Governance and compliance
Show what your AI is built on. Record by record.
Regulators, auditors, boards and buyers are starting to ask the same questions about any AI system: where did the data come from, who owns it, how did it change, and can it be trusted for an automated decision? We answer them with evidence from your own systems, pillar by pillar, and say plainly what we couldn’t see.
Starts with a 30-minute call. Commits you to nothing. We are not a law firm and give no legal advice.
A board figure traced back to source. Illustrative example, not a client.
The questions you’ll be asked
Six questions. Each one maps to a pillar.
The Truth Score™ is a score out of 100 for how far your data can be trusted, built from six weighted pillars. Its governance and lineage pillars measure what these questions ask; the other four say whether the data itself can be trusted. Pillars with too little signal are marked limited signal or not assessed, never guessed.
What we evidence, and what we don’t
Honest about the edges.
What you get
- Governance evidence: owners, stale records, lifecycle and audit trails
- Lineage evidence: sources identified, transformations and versions documented or not
- Whether key records agree across CRM, billing, ERP and HR: our engine matches the customers, people, deals and invoices across the exports you send, and every red flag is checked by hand against sample records before sign-off
- A prioritised fix list, each item with an owner, effort and a test for done
What we don’t do
- Legal or regulatory advice, or a view on which rules apply to you
- Conformity assessments, certificates, seals or badges
- Review of model code, model behaviour or security controls
- Fix what we find, or take a fee from whoever does
The EU AI Act, plainly
The rules are still settling. The evidence starts with the data.
The EU AI Act puts data governance and record-keeping expectations on higher-risk AI systems, and its timelines are still being phased in. Whatever the dates turn out to be for you, the evidence it asks about starts in the same place: where your data came from, who owns it and whether it can be trusted.
-
One piece of work, two uses
The governance and lineage that regulators ask about are what make AI trustworthy in the first place. Evidence for one is evidence for the other.
-
Independent by design
We sell no AI, no software and no fixes. We take no referral fees, commissions or margin from anyone. Our fee is fixed before we start, so the evidence reads the same whatever it shows.
-
For your advisers, not instead of them
Written so your legal and compliance team can use it. Every red flag points to records you can check yourself, and the scope line says what we didn’t check.
Where to start
Start with one system and the data it relies on.
A Truth Score Read on the AI system or proposal that matters most, from exports of the systems behind it. When governance evidence is needed across several AI bets, the AI Investment Review covers them all and ends in a remediation roadmap.
Questions
Asked plainly.
Anything else, ask on the 30-minute call. It commits you to nothing.
Book the callWill this make us compliant with the EU AI Act?
No assessment of data does that on its own, and we don’t claim to. We give you evidence about the data an AI system is built on: its governance, lineage and quality. Your legal and compliance advisers decide what the regulation requires of you and whether that evidence helps meet it.
Do you give legal advice?
No. We are not a law firm and don’t give legal or regulatory advice. We tell you, in writing, what your data can evidence and where the gaps are.
Do you issue a certificate or badge?
No. You get a memo, checked by hand and signed off by DataTruth, that says what was checked, what was found and what wasn’t assessed. We don’t issue certificates, seals or compliance badges.
When do the EU AI Act obligations apply to us?
That depends on what your AI systems do and how the regulation’s timelines settle, so it is a question for your legal advisers. The evidence about your data is worth having either way: the same governance and lineage that regulators ask about are what AI needs to be trustworthy.
Can you assess the data behind a system we already run?
Yes, if the systems it reads from export. We compare those exports record by record and trace key figures back to source. Steps that live outside the exports, such as pipeline code, need your team’s documentation; where we can’t evidence a pillar, we mark it not assessed.
Do you put our data into an AI model?
The Truth Score is rule-based: the same data, scored on the same date, gives the same score, and no AI model decides it. We do use a language model (Anthropic’s Claude, through its commercial API) to read the plan or proposal you send and to help draft the memo’s wording from our findings. A person checks every line before it reaches you. If you’d rather we didn’t use it on your engagement, say so and we do that part by hand.
What happens to our data?
It arrives as exports only, under an NDA and our data processing agreement. The full list of sub-processors comes with our data processing agreement, before any data moves. We keep quality metrics and the memo; the memo cites a handful of sample records as evidence, and your exports are deleted after the engagement. We never use your data or metrics derived from it in any benchmark without your written opt-in. Every step, on the Security page.
Will you fix what you find?
No. You get a prioritised fix list, each item with an owner, an effort estimate and a test for done, written to hand to your own team or any outside firm.
What does it cost?
A fixed fee, agreed before we start, that never moves with the verdict. It is a small fraction of the proposal it tests; if it wouldn’t be, we’ll tell you on the call. Our first clients get a founding rate, in exchange for a private reference call once they’re happy with the work.
Evidence first. Then the conversation with your advisers.
Exports from the systems behind your AI. Governance and lineage, evidenced in writing within 5 working days of complete exports.
Starts with a 30-minute call. Commits you to nothing.