# Compliance and quality · Solutions > For quality, regulatory and compliance leads in regulated engineering. Neural Inverse produces the evidence; your quality system and your assessor decide what it proves. Source: https://neuralinverse.com/solutions/compliance-and-quality/ --- [Solutions / Quality, regulatory and compliance leads](https://neuralinverse.com/solutions/) # Show who changed what with AI, who signed for it, and that the record is intact. For quality, regulatory and compliance leads in regulated engineering. Neural Inverse produces the evidence; your quality system and your assessor decide what it proves. For Quality, regulatory and compliance leads Record Hash-chained, sealed every minute Approvals Signature records with re-authentication Verification Offline, standalone verifier Standards Evidence toward your frameworks What you own ## What quality and compliance answer for. - **Controlled change:** Changes to controlled items, released baselines and trace data go through your change process, whoever or whatever drafted them. - **Signatures that mean something:** An approval needs a named person, a meaning and a reason, and the author cannot approve their own work. - **Accounting for AI use:** An assessor may ask which parts of a release AI produced, with which model, and who reviewed them. - **Records that last:** Records are kept for years, unchanged, and must be checkable by someone who does not trust your systems. - **AI services outside your tools:** Use of AI vendors' own services belongs in the record too. What Neural Inverse gives you ## Evidence produced as the work happens. Each row is a capability of Neural Inverse Build or Govern in use today. - **Written with the change:** Every change and every enforced decision is written in the same database transaction as the change. If the entry cannot be written, the change does not happen. - **Electronic signature records:** An approval is a signature record in the repository with the signer's printed name, time, meaning and reason, made with re-authentication. Verification refuses a changed request, a replayed record and any separation-of-duties breach. - **Evidence packs:** A signed pack for a release, a change, a trace or a time range answers which lines AI touched, which model and context were used, who approved and what left the boundary, with every gap listed. - **Sector templates:** Starting agent rules for avionics, medical devices, automotive, finance, mainframe, firmware, FPGA and industrial control. Applying one never removes or loosens a rule you already have. - **Retention and legal holds:** Older entries move to your own bucket as signed segments, under Object Lock in compliance mode where you choose. Retention can be lengthened, never shortened, and a legal hold keeps entries in the hot tier. - **Compliance rule packs:** Rule packs for SOC 2, ISO 42001, the EU AI Act, GDPR, HIPAA and other frameworks check your organisation's state and store findings and evidence records. A pass means a check found what it looks for, not that a control is met. - **Vendor audit records:** Audit and usage records pulled from AI vendors' APIs or pushed by tools, kept beside Govern's own with their own signed exports. How a change moves ## How a controlled change moves. 1. Propose An engineer or an agent drafts a change to a controlled item. 2. Verify Your qualified tools and your organisation's signed checks run on it. 3. Approve Enrolled approvers other than the author sign with re-authentication, stating the meaning and the reason. 4. Record Change, results and signatures are kept together, and CI re-checks the exact commit. 5. Verify offline Your assessor checks the evidence pack or signed export without access to your systems. For your auditor ## What you can show an auditor. Neural Inverse provides evidence toward the frameworks you report against. Certification stays with your organisation and assessor. - **Signed exports:** NDJSON or CSV for any time window, with a manifest signed with Ed25519 that names the file's hash and its place in the chain. - **Offline verification:** A standalone verifier checks exported chains and archived segments with no network access and no connection to Govern, using the public keys of your installation. - **Evidence packs per release:** In OSCAL, in-toto, SLSA and CycloneDX, with an HTML report and CSV tables. Packs from several developers combine into one. - **Access review decisions:** Every item, decision, reviewer and time of a campaign, with the audit entries behind them, exportable as JSON or CSV. - **Context evidence:** Which context fed each AI request, which model call used it and which agent instructions a session started with, in a separate chain. Neural Inverse provides evidence toward the standards you report against. Certification stays with your organisation and assessor. Read next [Audit and evidence → A record your auditors can verify without trusting us.](https://neuralinverse.com/govern/audit/)[Agent policy and approvals → Sector templates and named approvers.](https://neuralinverse.com/govern/agent-policy/)[Editor → Signature records and evidence packs.](https://neuralinverse.com/build/editor/)[Security and trust → How we handle security and what we do not claim.](https://neuralinverse.com/trust/) Industries[Medical devices](https://neuralinverse.com/industries/medical/)[Avionics](https://neuralinverse.com/industries/avionics/)[Automotive](https://neuralinverse.com/industries/automotive/)[Banking and mainframe](https://neuralinverse.com/industries/banking/) Documentation[Evidence](https://neuralinverse.com/docs/evidence/)[Verify offline](https://neuralinverse.com/docs/evidence/verify-offline/)[Policy, approvals and audit](https://neuralinverse.com/docs/build/governance/)[Evidence packs](https://neuralinverse.com/docs/editor/evidence-packs/)[Compliance rule packs](https://neuralinverse.com/docs/evidence/compliance/) What's next ## Still being built. Listed so you can plan around it. None of it is part of what works today. - **Automatic evidence collection:** Most compliance checks report a warning until someone records evidence for the control. Collecting evidence automatically is not part of this release. - **Domain module verification:** The modules that drive your vendor tools are pre-release, and nothing is verified by a customer yet. Their verification state is published per capability. - **Access reviews in the console:** Access reviews run through the API today; their console page is not available yet. ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)