From audit events to evidence
ATR-01 already requires that every event carry a complete, replayable envelope. The Evidence Center turns that raw stream into artifacts a governance function can actually use: scoped reports, packaged exports, and a queryable history that survives staff turnover.
TrustLayer runs the same deterministic controls as the open framework — this module adds operations around them, not different rules.
What it produces
Compliance reports
Period-scoped summaries of control outcomes across an agent fleet, with the underlying events reachable from every figure.
Evidence packages
Self-contained exports for a specific review — agent inventory, control results, decision history, and the trace records behind them.
Event history
Queryable, replayable record of what each agent did and what the controls decided, retained on your schedule.
Governance exports
Structured output for internal audit, risk committees, and downstream GRC tooling — not a PDF you have to retype.
Framework alignment
Evidence is organized so it maps onto documentation frameworks your organization already reports against. This is alignment, not certification — NHID-Clinical does not certify anyone against any of these, and no export constitutes a compliance determination.
| Framework | What the evidence supports |
|---|---|
NIST AI RMF 1.0 | Map and Measure functions — documented agent inventory, control outcomes, and measurement over time |
ISO/IEC 42001 | Annex A transparency and operational control evidence for an AI management system |
HIPAA security documentation | Access and audit control documentation for systems handling protected health information |
EU AI Act Art. 50 | Transparency obligation evidence — disclosure occurred, when, and on which interactions |
FHIR AuditEvent R4 | Audit records emitted in a healthcare-native format your existing systems can ingest |
The open framework’s regulatory alignment page documents these mappings in full, free of charge.
Illustrative export summary
Illustrative figures for layout purposes — not live product data or a customer result.
Related
Where the evidence comes from, and what the open framework already gives you.
TrustLayer by NHID-Clinical is in active development. It is not an accredited standard, a certification, or a regulatory compliance guarantee. The open framework it enforces remains free under CC BY 4.0 and is never gated behind a plan.