How to evidence AI controls for audit, insurers and clients
Evidence of AI controls is a small set of dated records that show your rules exist and are followed. For an audit, an insurer or a client, five things usually do the job: a signed AI policy, training records, a list of approved tools, a log of incidents, and a regular report. Keep them in one folder. Update them monthly. Then the next request takes minutes, not a week.
What counts as evidence
A policy on its own is a promise. Evidence shows the promise is kept. Auditors, insurers and clients all look for the same pattern. A rule, a date, a name and a result.
Each record below answers one plain question a reviewer will ask.
1. A signed AI policy
The question: do staff know the rules? You need the policy itself and a dated agreement from each person. A shared drive file nobody signed proves little. A list showing who agreed, and when, proves a lot.
If you have no policy yet, our UK AI policy template covers the six points most firms need.
2. Training records
The question: were staff shown how to follow it? Record who was trained, on what, and the date. A short session counts. So does a recorded video with a sign-off. Note who is still to do it. Gaps you know about look better than gaps you hide.
3. An approved tools list
The question: which AI tools are allowed, and on what accounts? List each tool, the account type and who owns it. For example: ChatGPT Team, business account, owner Priya. Add tools that are not allowed. Review it when someone asks for a new one.
Reviewers often follow up by asking how you know staff stick to the list. A note of how you check helps. Our guide to finding out which AI tools staff use covers the options.
4. An incident log
The question: what happens when something goes wrong? Log each event. Date, person, tool, kind of data, what was done. Keep near misses too. A log with entries and actions reads as a working control. An empty log for a busy team can raise doubts.
5. A regular report
The question: is anyone watching over time? A monthly one-page summary is enough. Policy agreements, training status, tool changes, incidents and actions. Sign and date it.
Rule of thumb: every record needs a date and a name. Without both, it is a document, not evidence.
Build the evidence pack
Make one folder. Call it "AI controls". Give it five subfolders matching the list above. Then add a cover page.
The cover page says what the pack contains and when it was last updated. Keep it to one side of paper. Here is a worked example.
Example: Ashcombe, 24 people. Policy version 2, agreed by 22 of 24. Two on leave, due back 10 November. Training done for 21. Approved tools: ChatGPT Team, Copilot. DeepSeek not allowed. Three incidents in October, all closed. Last report signed by Jo, 3 November.
A reviewer can read that in a minute. Each line points to a record behind it.
Keep it without extra admin
The pack fails when it depends on someone remembering. A few habits keep it current.
- Tie it to the month end. Update the pack on a fixed date. Same day every month.
- Collect agreements at onboarding. New starters sign the AI policy with their contract.
- Re-sign on change. When the policy changes, ask everyone again. Date the new version.
- Log as you go. An incident logged on the day takes a minute. One rebuilt later takes much longer.
- Automate where you can. Records that are made by software, not typed up, are cheaper to keep and harder to question.
Tailor it to who is asking
The same pack serves all three. What changes is the emphasis.
| Who asks | What they focus on |
|---|---|
| Auditor | Dates, versions, sign-offs, and whether actions were closed. |
| Insurer | Whether controls exist and are applied to everyone. |
| Client | Whether their data could reach an AI tool, and what stops it. |
Answer the question asked. Send the cover page and offer the detail. Insurers in particular phrase things their own way, so see what cyber insurers ask about AI use before you reply.
Where Helio Guard fits
Helio Guard makes several of these records for you. It records each person's dated agreement to your AI policy. It flags unapproved AI tools and staff who need training. It logs each time sensitive data was taken out, warned about or stopped on listed AI sites. Each entry shows the kind of data, site, person, outcome and time. Then it produces a monthly record for clients, insurers or auditors.
The checks run on the PC with fixed rules. We never see what your team types. Windows only, with Chrome and Edge. It is £1 a person a month, from 5 people, with a 14-day free trial and no card needed. Details are on the pricing page.
Common questions about evidencing AI controls
How often should AI control evidence be updated?
AI control evidence is best updated monthly, on a fixed date. A monthly cycle keeps policy agreements, training status and incident logs current without much work. It also gives auditors and insurers a clear run of dated reports, which shows the controls are watched over time rather than written once and forgotten.
Is a signed AI policy enough for an insurer?
A signed AI policy is a good start but rarely enough on its own. Insurers usually want to know the policy is applied. Training records, an approved tools list and an incident log show that. Together they turn a written promise into evidence that staff follow the rules day to day.
What should an AI incident log include?
An AI incident log should include the date, the person, the AI tool, the kind of data involved, and what was done about it. Record near misses as well as real events. A log with closed actions shows the control works. Avoid copying the sensitive data itself into the log.