Verivus is building AI governance that can be checked rather than taken on trust: decisions co-signed by three of five signers, and records that are hash-linked and signed so that tampering shows. The platform is still in development and today runs only for Verivus itself; the open-source tools further down this page are available now.
Enterprises putting AI into production face three risks that compound one another.
AI outputs lack verifiable reasoning. When a model decides, you get a result, not a proof, and auditors, regulators and boards are left with a probabilistic explanation for a consequential outcome.
The EU AI Act requires technical documentation for high-risk systems (Annex IV), ISO/IEC 42001 sets out a certifiable AI management system, and the NIST AI RMF, although voluntary, describes how AI risk should be governed and measured. Evidence assembled by hand after the fact is slow to produce and hard to verify.
There is no cryptographic trail from requirement to deployment. AI-generated code, decisions, and artifacts exist without origin verification, agent accountability, or immutable audit records.
The design replaces trust in any single model with checks that can be repeated: a quorum that has to agree, records that show when they have been altered, and certificates that can be verified afterwards. Each of the three works in prototype today, and none is generally available yet.
No single model or agent should decide an outcome on its own. In the experimental prototype, work is split across five roles (Planner, Critic, Verifier, Optimiser and Sentinel) and a plan has to reach a quorum before it is accepted, although three of those roles (Verifier, Optimiser and Sentinel) are not yet backed by a model.
Governance events are written to a chain in which every entry is linked to the hash of the one before it and signed with Ed25519, so an entry that is changed or removed breaks the chain. Objects are content-addressed, which means an identifier is a digest of the content itself rather than a label someone assigned.
A decision that passes is issued a quorum certificate that needs signatures from at least three of five signers, and anyone holding the public keys can check it later without trusting the system that produced it. There is no network consensus between the signers yet, and the certificate is not part of a production service.
These are open-source tools built and maintained by Verivus, each published under a permissive licence with a public repository, a tagged release history and its own documentation site.
Verivus for Enterprise is not generally available. This is what we are building for regulated organisations, with the status of each part as of September 2026.
A verifiable AI governance platform for regulated organisations in sectors such as financial services, healthcare and government, with signed provenance and human approval built in. Parts of it work in prototype today; the rest is specified or planned.
Verivus does not currently hold an ISO certification or a SOC 2 report. These are the frameworks the design is built to support, and where our own work against each one stands.
Information security management. Control work was in progress as of February 2026, and Verivus is not certified.
AI management systems. Certification is a stated goal on the roadmap, and Verivus is not certified.
A voluntary framework with no certification scheme. Its four functions (Govern, Map, Measure and Manage) inform how the design treats AI risk.
A draft analysis (version 0.1) maps our evidence formats to the technical documentation required for high-risk systems under Annex IV. It is a capability map, not a readiness claim.
An independent auditor's report rather than a certificate. Verivus does not hold one, and it is on the roadmap.
If you are working out how to evidence AI decisions for a regulator, or you want to try the open-source tools on this page, we would like to hear what you need.