Evidence and proof levels
From declared to effective, and what each level needs.
Evidence is a dated, sourced record that a control operated. Cogna8 links evidence to the controls and AI systems it supports, and uses it to set each control's proof level.
How far is this control proven?Move the slider. Each level needs everything below it.
- DeclaredA control exists on paper and has an owner.Policy document, owner assigned
- ObservedCogna8 can see it in configuration or behaviour.Connector reading, configuration export
- ImplementedThe mechanism is in place.Active gate policy, enforced permission
- EvidencedDated records show it operating.Decision receipts, change records
- TestedA test has run and its result is recorded.Test run with date, sample and result
- EffectiveA passed test supports the claim.Passed test within the review period
Good evidence
| Quality | Why it matters |
|---|---|
| Dated | Shows the control worked in the period under review |
| Sourced | Can be traced to the system that produced it |
| Linked | Attached to the control and the AI systems it covers |
| Generated, not typed | Receipts and change records beat screenshots and attestations |
Last reviewed October 2026Suggest a change