Home · Platform
01 · Evidence Platform
Make every AI governance claim traceable.
The Mycelium Evidence Platform is the working layer behind Framework v2.0. Every board-level claim, every evidenced, partial or absent: traces back to a human-approved artefact, a named owner, a date and a decision.
02 · What you end up with
Four things a board can act on.
01
What AI exists
A register of every system, with an owner and a risk rating against each one.
02
What evidences it
The artefact behind each control, or the named gap where none exists.
03
Who approved it
A named human against every evidence item, with the date they reviewed it.
04
A record you can table
A dated, versioned pack for the board or the auditor, produced from the same entries.
Why it is needed
Boards are signing AI attestations they cannot defend. Risk produces slide decks; audit asks for trace. Document stores hold policies without proving a human reviewed each control on each cycle.
03 · How it works
Four phases. One traceable record.
01 · Capture
Live AI register
Every AI system registered, owned and risk-rated.
02 · Assess
Controls mapped
Mapped to the standards and guidance that apply to your organisation.
03 · Evidence
Human-approved
Requested from named owners, reviewed by a named human, traceable.
04 · Publish
Auditor-followable pack
Version-stamped, delivered to your private portal, with an audit row written.
04 · Capabilities
What the platform produces.
The platform is built and in pilot. No client cycle has been published yet, so the capabilities below are described as what a cycle produces, not as a claim about cycles already run.
01
Live AI register
Every system, owner, lifecycle stage and data sensitivity.
02
Risk rating
Per-system rating with documented rationale, refreshed each cycle.
03
Control mapping
Each system mapped to the fourteen dimensions and to the standards that apply to you.
04
Evidence requests
Plain-English asks issued to named owners. Tracked, reminded, logged.
05
Human approval gate
Every evidence item approved by a named human reviewer. Appended, never overwritable.
06
State scorecard
Per pillar, per system, per cycle, stated as evidence states rather than a traffic light.
07
Evidence pack
A versioned PDF an auditor can follow end to end, with an attestation page for the sponsor to sign.
08
Gaps register
Named remediation owner and due date for every absent or partial dimension.
09
Client portal
Passwordless access to your packs, isolated from every other client, with every view logged.
05 · Assurance boundary
You attest. We evidence.
The single most common failure in this market is a vendor whose language quietly implies it has assured something. Here is the line, drawn as structure rather than stated as a disclaimer.
Stays with you
- The assurance opinion, in every form it takes
- Whether the organisation is compliant, certified or assured
- Management, board, legal, risk, audit and regulatory accountability
- The decision to accept, remediate or tolerate every finding
- The attestation itself, and the signature on it
Mycelium produces
- The record of what human-reviewed evidence demonstrates
- A classification and a state for every dimension, on every cycle
- The trace from each board-level claim to its underlying artefact
- The named owner, the date and the review interval for each item
- The published pack, versioned, and the audit row that records it
01No platform licences
We hold no interest in any tool we recommend.
02No systems integration
No assessment of work we would be engaged to remediate.
03No referral arrangements
No recommendation of ours creates a downstream interest for us.
04No assessment into a subscription we own
The rule runs both ways, for twelve months either side of a Health Check.
The record is yours. Every register, assessment and evidence pack is delivered in a form you can keep current without Mycelium and without the platform.
06 · Security
The boundary is in the product.
01
Client isolation
Isolated by construction, not by policy.
02
Private evidence
Private storage, reached only through short-lived, single-use links.
03
Append-only audit
Every publication and view written to a record that cannot be altered.
04
Versioned packs
“What did we hold in March?” has a file as its answer.
05
Fail-closed drafting
Malformed output is rejected, never published.
06
Data residency
Australian by default. Source artefacts stay in your tenant.
Human review is mandatory on every evidence item, the gate is enforced, not advisory. Full architecture, control detail and penetration-test position are provided under NDA during procurement.
07 · Pilot offer
The AI Governance Evidence Pilot.
Six weeks. One AI system. All fourteen dimensions. One published, board- and auditor-ready evidence pack. Design-partner pricing for the first two to three clients, sized to fit inside an existing audit-prep or AI project budget.
WEEK 1–2Capture: register the system, name the owner, rate the riskEvidenced
WEEK 2–3Assess: map to the fourteen dimensions and the standards that applyEvidenced
WEEK 3–5Evidence: request, review and approve, item by itemPartial
WEEK 6Publish: versioned pack, sponsor attestation, audit rowPending
08 · FAQ
The questions buyers ask first.
- 01
Does the platform certify compliance?
No. The platform produces an evidence trail; assurance opinions remain with management, the board and the relevant assurance providers.
- 02
Where does the data live?
Source artefacts stay in your own tenant; Mycelium holds references and metadata only. Published evidence packs sit in private storage in an Australian region. The website, forms, scheduling and analytics we use process offshore, and the privacy policy sets out which is which.
- 03
Who can see another client’s data?
No-one. Any cross-client access attempt fails closed and is written to the audit record.
- 04
Does the AI decide anything?
No. Nothing publishes without a named human reviewer approving it, and drafted narrative is validated before publication.
- 05
Can I see a published evidence pack?
Yes. An anonymised sample is available from the reference library, built to the same structure as a live cycle. All entity names, identifiers and email addresses in it are illustrative.
- 06
Can the platform integrate with our GRC?
Yes, via documented export. Custom integrations are a paid extension after pilot.
- 07
Is the platform IRAP- or SOC 2-certified?
No. It is engineered to the relevant baselines, and certification will be pursued when a contracted client requires it. A Security and Trust Summary is available on request.
09 · Start the conversation
If your board is being asked to attest to AI governance, or your auditor is.
The Evidence Platform is the system that makes that attestation defensible.