The Mycelium Evidence Platform is the working layer behind the Mycelium 14-Dimension Framework. Every board-level claim — every met, partial or gap — traces back to a human-approved artefact, a named owner, a date and a decision. Built for Australian regulated organisations that can no longer afford to attest on faith.
Boards are signing AI attestations they cannot defend. Risk teams produce slide decks; internal audit asks for trace. Spreadsheets and policy folders fall apart on the third quarterly cycle. Enterprise GRC platforms store documents but cannot prove a human reviewed each AI control on each cycle.
APRA CPS 230 and CPS 234, AS ISO/IEC 42001 and the ASD ISM AI controls now ask for evidence — and the AICD has put AI directly on the directors’ duty register.
Most platforms cannot do trace. Most consultancies cannot ship product. The Mycelium Evidence Platform is built to sit between them.
Every AI system registered, owned and risk-rated.
Each system mapped to APRA, ISM, AS ISO/IEC 42001, NIST AI RMF, AICD and the Privacy Act ADM reforms.
Evidence requested from named owners. Each artefact reviewed by a named human. Stamped with an evidence_uid.
Drafted under validation, rendered to PDF, version-stamped, uploaded to the private client portal, audit row written.
Every system, owner, business unit, lifecycle stage and data sensitivity.
Per-system rating with documented rationale, refreshed each cycle.
Each system mapped to the 14 dimensions and to the regulator and standards set relevant to the organisation.
Plain-English asks issued to named owners. Tracked. Reminded. Logged.
Every evidence item approved by a named human reviewer. Appended, not overwritable.
Met, partial, gap — per pillar, per system, per cycle.
Versioned PDF: executive summary, scorecard, register, control-evidence detail, gaps and remediation, methodology, attestation page.
Named remediation owner and due date for every gap or partial.
Passwordless access, RLS-isolated client data, 120-second signed download links, append-only access audit.
The Mycelium Evidence Platform reports what human-reviewed evidence demonstrates. It does not assert that an organisation is compliant, certified or assured. It does not replace management, board, legal, risk, audit or regulatory accountability. Compliance, certification and assurance opinions rest entirely with management, the board and the relevant assurance providers.
Six weeks. One AI system. All 14 dimensions. One published, board- and auditor-ready evidence pack. Design-partner pricing available for the first two to three clients.
Designed to fit inside an existing audit-prep or AI project budget.
Book a 30-minute conversationCapture → Assess → Evidence → Publish. The full pipeline, end-to-end, in six weeks. Sponsor-signed. Auditor-followable.
No. The platform produces an evidence trail; assurance opinions remain with management, the board and the relevant assurance providers.
Sensitive artefacts remain in the client’s Microsoft 365 / SharePoint tenant. Mycelium holds references and metadata only. Evidence packs are stored in a private Supabase bucket, default region AU-Sydney.
No-one. Postgres row-level security isolates client data. Cross-client access returns HTTP 403 and is written to the append-only audit log.
Passwordless magic link via Supabase. The service-role key never reaches the browser; download links are signed by a server-side Netlify function and expire in 120 seconds by default.
No. Claude drafts the pack narrative under JSON validation, with a fallback model and explicit fail-closed behaviour. Every claim is cited to an evidence item approved by a named human reviewer.
Yes. There is an anonymised sample on this page (See a sample pack, top of hero), built to the same structure as a live cycle: executive summary, RAG scorecard, control-evidence detail with evidence_uid, gaps and remediation, methodology and an attestation page. All entity names, identifiers and email addresses are illustrative.
Yes, via documented export. Custom integrations are available as a paid extension after pilot.
Not yet. The platform is engineered to the relevant baselines; formal certification will be pursued when a contracted client requires it. The architecture, controls and limits are documented in the Security and Trust Summary, available on request.
The Mycelium Evidence Platform is the system that makes that attestation defensible.
Book a private demonstration