the view of your governance that shows you what a regulator, journalist, or plaintiff would find. most people prefer the other view.
A view of the framework that highlights what fails, how it fails, and who is accountable when controls are absent or ineffective. Maps failure modes to specific components. Forensic exposure is not a risk assessment — it is a reconstruction of what the evidence trail would show to an external investigator examining your AI governance after an incident. It asks: what would a regulator, plaintiff, auditor, or journalist conclude from what exists — and what does not exist — in your governance record?
Why It Matters
Most AI governance frameworks are designed to show what is in place. Forensic exposure shows what is not. The difference is the difference between the board presentation and the litigation discovery. Both look at the same framework. They see entirely different things.
A governance framework with 200 controls looks comprehensive until you examine the evidence. How many controls have documented proof of operation? How many have been tested? How many have a named accountable person? How many have evidence that they were reviewed in the last 12 months? The gap between “controls defined” and “controls evidenced” is the forensic exposure. It is the surface area that an adversary — regulator, litigant, journalist — will target.
This matters because regulatory enforcement and AI litigation are accelerating simultaneously. The EU AI Act introduces fines of up to 35 million euros or 7% of global turnover. U.S. litigation around algorithmic decision-making is increasing. Journalists have demonstrated the ability to reverse-engineer AI governance failures from public evidence. The forensic exposure view tells you what these actors would find before they find it.
The Stress Test
Your organisation faces a regulatory investigation after a customer complaint about an AI-driven decision. The regulator issues an information request covering your AI governance framework, evidence of control effectiveness, incident records, and accountability assignments. You produce 47 policy documents, 12 model cards, and a governance framework diagram.
The regulator asks a single question: for the specific AI system involved in the complaint, produce the evidence that each claimed control was operational at the time of the incident. You discover that 14 of the 23 controls listed for this system have no evidence artifact. Three controls reference procedures that were drafted but never implemented. Two controls name accountable persons who left the organisation eight months ago and were never replaced. Your framework said “governed.” The evidence says “exposed.”
In the Wild
The Boeing 737 MAX investigation revealed a pattern relevant to AI forensic exposure: the Maneuvering Characteristics Augmentation System (MCAS) had documented design controls, testing procedures, and safety assessments. Post-crash forensic analysis revealed that the safety assessment for MCAS relied on a single point of failure analysis that assumed pilot response times inconsistent with actual operational conditions. The controls existed on paper. The evidence of their adequacy did not survive forensic scrutiny. The resulting litigation, regulatory fines, and criminal charges were all driven by what the evidence trail revealed about the gap between claimed governance and actual governance.
Boeing did not lack a safety framework. It lacked evidence that the framework’s assumptions were tested against reality. The forensic exposure was the gap between the framework’s claims and the evidence trail’s record.
In the aftermath of the Dutch childcare benefits scandal, forensic analysis of the Tax Authority’s algorithmic governance revealed a specific pattern: governance documents existed that described fairness controls and appeal mechanisms. Evidence that these controls operated was absent. Internal correspondence showed that staff had flagged concerns about the algorithm’s behaviour, but no evidence existed that these concerns triggered the documented escalation process. The governance framework described a system that should have caught the error. The evidence trail showed it did not. The parliamentary inquiry used the gap between documented controls and evidenced controls as its primary finding.
The governance framework was the prosecution’s exhibit A. Not because it was absent, but because it was present and unenforced. Documented controls without evidence are worse than no controls: they prove you knew what should have been done.
Clearview AI faced enforcement actions from data protection authorities in France, Italy, Greece, the UK, and Australia. Each authority independently examined Clearview’s governance documentation and found the same pattern: claims of compliance with data protection principles, absence of evidence that those principles were operationalised. The French CNIL fined Clearview 20 million euros. The Italian Garante matched the amount. The UK ICO issued a 7.5 million pound fine. In each case, the forensic exposure was identical: the gap between Clearview’s stated compliance and the evidence of actual compliance.
Five regulators. Five independent investigations. Five identical findings. Forensic exposure does not vary by jurisdiction. The evidence trail is the same everywhere. If the controls are not evidenced, every investigator finds the same gap.
How to Govern It
Forensic exposure is not a risk to mitigate. It is a lens to apply. The mitigation is evidence.
Within the AI Control Index, forensic exposure is managed through the Evidence Factory and systematic evidence gap analysis:
- Evidence Factory (S1) — Every control in the framework generates a governance artifact: a test result, an approval record, a review log, an incident report. The Evidence Factory is the system that captures, timestamps, and links these artifacts to their controls. No artifact, no evidence. No evidence, forensic exposure.
- Control-Evidence Mapping — Each control specifies the evidence it must produce to demonstrate operation. The mapping creates a checkable inventory: for each control, does the evidence exist? Is it current? Is it authentic? Gaps in this mapping are the forensic exposure surface.
- Severity-Based Prioritisation — Not all forensic exposure is equal. An evidence gap in a severity 5 system facing the public is more dangerous than a gap in a severity 1 internal tool. The framework prioritises evidence generation by severity and blast radius.
- Adversarial Review — Periodic assessment of the governance framework from an adversarial perspective: what would a regulator find? What would a plaintiff’s attorney request in discovery? What would a journalist conclude from public evidence? The adversarial review identifies exposures before external actors do.
- Accountability Mapping — Every control has a named accountable person. Every evidence gap has a named person responsible for remediation. Accountability voids — controls with no named owner — are themselves a forensic exposure.
When It's Relevant
Every AI governance review. Forensic exposure analysis should be part of every governance assessment, every gate review, and every incident post-mortem. The question is never “do we have controls?” The question is “can we prove they work?”
Forensic exposure analysis is most critical when:
- The organisation is preparing for regulatory scrutiny (EU AI Act enforcement, sector-specific audits)
- An incident has occurred and the organisation needs to assess its evidence position before external investigation
- Board or audit committee seeks assurance that governance is operational, not aspirational
- M&A due diligence requires an honest assessment of the target’s AI governance maturity
- The organisation’s AI governance framework was built recently and evidence generation has not yet caught up with control design
Related Terms
References
- [1] Raji, I.D., Smart, A., White, R.N., Mitchell, M., Gebru, T., Hutchinson, B., Smith-Loud, J., Theron, D. and Barnes, P. (2020) ‘Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing’, Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (FAT*), pp. 33–44.
- [2] European Parliament and Council of the European Union (2024) Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L series.
- [3] Parliamentary Committee of Inquiry into Childcare Benefits (2020) Ongekend Onrecht [Unprecedented Injustice]. The Hague: Tweede Kamer der Staten-Generaal.
- [4] Commission Nationale de l’Informatique et des Libertés (2022) Decision SAN-2022-019 regarding Clearview AI. CNIL, Paris.
- [5] Power, M. (1997) The Audit Society: Rituals of Verification. Oxford: Oxford University Press.
- [6] Kaplan, R.S. and Mikes, A. (2012) ‘Managing Risks: A New Framework’, Harvard Business Review, 90(6), pp. 48–60.
- [7] Ananny, M. and Crawford, K. (2018) ‘Seeing without Knowing: Limitations of the Transparency Ideal and Its Application to Algorithmic Accountability’, New Media & Society, 20(3), pp. 973–989.
AI Control Index v6.0 · Glossary · June 2026 · i-DEPOT 158508 (BOIP) · CC BY-NC-ND 4.0
By Jeroen Janssen, Apparens