CSOAI OS · signed assurance
Prove any AI was governed. Verify it offline. Forever.
Assurance regimes — UK JSP 936, the EU AI Act, NIST — all require proof that a high-risk AI system was governed across its lifecycle. But there's a missing primitive: an independent, tamper-evident record anyone can verify without trusting a vendor's dashboard. Consultancies sell assurance as a service; no commercial assurance vendor we've found ships a tamper-evident, cryptographic System Card. CSOAI does.
It turns "trust our governance" into "don't trust us — verify it yourself, and watch tampering fail." Every retrain re-issues a new signed card; the version history is preserved; incidents trigger re-assurance. It's the assurance layer for JSP 936, and it maps straight onto EU AI Act, NIST and ISO 42001 obligations.
Demo card data is synthetic; the signing and verification are genuinely real, on the CSOAI measurement signing backend. For a named engagement the card is issued under your own signing key.