The Chain · Data to AI decision
Both halves of governance, one chain of custody.
Data governance and AI governance have converged. Governed data feeds the AI, and when a decision is questioned the answer has to trace back to the data. aerais runs both halves as one chain, so provenance and proof do not break at the seam.
Two planes · One seam
Where the chain runs.
Most tools cover one plane. The chain only closes when the data plane, the AI plane and the seam between them are governed together.
Data plane
Data feeds AI
- Discovery and catalog
- Classification and data security posture
- Lineage and metadata
- Data quality
- Privacy operations: DSAR, RoPA, DPIA, consent
The seam · governed by one team
Data meets AI
- Data-to-AI lineage and training-data provenance
- Quality-gated AI release
- Contaminated-data blast radius
- Right to be forgotten across data and models
- Unified control crosswalk
AI plane
AI risk traces back
- AI inventory
- Assurance and evaluations
- Red-team and adversarial testing
- Runtime guardrails
- Monitoring and incident response
Five capabilities · LOOP-01 to LOOP-05
What only runs when you govern both sides.
Each capability needs evidence from the data plane and from the AI plane at the same time. That is why they sit on the seam.
- LOOP-01
Data-to-AI lineage
Every model and feature traced to its source data. The path from source dataset through features and training sets to the model and its outputs is recorded. A decision can then be followed back to the data that shaped it.
- LOOP-02
Quality-gated release
Data quality thresholds gate AI deployment. A release is held when the data behind a model fails an agreed gate. The gate, the threshold and the result are kept as evidence.
- LOOP-03
Blast radius
Find a contaminated source, then find everything it touched. Lineage runs forward from the source to every dataset, feature, model and vector store that used it. The affected list becomes the scope of remediation.
- LOOP-04
Right to be forgotten
Erase a subject across data stores and into the AI. The subject is located in features, training sets and vector stores as well as source systems. Where a model is affected, the decision on retraining or other treatment is recorded.
- LOOP-05
Unified crosswalk
One control, evidenced once, mapped to both data and AI regimes. A single control record carries its mappings to the relevant standards and regulations. Evidence captured once is reused across reviews and audits.
Evidence · Tamper-evident by design
What the chain leaves behind.
Each step in the chain writes an evidence record: what happened, which data or model was involved, which control applied and when. Records are linked by cryptographic hashes, so a change to an earlier record is detectable. This describes a design property, not a claim of absolute security.
When a regulator, a board or a customer asks how a decision was made, the answer is a set of linked records rather than a reconstruction from memory. The same records support internal audit, incident review and the unified control crosswalk described under Framework.
Position · Why a chain
Catalogs stop at lineage. AI-governance tools start at the model.
Data catalogs govern the left side of the chain and stop at lineage. AI-governance tools govern the right side and start at the model. Both hand you software to implement and staff.
aerais works across the seam and operates the result. The records are built into your own systems, designed so that alteration is detectable, and handed to you as evidence you own.
FAQ
Frequently asked questions
What is a chain of custody for AI?
It is a recorded, linked path from source data through features, training sets and models to a specific AI decision. Each step leaves evidence, and the records are linked by hashes so that alteration is detectable. Any decision can then be followed back to the data behind it.
Can we start with only the data side or only the AI side?
Yes. Many engagements begin on one plane, often an AI inventory or a data classification effort. The five seam capabilities need both planes, so the scope expands as the chain closes.
Why does aerais operate the chain instead of licensing software?
The controls live inside your systems, delivery lifecycle and data. aerais builds them there and runs them with your teams, so ownership of the evidence stays with you and no separate platform needs to be staffed.
Contact
Make your data and AI provable.
Start with a diagnostic: current-state maturity, risk exposure and a prioritized roadmap. We aim to reply within two business days.