Reference / Evidence alignment
Standards & Regulatory Alignment
Verifiable execution evidence for AI governance, regulatory compliance and independent audits.
AI regulations and standards increasingly require organisations to document, trace and review how their AI systems operate.
NexArt helps organisations produce tamper-evident, independently verifiable evidence of recorded AI and software executions through Certified Execution Records (CERs), Project Bundles and cryptographic attestations.
These records can support selected evidence requirements across European AI regulations, international standards and security assurance frameworks.
NexArt supports evidence integrity and independent verification. It does not replace governance systems, establish regulatory compliance or guarantee the completeness or correctness of recorded executions.
Standards directory
10 regulations, standards and frameworks
Evidence-support mappings, not conformity assessments. European draft entries are labelled below. Unless stated otherwise, mappings use public scopes and themes, not reviewed normative clauses.
European AI Regulation & Standards
Regulation (EU) 2024/1689
EU AI Act: AI Record-Keeping & Traceability
What it covers
The EU AI Act establishes requirements for AI systems, including risk management, technical documentation, record-keeping, transparency, human oversight and post-market monitoring for applicable high-risk systems.
How NexArt supports alignment
NexArt creates tamper-evident records of instrumented AI executions. These can preserve declared inputs, parameters, outputs, identifiers and supporting context, using confidential commitments for supported sensitive fields. Exported Certified Execution Records can be independently verified to support evidence review and investigations. The provisions below are areas where captured evidence may be relevant, not obligations satisfied by installing NexArt.
Relevant requirements or control areas
- Article 11: Technical documentation.
- Article 12: Record-keeping.
- Article 14: Human oversight, where relevant oversight events are captured.
- Article 17: Quality management systems.
- Article 19: Retention of automatically generated logs.
- Article 72: Post-market monitoring; Article 73: Reporting of serious incidents.
NexArt evidence capabilities
- Certified Execution Records
- Cryptographic integrity verification
- Signed node attestations
- Project Bundles
- Independent verification
- Portable evidence
What remains outside NexArt's scope
NexArt does not perform AI system classification, risk assessments, conformity assessments or governance processes. Capture architecture and applicable log retention remain the organisation's responsibility. Records do not establish that decisions were correct or lawful.
Official reference
EUR-Lex: Regulation (EU) 2024/1689Published European standard
EN 18286:2026: AI Quality Management Systems
What it covers
EN 18286:2026, Artificial Intelligence: Quality management system for EU AI Act regulatory purposes, specifies QMS requirements particularly relevant to providers of high-risk AI systems. Its reference was published in the Official Journal in connection with the EU AI Act by Commission Implementing Decision (EU) 2026/2274. The citation concerns covered QMS requirements, not automatic conformity with the entire AI Act.
How NexArt supports alignment
NexArt provides independently verifiable execution evidence supporting documentation, validation, operational traceability, incident investigation and management review. CERs preserve protected information about recorded executions; Project Bundles link supported multi-step workflow evidence. Signed attestations provide evidence of node acceptance, not execution truth.
Relevant requirements or control areas
- Documented information and evidence integrity.
- AI system identification and traceability.
- Verification and validation evidence.
- Operational controls and change investigation.
- Incident investigation.
- Management review.
NexArt evidence capabilities
- Certified Execution Records
- Project Bundles
- Cryptographic integrity verification
- Signed node attestations
- Independent verification
- Portable evidence
What remains outside NexArt's scope
NexArt does not establish or maintain a quality management system, evaluate management-control suitability or certify EN 18286 conformity. This is a high-level evidence mapping, not a clause-by-clause assessment of the final normative text.
Official reference
NEN: Published EN 18286:2026 catalogue entryDraft European standard
prEN 18229-1: AI Logging
What it covers
AI trustworthiness framework: Part 1, Logging, is European draft standardisation work on terminology, requirements and guidance for logging of AI systems. A draft is not a published harmonised standard and does not create a presumption of conformity. The precise current ballot stage has not been independently confirmed from the primary project record.
How NexArt supports alignment
Cryptographically protected execution records can complement AI logging systems. Where properly instrumented, CERs preserve selected execution information for subsequent independent integrity verification. Project Bundles link recorded steps in supported workflows.
Relevant requirements or control areas
- Event identification and execution traceability.
- Protected record integrity.
- Authenticity of attestation evidence.
- Time evidence, where supplied and independently verified.
- Evidence retention and portability.
- Independent inspection.
NexArt evidence capabilities
- Certified Execution Records
- Cryptographic integrity verification
- Project Bundles
- Signed node attestations
- Independent verification
- External timestamp evidence, where configured and independently verifiable
What remains outside NexArt's scope
Logging completeness, capture architecture and operational logging controls remain the integrating organisation's responsibility. These are potential evidence themes, not confirmed clauses or a complete logging-requirements mapping.
Official reference
DIN: AI standards committee draft catalogueDraft European standard
prEN 18228: AI Risk Management
What it covers
European AI standardisation work addressing risk-management processes for AI systems. Draft requirements may change and do not establish a presumption of conformity.
How NexArt supports alignment
NexArt preserves selected execution evidence associated with externally defined risk-management activities and control evaluations. Recorded context and declared outcomes can support later investigations. Policy-evaluation information, when supplied by the producer, is evidence content, not a NexArt policy-enforcement service.
Relevant requirements or control areas
- Operational evidence associated with risk controls.
- Recorded control evaluations.
- Incident investigation.
- Evidence supporting periodic risk reviews.
- Traceability of selected AI operations.
NexArt evidence capabilities
- Certified Execution Records
- Execution and model metadata
- Independent verification
- Project Bundles
What remains outside NexArt's scope
NexArt does not identify, assess, score or treat AI risks or determine control suitability or effectiveness. This thematic mapping does not claim review of the draft's normative clauses.
Official reference
DIN Media: AI Risk Management draftDraft European standard
prEN 18282: AI Cybersecurity
What it covers
Artificial intelligence: Cybersecurity specifications for AI Systems addresses organisational and technical cybersecurity measures for high-risk AI systems across their life cycle. The CEN project record lists it under approval. Draft requirements may change; draft status does not create a presumption of conformity.
How NexArt supports alignment
Tamper-evident evidence can support AI security investigations and reviews of recorded software actions. Consequential Execution records preserve producer-reported actions, outcomes and state observations. Project Bundles can support investigations for their currently supported evidence families; this does not imply that Consequential Execution records can be embedded in those bundles.
Relevant requirements or control areas
- Security-related execution evidence.
- Incident investigation.
- Integrity of recorded operations.
- Traceability of recorded tool calls and actions.
- Supporting evidence for security-control reviews.
NexArt evidence capabilities
- Certified Execution Records
- Consequential Execution records
- Signed node attestations
- Project Bundles, for supported bundle families only
- Independent verification
What remains outside NexArt's scope
NexArt does not prevent prompt injection, model extraction, malicious tool calls or other attacks, or establish that a system is secure. The mapping is thematic, not a normative cybersecurity assessment.
Official reference
CEN-CENELEC: Cybersecurity standard project recordInternational AI Governance
Published international standard
ISO/IEC 42001:2023: AI Management Systems
What it covers
ISO/IEC 42001 establishes requirements for an artificial intelligence management system, addressing organisational processes, responsibilities, planning, evaluation and improvement.
How NexArt supports alignment
CERs preserve recorded execution information for selected AI management-system activities. Cryptographic verification detects changes within the protected evidence scope. Project Bundles link supported recorded workflow steps for review.
Relevant requirements or control areas
- Documented information.
- Operational evidence.
- AI system traceability.
- Monitoring and measurement evidence.
- Incident investigation.
- Management review and improvement evidence.
NexArt evidence capabilities
- Certified Execution Records
- Project Bundles
- Cryptographic integrity verification
- Signed node attestations
- Portable evidence
What remains outside NexArt's scope
NexArt does not implement an AI management system or establish organisational conformity. Management policies, risk acceptance, governance accountability and independent ISO certification remain outside its scope. This is a thematic mapping, not a normative clause assessment.
Official reference
ISO: ISO/IEC 42001:2023Published international guidance standard
ISO/IEC 23894:2023: AI Risk Management
What it covers
ISO/IEC 23894 provides guidance on managing risks associated with AI systems and integrating risk management into AI-related activities.
How NexArt supports alignment
NexArt preserves structured execution evidence relevant to risk reviews and investigations. When customers record control evaluations, test executions or consequential actions, integrity-protected artifacts can support subsequent examination.
Relevant requirements or control areas
- Risk-related operational evidence.
- Recorded AI system behaviour.
- Evidence associated with risk-control evaluation.
- Incident investigation.
- Review of captured changes and outcomes.
NexArt evidence capabilities
- Certified Execution Records
- Execution and model metadata
- Consequential Execution records
- Independent verification
What remains outside NexArt's scope
NexArt does not perform AI risk identification, analysis, evaluation or treatment. Evidence integrity does not establish that reported control evaluations are truthful or that controls are effective.
Official reference
ISO: ISO/IEC 23894:2023Voluntary framework: AI RMF 1.0
NIST AI Risk Management Framework: AI Risk Management Framework
What it covers
The NIST AI Risk Management Framework is a voluntary framework for managing AI risks. Its core functions are GOVERN, MAP, MEASURE and MANAGE.
How NexArt supports alignment
Independently verifiable evidence of captured AI operations can support organisational reviews, measurements and investigations under the framework. These relationships are supporting evidence connections, not determinations of framework conformity.
Relevant requirements or control areas
- GOVERN: Evidence supporting accountability and review processes.
- MAP: Captured execution context and relevant system metadata.
- MEASURE: Integrity-protected evidence associated with testing and evaluation.
- MANAGE: Evidence supporting investigations and operational risk reviews.
NexArt evidence capabilities
- Certified Execution Records
- Execution and model metadata
- Project Bundles
- Signed node attestations
- Independent verification
What remains outside NexArt's scope
NexArt does not implement a risk-management programme, score AI risks, establish acceptable risk thresholds or determine control effectiveness.
Official reference
NIST: AI Risk Management FrameworkSecurity & Assurance
Assurance examination criteria
SOC 2 Trust Services Criteria: Trust Services Criteria
What it covers
SOC 2 examinations assess relevant controls at service organisations against applicable Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
How NexArt supports alignment
Tamper-evident records of selected AI and software executions support the integrity and inspection of evidence associated with relevant controls. Confidential commitments can limit disclosure of supported fields; commitments are not encryption and do not replace confidentiality controls.
Relevant requirements or control areas
- Security-related evidence.
- Processing-integrity evidence.
- Audit record integrity.
- Incident investigation.
- Supporting evidence for selected confidentiality controls.
NexArt evidence capabilities
- Certified Execution Records
- Cryptographic integrity verification
- Signed node attestations
- Independent verification
- Confidential commitments
What remains outside NexArt's scope
NexArt does not establish SOC 2 compliance, replace underlying controls or provide a SOC 2 examination. This mapping does not claim that NexArt holds a SOC 2 Type I or Type II report.
Official reference
AICPA & CIMA: SOC 2Published guidance: Revision 5
NIST SP 800-53: Security & Privacy Controls
What it covers
NIST SP 800-53 provides a catalogue of security and privacy controls for information systems and organisations.
How NexArt supports alignment
Tamper-evident execution records can support selected audit, accountability and system-integrity activities, technical investigations and external review. Verification results explain integrity checks and supported failures; they are not conclusions about control effectiveness.
Relevant requirements or control areas
- AU: Audit and Accountability.
- SI: System and Information Integrity.
- IR: Incident Response.
- CM: Configuration Management, supporting evidence only.
- SC: System and Communications Protection, where relevant evidence is captured.
NexArt evidence capabilities
- Certified Execution Records
- Cryptographic integrity verification
- Signed node attestations
- Independent verification
- Portable evidence
What remains outside NexArt's scope
NexArt does not implement the complete catalogue or replace identity and access management, security monitoring, incident response or security governance. The mapping is at control-family level, not a claim that individual controls are satisfied.
Official reference
NIST: SP 800-53 Revision 5The Evidence Behind the Alignment
NexArt supports regulatory and standards-aligned activities through a common set of verifiable execution evidence capabilities.
Certified Execution Records
Structured, tamper-evident records of captured AI and software executions.
Cryptographic Integrity
Versioned canonicalisation and hashing allow protected evidence to be checked for modification.
Signed Attestations
Cryptographically signed receipts provide independently verifiable evidence of node acceptance.
Project Bundles
Integrity-linked records for supported multi-step execution workflows.
Independent Verification
Verify supported record integrity and signatures using the appropriate artifacts, protocols and trusted public keys.
For technical detail, inspect AI execution evidence and verification semantics, the security model, Article 12 record-keeping, logging versus execution evidence and the AIEF evidence framework. Deterministic replay is limited to supported deterministic workloads; it is not AI-token reproduction. Verification reason codes and confidential-opening checks are described in the verification documentation.
What Verification Establishes and What It Doesn't
What NexArt can establish
- Whether protected recorded content matches its certificate hash.
- Whether supported signatures verify against an appropriately trusted public key.
- Whether supported Project Bundle integrity relationships remain valid.
- Whether supplied confidential openings match their corresponding commitments.
- Whether supported external timestamp evidence verifies, when present and configured.
What NexArt does not independently establish
- Whether every relevant execution was captured.
- Whether producer-declared information is truthful.
- Whether the stated AI model actually executed.
- Whether an AI decision was correct, fair, safe or lawful.
- Whether an action was authorised.
- Whether an organisation satisfies a regulation or standard.
- Whether the organisation's operational controls are effective.
A signature proves that a signing key signed the relevant bytes; it does not authenticate every identity or execution claim in them. Confidential commitments are not encryption. A bundle does not prove capture completeness.
NexArt provides verifiable execution evidence that can support governance and compliance activities. Regulatory conformity depends on the organisation's broader controls, processes and applicable obligations.
Explore Verifiable Execution Evidence
See how NexArt creates and verifies execution evidence, or independently inspect a Certified Execution Record.