy attestation, audit-readiness workflow for SOC 2 and ISO/IEC 27001 | Control coverage is infrastructure-oriented. AI-specific execution records are outside the collector set. |
| Standards and frameworks | ISO/IEC 42001, NIST AI RMF, EU AI Act Articles 11, 12, and 20 | The obligations themselves: management system, documentation, record-keeping, traceability | A framework states the requirement. It does not produce the artifact that satisfies it. |
| Execution evidence | NexArt Certified Execution Records and Project Bundles | Per-run records with a canonical SHA-256 hash, Ed25519 attestation, and RFC 3161 timestamp, verifiable offline | Covers execution and inference only. Not a substitute for technical documentation or a management system. |
Where NexArt fits
NexArt produces the sampled artifact. When a control says high-risk AI decisions are logged and reviewable, or when Article 12 record-keeping is in scope, a Certified Execution Record turns that assertion into something an auditor can test: recompute the canonical hash, check the Ed25519 signature against the published attestation key, and read the RFC 3161 timestamp issued via DigiCert. One integration produces evidence that can be referenced from several framework mappings at once, and confidential execution keeps prompts, outputs, and personal data out of the record by storing keyed commitments instead.
What NexArt does not cover
NexArt does not write technical documentation, maintain a model inventory, classify risk, run a management system, or assert that any framework requirement is met. Framework conformity is a determination for the operator and its auditors. NexArt supplies verifiable execution records that support specific record-keeping and traceability obligations.
Mapping artifacts to obligations
- EU AI Act Article 11 technical documentation: governance platform output.
- EU AI Act Article 12 record-keeping and Article 20 traceability: execution evidence.
- ISO/IEC 42001 management system clauses: governance platform plus internal process records.
- NIST AI RMF Measure and Manage functions: evaluation tooling plus execution evidence for the measured runs.
Related questions
Can a governance platform produce audit evidence for individual AI decisions?
It can store references to them, but the records themselves live in operator-controlled systems and are editable. That is acceptable for internal review and weaker when an auditor, regulator, or customer is the audience.
Does NexArt make us EU AI Act compliant?
No. The EU AI Act is predominantly a governance regime, and conformity is broader than any single tool. NexArt provides verifiable execution evidence that supports a narrow set of record-keeping and traceability obligations.
Do we still need documentation if executions are certified?
Yes. Documentation and evidence are complementary: documentation states the intended controls, evidence shows the controls operated. Auditors test the second against the first.