Evidence for the six AI areas raised in the external audit walkthrough. Rows marked observed are resolved against the running estate each time this page loads; rows marked curated come from version-controlled registers in the repository, where git log is their change history. Where the two disagree, the page reports the disagreement rather than choosing between them.

1 Governance and oversight

Asked for: key stakeholders in AI decisions; AI policy, guideline or internal rule; meeting notes, reporting packs or presentations where AI risks have been discussed.

2 Exposure assessment

Asked for: the AI risk register, issue log or action tracker; the summary used internally to prioritise and monitor AI risks; a record of notable AI incidents, issues or complaints.

3 Data and model risk for solutions in use

Asked for: a process flow for the main AI use cases; privacy, consent or data-handling guidance related to AI; notes or examples showing human checks and reviews before important AI outputs are used.

4 Operability and security

Asked for: a high-level architecture or system diagram; a description of how access, credentials and keys are managed; support process notes, incident handling steps or operational guidance.

5 Development practices

Asked for: how changes to AI systems are developed, tested and released; testing examples, release notes or change logs; an overview of how code, prompts and configurations are version-controlled.

6 Asset management

Asked for: the latest list of AI applications, tools, repositories or services; a simple ownership list; a list of key third-party AI providers and any related agreements.