Evidence · The proof
When an enterprise customer's procurement team or an auditor asks you to prove your AI is in order, you have minutes, not weeks. Normis gathers your register, classifications, policy, staff sign-offs, incidents and transparency disclosures into a single dated, sealed document, one click, no digging.
Who it is for
For most small companies the first request for proof does not come from a regulator; it comes from a bigger customer. An AI questionnaire arrives during procurement, and a deal is waiting on your answer. That is the moment this page is about.
You will likely be asked for evidence if:
No fines have been issued across the EU so far, so the honest driver here is commercial, not fear: being the supplier who can answer in a day, not a fortnight, wins the deal and the trust. This is the situation behind being ready the moment they ask. The free classifier shows you what you would need to evidence in the first place.
The pack pulls from the work you have already done in Normis, so nothing is assembled by hand the night before a call.
A record only counts as proof if you can show it has not been quietly edited since. Every pack carries a fingerprint that breaks if a single character changes.
The record belongs to your company. Export it whenever you like, in formats you can read and reuse without Normis.
How it works
Add your AI tools, classify them, publish a policy and send it for sign-off. Normis walks you through it.
One button assembles the pack from your live data.
Send the sealed pack to the auditor, customer or buyer who asked.
As your tools and team change, a fresh pack reflects the new picture.
There is no rule that says produce a pack. But deployers do have to be able to show how they meet their obligations, and enterprise buyers increasingly ask for proof during procurement. The pack is the fast, credible way to answer either, rather than scrambling through spreadsheets and email.
No, and we will not pretend otherwise. The evidence pack is a record of your compliance work - register, classifications, policy, sign-offs, incidents and disclosures. It is not a conformity assessment, which is a separate, provider-side process for high-risk AI. Normis is built for deployers of ordinary AI.
A cover summary (scope, counts, the seal and timestamp), then your AI register, risk classifications with reasoning, the policy document with its attestation list, the incident log, and your Article 50 transparency disclosures. The first version ships as a summary PDF plus per-section CSVs and the policy PDF.
The pack carries a cryptographic fingerprint (a hash) and a timestamp. If anyone changes the contents afterwards, the fingerprint no longer matches, so you can prove the record is the one you sealed, unchanged.
Yes, that is the most common reason people reach for it. The pack gives you the underlying facts (what AI you use, how it is classified, your policy and sign-offs) to answer a procurement or vendor questionnaire quickly and consistently.
In the European Union, encrypted in transit and at rest. You can export everything at any time, and the record is yours to keep.
No. Normis gives you a plain-English system for keeping and proving your records, with the article reference kept next to every answer. It is not a substitute for legal advice on a complex case.
The classifier is free, no signup, no card. It shows you what you would need to evidence, and Normis keeps it ready for the day you are asked.