Who Audits the AI? Not the Company That Sold It to You.

Your agents took some actions this week. Somebody will eventually ask whether they took the right ones, in the right order, with the approvals that were supposed to happen. Look at who is offering to answer that question and you will notice something: almost all of them also sold you the thing being asked about. That is not a competitive observation. It is a disqualification, and it is older than any of this.

The rule that actually applies

Start with the correction, because the obvious version of this argument is wrong. Almost nobody is barred from vouching for themselves. You assess your own tax. Under the EU AI Act a provider self-assesses most high-risk systems, education and credit scoring included. Self-certification is ordinary, lawful and everywhere, and an argument that opens by denying it gets taken apart by the first lawyer in the room.

Where the stakes are high enough, independence does become mandatory. A company cannot audit its own accounts. A certification body cannot certify work it consulted on. And the medical device rules draw the line in plain sight: under the EU's Medical Devices Regulation, a Class I manufacturer issues its own declaration of conformity, while at Class IIa and above a notified body is required (Article 52). Cross that threshold and the AI stops self-assessing with it — Article 43(3) of the AI Act sends the provider to the conformity assessment demanded by the existing legislation and folds its own high-risk requirements into it, which “shall be part of that assessment”.

So the same technology is self-assessed or independently assessed depending on nothing but how much harm it can do. That is a threshold drawn by consequence, not a principle covering the field — and education, which the same regulation also calls high-risk, sits on the self-assessing side of it.

What is not ordinary is self-attestation surviving contact with a challenge. The burden was never removed. It was parked.

Under the Fair Trading Act 1986, a representation is unsubstantiated if you did not hold reasonable grounds for it at the moment you made it, and s12A applies that test “irrespective of whether the representation is false or misleading”. You can be right and still liable. What is judged is not the claim. It is whether you were entitled to make it. Tax runs the same shape: you file your own assessment and it stands, and the moment anyone disputes it, s149A of the Tax Administration Act 1994 puts the onus on you, not the Commissioner, to show the assessment is wrong and why.

And when the burden does land, the law already separates a record from an account. The Evidence Act 2006 admits a business record where the person who supplied it cannot reasonably be expected to recollect the matter now, and requires a judge to warn a jury that a mistaken witness may be convincing, and that every one of them may be mistaken. There is no equivalent warning for a contemporaneous record. A note made before anyone knew there would be a dispute is a different object from an account assembled afterwards, and the difference is written into statute.

So the question was never who is allowed to vouch for themselves. Everyone is. The question is what you are holding when somebody stops taking your word for it. Apply that to the systems now taking actions on your behalf and most of the market has nothing to hand you.

Test one: does the measurer have a stake in the verdict?

An agent vendor is conflicted in both directions. Lenient with its own agents, because a finding of failure is a finding about their product. Severe with a competitor's, because a finding of failure is a finding about a rival. Either way, the verdict carries the interests of whoever issued it.

This is worth saying carefully, because the engineering coming out of those companies is good and getting better. Microsoft's Agent Governance Toolkit evaluates policy at runtime before a tool call executes and writes hash-chained, tamper-evident audit entries. That is real work, done well, and it is open source.

It is also, by their own account, not the same object. From the project's own public discussion of policy enforcement versus decision evidence:

“What we don't do yet is treat the decision as a sealed, independently verifiable artifact in the way you describe.”

“Right now the decision and evidence are embedded in the audit trail rather than being first-class objects you can pass around or verify externally.”

microsoft/agent-governance-toolkit, Discussion #276

Note the word yet. That is a roadmap gap, and roadmap gaps close. A company of that size can build sealed, portable, externally verifiable evidence any quarter it decides to.

And it will not help. That is the whole point of an eligibility argument over a feature argument. Shipping the capability does not remove the conflict, because the conflict was never about capability. When the evidence that Microsoft's agents followed the required process is produced and signed by Microsoft, the artefact is a statement by an interested party, however excellent the cryptography. A feature gap can be closed by engineering. A structural conflict cannot be closed by anything the conflicted party does.

That is not a hypothetical. In August 2026 a bipartisan coalition of 51 attorneys general reached a proposed settlement with Meta, subject to court approval, worth up to US$17 billion over ten years. Among its terms is an independent auditor with expansive access to information and resources, regular reporting, and the right to raise concerns directly with the attorneys general. A company with more engineering capacity than anyone else in this market did not settle a question about its own conduct by improving its own logging. The remedy was somebody else being given access.

Test two: who produced the record?

The second test is harder and it clears out most of what survives the first.

Observability platforms pass test one — they are framework-agnostic and have no stake in whether any particular workflow succeeded. But their evidence comes from an SDK running inside the customer's own application, recording what that application chooses to report. The party being examined is also the party writing the account. That is a diary, not a witness. Excellent for debugging. Worth very little to a regulator.

Orchestration frameworks fail both tests at once, and fail them harder than the model vendors do. A framework whose central promise is that it enforces step order cannot also be the independent confirmation that the order held. That is the doer vouching for the doing. It is the same reason the person who performed a procedure does not get to witness their own compliance with it, and the reason a signature and a countersignature are required to come from two different hands.

What passing both tests actually requires

Passing test two is not a matter of being trustworthy. It is architectural. The record has to be produced by something that sits in the path of the action rather than alongside it — where the step does not execute unless the check returns permission, so the evidence is a precondition of the action rather than a report written about it afterwards.

A library that observes from inside the application can never make that claim, no matter how independent its vendor. It sees what it is shown.

And the artefact has to be portable: signed, self-contained, verifiable by a third party who trusts neither the operator nor the vendor and holds no account with either. Evidence embedded in someone's audit trail is evidence you have to ask permission to examine. That is the distinction a maintainer on Microsoft's own project drew, and it is the right one.

Now run the test on us

An argument like this is worthless if the party making it exempts itself, so here is where we stand against our own two tests.

Test one, cleanly. We do not sell agents, models, or an orchestration framework. There is nothing in our catalogue whose reputation a DENY could damage. We have no stake in any verdict we issue, and structurally we cannot acquire one without ceasing to be what we are.

Test two, cleanly. The gate sits in the execution path. A step is not permitted until it is checked against a sequence declared before the run began, and the receipt is a signed, portable object with its own preimage published, verifiable offline by anyone with no account and no permission.

And the part that is not clean. We currently hold the signing keys. That is the honest limit on everything above, and we would rather say it than have you find it: an auditor who keeps the client's working papers in their own drawer is independent in the way that matters least. Every sealed run is copied to a separate write-once archive under a different credential, which means an altered record can be caught by comparison rather than taken on trust. That closes part of it. The rest closes when the keys are held by someone who is not us, and that is work in front of us, not behind us.

We would rather publish that sentence than be asked it in a meeting.

Three questions

The test runs on anyone selling agent governance, including us:

Do you also sell the thing being measured? The agents, the models, or the framework that runs them.

Who produces the record? Your system, or mine reporting on itself.

Who holds the keys, and can I verify anything without asking you?

A vendor who answers all three cleanly is rare. A vendor who cannot answer them at all is selling assurance, which is a feeling. Evidence is something a stranger can check, and the first requirement of evidence has never been that it is accurate. It is that the person who produced it had nothing to gain.

Related reading: What AgenticRail is, and what it is used for · When an AI Agent Skips a Step, Your Audit Log Shows a Clean Run · Self-Signed Evidence · Provable Human Oversight · Security