Acceptance criteria
API, CSV, webhook or evidence package suitable for audit and incident response use.
Why it matters
Evidence has to leave the console in a form legal, HR and auditors can use.
How to verify
Export an evidence package for one pilot incident.
OWASP adoption context
Evidence export serves investigation and audit across adoption tiers; the relevant source and access restrictions still follow the records.
Framework mappings
Exportable AI-event and incident records provide usable information for incident analysis and evidence handling. Preserve source identifiers, times, provenance and integrity through export into the relevant evidence procedure. Format support alone establishes neither accuracy, completeness, chain of custody, recorded investigation actions nor an internal-audit program or incident decision.
Evidence packages make AI-event information available to people responsible for testing, incident identification and information sharing. An export facility is an input to those practices, rather than the complete practice.