AI compliance: an evidence checklist for agents and models

An AI review starts with the intended use and the requirements that apply to it. Ask which control addresses each requirement, who owns it and what evidence shows how it works.

By Nebula Platform Pty Ltd. Sources checked 15/10/2026. This guide is an evidence-gathering checklist, not legal advice, a compliance determination, a certification or an assessment of Nebula or a customer deployment. Requirements depend on the actual jurisdiction, sector, data and use. Obtain qualified advice for that scope before making a legal claim.

Separate obligations, frameworks and assurance

Applicable law, contractual commitments, voluntary frameworks and independent assessments serve different purposes. A supplier's control mapping is not the same as a certificate or an independent assessment. The evidence needed depends on what the system does, who is affected and the consequences of error.

The NIST AI Risk Management Framework is intended for voluntary use. NIST says AI RMF 1.0 is being revised; record which version a review uses rather than treating it as a fixed legal standard.

The DTA's Pilot AI assurance framework is historical draft guidance for Australian Government agencies in a pilot that ran from September to November 2024. DTA says the draft was subject to change and did not represent a final Australian Government position. The DTA's AI technical standard (last updated 22 August 2025) and agentic AI addendum (last updated 4 June 2026) are guidance for Australian Government agencies. They are not a general private-sector compliance rule or an approval for a supplier's product.

Assemble evidence for one intended use

Use these questions to help a procurement team assess a particular use. They are not a complete list of legal obligations.

1. Use and impact. Describe the task, affected people and consequences of an incorrect answer or action.
2. Requirement. Name the applicable source, version and obligation, with a qualified owner for interpretation.
3. Data flow. Identify what information enters the system, which services process it, retention and deletion arrangements, and relevant locations.
4. Authority. State who can approve an action, which party they represent, and when permission expires or is revoked.
5. Control. Describe the implemented safeguard and where it operates, including dependencies on deployment configuration.
6. Evaluation. Keep representative test cases, expected outcomes, results and unresolved failures.
7. Operations. Assign responsibility for incidents, changes, periodic review and supplier updates.
8. Decision. Record the evidence considered, remaining conditions and the accountable person's decision for this use.

Keep supplier-published statements separate from evidence about the actual customer account and deployment. A provider may offer regional processing or particular retention terms without those settings applying to every account.

A worked procurement question

An illustrative buyer asks whether an agent may issue a contractual notice. A model quality report does not answer that question by itself. The review also needs the applicable notice requirements, the party entitled to issue it, the authorised person, the approved content and destination, and evidence of the sending result.

If a product only drafts the notice, record that narrower use. If a person must approve the final message, test that the message cannot be changed after approval without another check. These are review questions, not a statement that Nebula supplies every notice-sending workflow.

Ask for inspectable evidence

Ask a supplier to demonstrate a permitted operation and a refusal. Request the scope and date of any independent assurance claim, rather than accepting a logo alone. Check how changes to the model, permissions or source documents trigger another review. Agree how the organisation can retrieve the records it needs after an incident or when leaving the service.

For technical questions, the agent governance guide covers permission to act and model trust and evaluation covers the quality of a result.

Review Nebula's published controls

Start with Security and data handling, the subprocessor evidence register and enterprise readiness. The security and compliance documentation explains published access, processing and proof-check boundaries. These materials are evidence to examine, not a representation that Nebula or a particular deployment complies with a law or standard. For evidence specific to an intended deployment, contact Nebula.