Audit is a query: evidence records for clinical AI.
Designing AI so that every action leaves a verifiable record, and proving compliance becomes a search rather than a scramble.
What auditors actually ask
Which data did the system use? Under which policy and consent? Which model version produced the output? Who approved the action, and when? Most teams answer these by collecting screenshots and log extracts after the fact.
Write the evidence at the moment of action
Every AI action on the platform is designed to emit an evidence record at the time it happens: the inputs and source documents, the policy and consent that permitted it, the model and prompt version, the output, and the person who approved or overrode it.
Make it tamper-evident
Records are chained so that altering or deleting an earlier entry is detectable. An audit trail that an administrator can quietly edit is not evidence.
Obligations as configuration
Regulatory obligations are modelled as versioned rules per jurisdiction, each mapped to the controls and evidence that satisfy it. When an auditor asks how a HIPAA or DPDP requirement is met, the answer is a query that returns the controls and the records proving them.
Key takeaways
- 1Capture evidence when the action happens, not when the auditor arrives.
- 2Chain records so tampering is detectable.
- 3Map each obligation to the controls and records that prove it.