ExeCert issues cryptographic execution certificates for AI models. Not logs. Not dashboards. A signed, replayable artifact that proves exactly what ran, when, and whether it was admissible — ready for SR 26-2, EU AI Act, and board-level audit.
SR 26-2 replaced SR 11-7 in April 2026 and explicitly excludes generative and agentic AI from its formal MRM scope — creating a governance gap regulators have flagged for specific guidance. The audit question has changed.
Governance platforms capture metadata, policy mappings, and monitoring dashboards. When an examiner asks "show me exactly what this model did on this decision" — you have a log entry. That is not proof. Logs can be altered, deleted, or selectively exported.
A signed artifact anchored to the exact execution — input hash, execution hash, policy version, verdict, timestamp — independently verifiable by any party without calling ExeCert. The certificate is the audit trail. It cannot be retroactively altered without detection.
SR 26-2 §4 requires ongoing monitoring and audit trails. In practice, banks submit model documentation PDFs. Examiners are starting to ask for something better, and specific AI guidance is forthcoming.
A signed JSON certificate, a PDF render for examiners, an offline verifier, and an evidence bundle — all generated automatically at execution time. No manual assembly. No documentation sprint before the audit.
ExeCert sits beneath your existing AI stack as an evidence layer. No model changes. No workflow disruption. Add the capture hook and every execution produces a certificate.
One API call after each AI model execution. Submit the execution ID, policy, input hash, and runtime metrics. Works with any model, any framework, any cloud.
ExeCert evaluates the execution against your declared policy, produces a verdict (ADMISSIBLE / INADMISSIBLE), and signs the certificate with Ed25519. Issued in milliseconds.
Any party can verify the certificate offline using the public key and the certificate JSON. No ExeCert dependency at verification time. Evidence survives vendor relationships.
Not all AI executions need the same evidence depth. ExeCert's five-level assurance scale lets you match evidence strength to decision risk — and communicate it in language auditors and boards understand.
ExeCert certificates map to the specific evidentiary requirements of the frameworks your examiners and auditors actually use.
SR 26-2 replaced SR 11-7 in April 2026 and explicitly excludes generative and agentic AI — directing banks to apply appropriate controls. ExeCert is that control layer: execution evidence for every AI decision, ready for OCC examination.
Article 12 requires logging and record-keeping sufficient for post-hoc audit of high-risk AI systems. ExeCert certificates satisfy Article 12 logging requirements with signed, tamper-evident artifacts retained per your defined schedule.
ECB and BaFin model risk guidelines require explainability, audit trails, and governance documentation for AI in financial services. ExeCert provides the execution evidence layer beneath your existing governance platform.
The GOVERN, MAP, MEASURE, MANAGE functions all require evidence of what AI systems actually did. ExeCert's certificates provide the MEASURE-layer artifacts that NIST AI RMF compliance requires at the execution level.
DORA ICT risk management obligations require audit trails for all critical systems. AI models in financial services are increasingly classified as ICT assets. ExeCert provides the execution audit trail DORA examiners will request.
ISO 42001 certification requires documented evidence of AI governance controls. ExeCert certificates are the machine-readable evidence artifacts that map to ISO 42001 control objectives — reducing certification preparation time significantly.
Start with platform access. Scale with execution volume. No per-decision fees during pilot — we want you to certify everything.
Work directly with ExeCert to certify your first workflow. Influence the product roadmap.
Full evidence infrastructure for production AI deployments. Level 4 certificates included.
Add evidence capacity as your certified execution volume grows. No surprises.
SR 26-2 is in effect. EU AI Act high-risk obligations apply from August 2026. The institutions that build the evidence infrastructure now are the ones whose examiners find nothing to object to later.
Start a pilot conversation →The certificate layer for AI execution evidence. ExeCert takes a submitted execution record, evaluates it against a declared policy, and issues a signed, tamper-evident certificate — in milliseconds.
A log records that something happened. An ExeCert certificate proves what happened, that it complied with the declared policy, and provides a cryptographic seal that makes any subsequent alteration detectable.
Execution ID, policy ID, execution type, input hash, steps completed, runtime in milliseconds, and optional violation records. One API call. Your model does not change.
A signed JSON certificate with execution hash, policy hash, verdict (ADMISSIBLE / INADMISSIBLE), signature, and all evidence fields. Verifiable offline. Exportable as PDF.
Any party with the public key and the certificate JSON can verify the certificate independently. No ExeCert account. No network call. The evidence is self-contained.
Certificates are stored with configurable retention — 6 months for EU AI Act Article 12, 7 years for SR 26-2 / BASEL III alignment. Bulk export available for migration.
The certificate schema is public and stable. Every field maps to a specific evidence requirement from the regulatory frameworks ExeCert is designed to support.
| Field | Value / type | Evidence purpose |
|---|---|---|
| certificate_id | 32-char hex | Unique identifier for retrieval and cross-referencing in audit binders |
| issued_at | ISO 8601 UTC | Timestamp of certification — establishes when policy version was in effect |
| policy.id + policy.version | string + semver | Exact policy applied — proves which rules governed this execution |
| policy.hash | SHA-256 hex | Cryptographic commitment to policy content — detects policy drift |
| execution_hash | SHA-256 hex | Hash of the execution record — binds certificate to specific execution |
| input_hash | SHA-256 hex | Hash of execution inputs — proves what data the model received |
| verdict | ADMISSIBLE | INADMISSIBLE | Policy evaluation outcome — the primary compliance signal |
| violations[] | typed array | Specific policy violations with type, detail, and step number |
| resources.* | observed vs limit | Runtime metrics against declared policy bounds — resource compliance evidence |
| signature.value | Ed25519 hex | Cryptographic seal — any alteration invalidates this signature |
| signature.public_key | 64-char hex | ExeCert signing key — allows offline verification without ExeCert access |
ExeCert integrates at the evidence layer, not the model layer. Your model runs as normal. You submit the execution record to ExeCert after the fact. No model changes, no latency impact on inference.
ExeCert ships with policies for common AI deployment patterns. Bring your own policy in YAML — define the execution type, resource limits, enforcement mode, and violation types that matter to your regulatory context.
General AI model inference. Runtime, memory, and step count bounds. HALT_ON_VIOLATION enforcement. Covers LLM, classification, and scoring workflows.
Credit scoring, fraud detection, and trading algorithm executions. Tighter runtime bounds, output validation requirements, and ECOA-aligned violation types.
AI in security and threat detection workflows. Network access boundaries, execution isolation requirements, and security-specific violation types.
API access is available immediately. Policies configured in hours. First certificate issued the same day. Start with a 90-day pilot at no cost — certify your highest-priority workflow first.
Get API access →