20 May 2026 5 min read Evidence
Compliance is proven, not asserted — what qualifies as evidence and how it is graded.
Evidence vs assertion
Saying you do something is not evidence. A document, test result, configuration export or third-party attestation that demonstrates it is.
Grades
- Self-declared: useful but weakest.
- System-verified: captured by tooling.
- Third-party/auditor-verified: strongest.
Admissibility
Higher-grade, current and relevant evidence is admissible and lifts readiness; stale or off-topic evidence does not.
This is an educational explainer. For the canonical regulation reference, see the dedicated Evidence page — or run an assessment to see how it applies to your product.