From Data Governance to Evidence Governance

AI governance increasingly recognises that risk cannot be understood only through model size, compute or model-level characteristics.

Training datasets, prompts, retrieval sources, documents supplied through retrieval-augmented generation and information available during deployment can materially influence what an AI system produces.

But governing data is not the same as governing evidence.

An organisation may know which repositories an AI system is authorised to access and still be unable, months later, to reconstruct the evidence behind a particular AI-assisted decision.

What evidence actually supported this decision, and can the organisation reconstruct it?

Cognitive Logic uses Evidence Governance in this research as an analytical concept for the governance layer connecting authorised sources, provenance, evidence, system actions, human review and final decision authority.

It does not replace data governance. It addresses what happens after data becomes operational evidence inside a decision process.

Data governance is necessary — but not sufficient

Data governance remains fundamental. The EU AI Act establishes, for relevant high-risk AI systems, requirements concerning data governance alongside documentation, record-keeping, transparency and human oversight.

NIST takes a similarly broad approach. The AI Risk Management Framework structures AI risk management through four functions: Govern, Map, Measure and Manage, with governance operating across the lifecycle rather than as a final compliance step.

These approaches establish an important baseline: AI systems require governed information, documented processes and accountable actors.

But once AI contributes to an operational decision, another problem appears. Data governance can establish which information the system is permitted to use. It does not automatically establish which evidence actually influenced a particular result.

That distinction is the evidence gap.

The evidence gap

Imagine an organisation using an AI system connected to an approved RAG repository. The repository is authorised, access controls exist, documents are maintained and the retrieval architecture is documented.

Six months later, a consequential decision is challenged.

The organisation now needs to answer different questions:

• Which documents did retrieval actually return?
• Which versions existed at that moment?
• Which evidence was available to the model?
• What prompt or contextual information accompanied it?
• Did another system transform that information?
• Did a human accept, modify or reject the output?
• Which evidence did the human use?
• Who possessed authority for the final decision?

An inventory of approved datasets cannot by itself reconstruct this chain. Neither can the statement that a human was “in the loop”.

The governance problem has moved from data availability to decision reconstruction.

From governed sources to verifiable evidence

Governed Sources

A governed source is more than accessible information. Its identity, provenance, status, authority and conditions of use are known and subject to governance.

This principle is part of QEN Sovereign, where governed sources are connected to verifiable evidence, decision traceability and human authority.

Provenance

Provenance addresses origins and transformations. The W3C PROV model describes provenance through entities, activities and agents involved in producing or influencing information.

This changes the question from “What information exists?” to: “Where did it come from, what happened to it and which actors or processes influenced it?”

Verifiable Evidence

A source does not automatically become useful evidence simply because an AI system accessed it. Evidence must remain sufficiently connected to its origin and use that an authorised reviewer can inspect it.

The practical question becomes: Can we show what supported this result?

Decision Traceability

Traceability extends the evidence chain into the organisational decision. The objective is not merely to retain logs, but to preserve enough information to reconstruct the relevant path between source, evidence, system interaction, output, human review and final action.

Human Authority

A human being present in the workflow does not automatically mean that meaningful human authority exists.

The responsible person must possess both the organisational authority to approve, reject, escalate or reverse the decision and sufficient evidence to exercise that authority responsibly.

Explainability is not traceability

Explainability and traceability are related, but they are not interchangeable.

Explainability asks whether a result or system behaviour can be understood. Traceability asks whether the organisation can reconstruct what actually happened.

Regulation already points toward reconstructability

This research does not claim that traceability or documentation are absent from existing regulation.

The EU AI Act already establishes requirements involving data governance, record-keeping, transparency and human oversight for relevant high-risk AI systems.

NIST similarly embeds documentation, monitoring, accountability and human oversight throughout the AI Risk Management Framework and its Playbook.

The proposition here is more specific: Evidence Governance asks how those components remain connected at the level of an individual AI-assisted decision.

Why this matters for RAG

A RAG system may operate only against approved documents, yet important governance questions remain.

• Which documents were retrieved for this request?
• Which chunks were used?
• Were those documents current?
• Did different versions coexist?
• What did the model receive?
• What evidence was surfaced to the human reviewer?
• What survived in the decision record?

Data governance controls the informational perimeter. Evidence Governance concerns the specific evidentiary path through that perimeter.

Why this matters even more for agents

An AI agent may retrieve information, call external tools, transform records, delegate to another agent, invoke APIs, trigger workflows and execute actions.

In these environments, governance cannot focus only on the base model. The object that needs to remain governable is increasingly the decision process itself.

Accountability eventually requires the organisation to understand: what happened, based on what evidence, under whose authority.

Human oversight requires evidence

“Human in the loop” is often used as shorthand for accountability. It is insufficient by itself.

A meaningful oversight architecture must establish what the reviewer can see, whether the recommendation can be challenged or overridden, whether intervention is recorded, how escalation works and who makes the final decision.

Without reconstructable evidence, human review risks becoming procedural confirmation rather than meaningful authority.

Human presence is not the same as human authority.

Evidence Governance as an analytical layer

Cognitive Logic uses Evidence Governance here as an analytical concept. It is not presented as a new legal standard or regulatory category.

Nor does it replace data governance, records management, provenance standards, AI risk management, audit or legal obligations.

It identifies the layer concerned with preserving the relationship between:

A proportionate Evidence Governance architecture may therefore address:

• source identity and authority;
• provenance and versioning;
• retrieval evidence;
• relevant prompts or contextual inputs;
• material workflow events;
• human intervention and overrides;
• decision ownership;
• evidence retention;
• reconstruction, audit and challenge.

Not every AI interaction warrants the same evidentiary depth. The required level should depend on context, consequence and risk.

From trustworthy AI to Verifiable AI

Trustworthy AI remains an important objective. Consequential organisational use, however, creates another question:

Can the basis for trust be examined after the decision has been made?

Verifiable AI approaches AI governance from this direction.

Where appropriate, sources should remain identifiable, evidence should remain examinable, decision paths should remain reconstructable and human responsibility should remain attributable.

This connects with Cognitive Logic's Manifesto della Verità Verificabile and its evidence-first approach to AI governance.

Governance before automation

AI changes the scale at which organisations can act. It also increases the number of actions whose basis may later need to be examined.

Evidence cannot therefore be treated only as something collected after a dispute, audit or incident.

The architecture needs to consider evidence requirements before automation begins.

• Which sources may be used?
• Which provenance must survive?
• Which events need to be recorded?
• Which outputs require evidentiary support?
• Which decisions remain human?
• How will a contested result later be reconstructed?

Research proposition

Cognitive Logic proposes the following relationship:

This should not be interpreted as a new legal standard. It is a governance model for examining whether AI-supported organisational decisions remain sufficiently evidenced and reconstructable to support review, challenge and accountability.

Data Governance asks:
What information may the system use?

Evidence Governance asks:
What evidence actually supported this decision, and can we prove it?

About QEN

The QEN Framework is Cognitive Logic's governance framework for structuring knowledge, evidence, responsibility and decision control.

QEN Sovereign applies these principles through governed sources, verifiable evidence, decision traceability, human authority and controlled technological dependencies.

The purpose is not to replace accountable human decision-makers. It is to preserve the evidence and governance conditions that allow them to remain accountable.

References

• NIST — Artificial Intelligence Risk Management Framework
• NIST — AI RMF Playbook
• W3C — PROV Overview
• European Union — Regulation (EU) 2024/1689, Artificial Intelligence Act
• AI Policy Perspectives — AI Policy Primer #15, used as context for the research question concerning the shift from compute governance toward data governance.