When the Builders Are Gone: Audit Evidence That Survives the Team

1. The Test, Stated Plainly

The sharpest formulation of what audit really demands came from Sue Eze, an AI governance and technology-risk lead, in a public comment in 2026:

It is a deceptively demanding bar. Most audit trails are sufficient in the room — while the engineer who built the pipeline, the analyst who set the thresholds, and the manager who signed it off are all still available to explain what everything means. The test Sue Eze names removes those people and asks whether the evidence still holds. If it does not, it was never really externalised; it was leaning on the team.

2. Systems Outlive the People Who Build Them

The reason this is not a theoretical concern is timing. AI systems run for years; the people who built them rarely stay that long. A decision made today may be questioned in 2027 or 2028 by which point the original engineers have changed roles, the analysts have left, and the approving director may be at another company. The audit happens precisely when the institutional memory is gone.

An audit trail that needs interpretation — “this field meant that,” “we set the threshold there because,” “the policy at the time was” — fails at exactly the moment it is needed, because the people who could supply the interpretation are no longer there to supply it. Designing for personnel change is not a nicety; it is the normal case for any system that matters.

3. The Same Test, One Layer Up: the Director

Sue Eze's test generalises a point Guy Miller has made about the accountable individual. Where Sue asks whether the system's evidence survives the team, Guy asks whether the director's personal evidence survives the director:

This is the director-attestation lane, and it is Guy Miller's to develop — covered in depth in director attestation under Articles 26 and 27. The point here is only that it is the same durability test, applied to the person rather than the system: evidence that is theirs, and that outlasts their tenure. The substrate's job is narrower — to make the underlying record reconstructable so that whatever the director attests to can be backed by something a stranger can check.

4. What Makes Evidence Self-Contained

“Keeping documents” does not, by itself, pass the test. A document store can still depend on institutional memory to be read correctly. The stricter property is that the decision can be reconstructed and confirmed from the record alone, using only public information, by someone who does not trust the operator and never met the team.

Concretely, that means three things are captured in the record itself rather than in someone's head: the reasoning path the decision walked, the evidence it touched, and the framework version in force at the time. And it means the record can be checked independently — for example, with a standalone offline verifier that uses public keys alone, with no account and no vendor code, as described in the offline proof verifier. If a stranger can reconstruct the decision without anyone from the original team, the evidence has survived the team.

5. The Honest Limit

Durable evidence is necessary, not sufficient. A perfectly self-contained record of a poor decision is still a record of a poor decision — surviving the team does not make a decision right, and the substrate does not decide whether the action it recorded was permitted to bind. What it guarantees is narrower and load-bearing: that whoever has to answer for the decision later — an auditor, a regulator, a successor, the director themselves — has a record that stands on its own rather than one that quietly required the people who are no longer there.

Continue Reading

• Director Attestation under EU AI Act Articles 26 & 27
• The Offline Proof Verifier for AI Decisions
• Proof Precedes Permission: The Substrate Seam
• Recall vs Verifiability in EU AI Act Audit Trails

Frequently Asked Questions