Validation module
01 / 07AI Governance Assurance
Tests whether the AI governance you have written down is actually enforced by the system you are running.
The problem
A policy is not a control
Most organisations now have an AI policy, an approval workflow and a register of approved systems. Very few can demonstrate that the register matches what is deployed, that the approval gate is reachable only through the approved path, or that the data boundaries described in the policy are enforced anywhere other than in the document. Teams adopt assistants and agents faster than any central function can inventory them, and an agent acquires permissions through whoever configured it.
Under the EU AI Act and ISO/IEC 42001 the obligation is on the deployer to show governance in operation, not to produce the policy that describes it. An auditor who asks for evidence of an enforced approval gate and receives a workflow diagram has found a finding.
How Veync tests it
Reconcile the register against the running system
Veync discovers the AI actually in use, compares it with what is declared, and then tests whether each declared control is reachable and enforced — approval gates by attempting to bypass them, data boundaries by attempting to cross them, human-in-the-loop checks by attempting to act without the human.
What this module covers
- Shadow AI discovery
- Model and agent inventory
- Data-flow boundaries
- Training-data boundaries
- Approval gates
- Human-in-the-loop controls
- Accountability and ownership
What you receive
An inventory you can defend
The output is the artefact an auditor asks for and most organisations cannot produce: a reconciled inventory, a map from each written policy clause to the mechanism that enforces it, and a register of the clauses where no mechanism exists.
A reconciled AI system inventory
A policy-to-enforcement map
A governance gap register
Standards
Evidence from this module maps to
EU AI Act Regulation (EU) 2024/1689
European Union
ISO/IEC 42001 2023
ISO/IEC
NIST AI RMF 1.0
NIST
ISO/IEC 23894 2023
ISO/IEC
Put this module to work
A validation briefing covers scope, the authorization you would sign, and the evidence this module would produce for your environment.
Named-vendor results and control-evasion evidence are shared under NDA, through the evidence annex.