What the Function Maintains
The Evidence Register — per AI system × per Risk Taxonomy 2026 class, the contemporaneous proof the function holds. Distinct from the AI Risk Register: the Risk Register names what could go wrong; the Evidence Register names what proof the function holds against each risk.
One-Page Posture Statement Row
The Auditor's Question
"Show me, for any of your AI systems, what proof you hold against each of the nine canonical risk classes."
Editorial Framing
Evidence framework is Element 3 because it is the operational substrate of the entire Defensibility posture. The Risk Register names what could go wrong (per the canonical 9 classes). The Evidence Register names what proof the function holds against each risk per system. The pair is the minimum governance substrate for institutional AI use; neither alone is sufficient.
The Evidence Register addresses all 9 Risk Taxonomy classes by design — it is the operational substrate.
Evidence Artefacts
- Evidence Register (per system × per class entries)
- Quarterly Evidence Register refresh log
- Linked vendor DPAs, audit reports, AI BoM components
- Per-capability evidence catalogue navigation
Common Failure Modes
- Risk Register held without an Evidence Register — the watchlist without the response
- Evidence Register entries stale beyond a quarter
- Evidence not linked to underlying artefacts (vendor DPAs, audit reports)
- Per-capability evidence catalogue not navigable from the one-page Posture Statement