The TRACE Framework
Every AI governance engagement we conduct is structured around five dimensions. Together they determine whether an organization can defend what its AI systems are doing — to regulators, boards, acquirers, and customers.
The TRACE Framework is a registered methodology. U.S. Copyright Office registration TX 9-584-804.
No single dimension tells the full story. An organization can have strong evidence but no clear accountability. It can have named owners but no process for governing change. TRACE evaluates all five in combination, because governance gaps rarely announce themselves — they accumulate quietly until someone serious starts asking questions.
What we evaluate, and what we look for.
Decision pathways are documented. Outputs can be tied to inputs. A regulator, auditor, or customer asking "why did the system do that?" gets a written answer — not a shrug.
The system produces outputs that no one can fully explain. Developers reference model weights or vendor black boxes. There is no audit trail connecting decisions to documented reasoning.
A named individual or team owns the system, monitors its behavior, and has authority to pull it offline. When something goes wrong, accountability is not a question.
Ownership is diffuse. The team that built it has moved on. The vendor says it's the customer's problem. The customer says it's the vendor's problem. No one is on the hook.
Claims about what the AI does — in marketing, contracts, product descriptions, regulatory filings — have been reviewed and signed off by someone with the technical standing to make them.
Marketing wrote the capability claims. Legal approved the language. Neither talked to the engineering team. The claims in the contract do not match what the system actually does.
Model updates, retraining events, prompt changes, and configuration changes go through a documented approval process. The governance record reflects the current state of the system.
The model has been updated three times since the last governance review. A prompt change went out last quarter with no documentation. The system the organization is defending is not the system that is running.
Test results are written down and retained. Benchmarks are current. Performance claims are backed by documentation that could be handed to an external reviewer.
The evidence is vendor-provided. Internal testing was done but not recorded. The benchmarks are from the original implementation and have not been updated as the system evolved.
How TRACE drives each engagement.
We apply all five dimensions to every AI system in scope. Each dimension produces a written finding — what we observed, what the evidence supports, and where the gaps are. The final report is structured around TRACE and can be handed directly to a regulator or board.
The 10-question diagnostic maps directly to TRACE. Each question probes one of the five dimensions. Your score tells you which dimensions are holding and which are creating exposure — before anyone external starts asking.
For organizations in active AI deployment, TRACE provides a standing framework for reviewing new systems, vendor changes, and model updates. Advisory engagements use TRACE to maintain a current governance posture rather than catching up after the fact.
See where your organization stands across all five dimensions.
The 10-question diagnostic takes about ten minutes and maps directly to TRACE. You'll see which dimensions are holding and which need work.