Compliance Monitoring

Compliance monitoring in VeriProof means maintaining a continuous picture of how well your AI applications are governed — not just recording individual decisions, but tracking trends, surfacing patterns, and alerting on degradation before it becomes a compliance incident.

This guide walks through the tools available and how to use them together.

The Compliance Center

The Compliance Center in the Customer Portal is your primary monitoring workspace. It aggregates governance data across all your applications and surfaces the metrics that matter for regulatory compliance.

Overview dashboard

The overview dashboard shows:

• Total sessions ingested over the selected period (default: last 30 days)
• Blockchain anchor status — the percentage of sessions successfully anchored
• Average governance score across all applications
• Alert activity — open and recently resolved alerts
• Session risk distribution — breakdown by MINIMAL / LOW / MEDIUM / HIGH / CRITICAL
• Guardrail activity — sessions with blocked, flagged, or allowed guardrail events

Application-level view

Click any application to drill into its compliance profile:

• Governance score trend (7-day and 30-day rolling averages)
• Decision distribution (approved / denied / deferred / escalated)
• Guardrail failure rate over time
• Sessions requiring manual review
• Compliance evidence export history

Tracking governance score trends

A single governance score on a single session is data. A trend is insight.

The compliance dashboard tracks governance score as a rolling average at the application level. Two views are provided:

7-day view: useful for detecting in-sprint regressions after a model update or prompt change.

30-day view: useful for identifying slow drift that emerges over weeks — for example, a gradual reduction in grounding annotation coverage as engineers stop adding it to new endpoints.

To investigate a score drop:

1. Open the application in the Compliance Center.
2. Click the score drop point on the trend chart.
3. The view filters to sessions from that time window.
4. Sort by governance score ascending to see the lowest-scoring sessions first.
5. Open individual sessions in Time Machine to identify what annotation patterns are causing the drop.

Governance score baselines and targets

You can set a governance score target per application in the portal:

1. Navigate to Applications → [your app] → Governance Settings.
2. Set the Target governance score (default: 75).
3. Enable Alert on score below target to create an automatic alert rule.

When the application’s rolling average drops below the target for 24 consecutive hours, the alert fires. See Alert Rules for notification configuration.

Continuous anchoring verification

The Compliance Center tracks blockchain anchoring status as an operational metric:

A healthy production deployment should maintain 100% anchoring success. Any ❌ events are logged with a reason code and available in Compliance Center → Anchor History.

Setting up your monitoring workflow

For EU AI Act compliance

Focus your monitoring on high-risk applications. For each:

1. Enable human_oversight.type annotation in your SDK integration (see First Integration)
2. Set a governance score target ≥ 80
3. Configure an alert rule for any session with risk_level = HIGH that lacks a human_oversight.type annotation
4. Schedule a monthly bulk evidence export for your audit trail

For US financial services (SR 11-7 / model risk)

1. Verify that decision.confidence is recorded on all loan/underwriting sessions
2. Set an alert for confidence < 0.65 AND risk_level = HIGH
3. Use the session distribution report (month-end export) for model monitoring documentation
4. Confirm blockchain anchoring coverage >99.9% in the Compliance Center

For ISO 42001

1. Enable governance score tracking for all AI applications, not just high-risk ones
2. Use monthly bulk exports as evidence for your management system document trail
3. Track governance score trends as your “AI system performance indicator”
4. Use the audit history log (in Settings → Audit Log) to demonstrate traceability of governance events

Compliance reports

The Compliance Center can generate three report formats:

To generate a report: Compliance Center → Reports → New Report.

Integrating with your GRC tool

If you use a GRC (Governance, Risk, and Compliance) tool, you can push compliance data to it from VeriProof via webhooks or API.

Configure a webhook to receive a notification whenever the daily compliance summary is generated:

1. Navigate to Settings → Webhooks.
2. Create a webhook with the event type compliance_summary.daily.
3. The payload contains aggregate metrics that your GRC receiver can ingest.

For bulk data export to a data lake or SIEM, use the Compliance Evidence Export API to programmatically pull session records on a schedule.

FAQ

How often is the governance score recalculated?

The per-session governance score is calculated once, immediately after ingest. Application-level averages are updated in real time as new sessions arrive.

Can I view compliance data for a specific date range in the past?

Yes. All Compliance Center views support date range selection. Default is 30 days. Maximum range depends on your plan’s retention period.

Can multiple users access the Compliance Center?

Yes. Any portal user with the Viewer role or higher can access the Compliance Center. The Compliance Officer role provides read-only access across all applications and can export evidence packages without creating or modifying anything.

Next steps

• Alert Rules — configure automated notifications for governance degradation
• Compliance Evidence Export — export session records for regulatory submissions
• Governance Scoring — understand how the governance score is computed