Evidence at Execution vs. Evidence by Attestation — Runtime Proof vs. Periodic Reports

Credo AI collects governance evidence through assessments, questionnaires, and periodic attestations — snapshots of your AI program. Mala seals governance evidence at the moment each decision is made — a cryptographic proof generated at execution time. Credo answers 'Are we compliant?' Mala proves 'This specific decision was compliant when it happened.'

Credo AI is the category leader for AI governance program management: policy libraries, compliance mappings to EU AI Act and NIST AI RMF, risk assessments, and evidence collection workflows. If you're building an enterprise AI governance program, Credo's framework gives you the policy structure and reporting layer. But Credo's evidence model is largely attestation-based: teams fill out questionnaires, upload documentation, and map controls to requirements. This creates a governance *program* — but it doesn't generate tamper-proof evidence about what individual AI decisions actually did at execution time. Mala fills this gap. For every AI agent decision, Mala generates a sealed decision trace: the input context, the policy that applied, the output, whether human approval was required, and a SHA-256 integrity proof. This isn't an attestation that 'our AI follows policy' — it's cryptographic proof that *this specific decision* followed policy *when it was made*. When an EU AI Act auditor requests 'Show me evidence that your Article 14 human oversight controls applied to high-risk AI decisions in Q4' — Credo shows your governance program documentation. Mala shows the individual sealed decision certificates where human oversight was applied. These are complementary: use Credo to structure and manage your AI governance program, use Mala as the runtime evidence layer that makes that program provable.

Does Mala replace Credo AI?

No — they address different governance layers. Credo AI builds your AI governance *program*: policies, risk frameworks, compliance mappings to regulations like the EU AI Act and NIST AI RMF. Mala generates the *runtime evidence* that makes that program provable. Use Credo to structure governance; use Mala to seal the execution-level proof.

What is the difference between attestation-based and execution-time evidence?

Attestation-based evidence (Credo's model) means your team documents and asserts that governance controls were followed. Execution-time evidence (Mala's model) means the system automatically seals cryptographic proof of what actually happened at decision time — no human assertion required. For high-risk AI under EU AI Act Article 19, execution-time logs are what regulators are moving toward requiring.

Does Mala integrate with Credo AI?

Yes, conceptually and technically. Credo defines your governance policies and evidence requirements. Mala's sealed decision traces can serve as the runtime evidence that satisfies those requirements. The decision certificates Mala generates — timestamp, input context, policy applied, output, integrity hash — map directly to Credo's evidence collection framework.