We Watched an Auditor Spend 3 Weeks Chasing AI Code Evidence. So We Built Verdict.
A health IT company we know went through their SOC 2 audit last quarter. Three developers had been using Claude Code for months. The auditor asked one question: “Show me the change management evidence for AI-generated code.”
What followed was three weeks of chaos. Developers dug through terminal history. The compliance lead manually reconstructed git logs. Someone built a spreadsheet mapping commits to Jira tickets. The auditor flagged it as a finding anyway — because none of it was systematic, automated, or tamper-resistant.
That's the moment we knew this had to exist.
The pain is real and getting worse
Every health IT team we talk to has the same story with slight variations:
EHR VENDOR, 200 ENGINEERS
“We had to ban AI tools entirely before our HITRUST assessment. Our compliance team couldn't figure out how to document AI-generated changes. We lost 4 months of productivity.”
DIGITAL HEALTH STARTUP, 30 ENGINEERS
“Our best developer quit because we wouldn't let her use Claude Code. She went to a company that figured out AI compliance. We still haven't replaced her.”
HEALTH SYSTEM IT, 50 ENGINEERS
“We tried to build an internal tool to track AI sessions. After 6 weeks, we had a janky script that captured maybe 40% of what an auditor needs. Then the person who built it left.”
The pattern is always the same: productivity gains from AI agents are massive, but the compliance gap makes them unusable in regulated environments. Teams either ban the tools, ignore the risk, or waste months building inadequate internal solutions.
What we built
Verdict is the compliance layer that should have existed from day one. It solves the three problems every health IT team faces:
Problem: “We have no audit trail for AI changes.”
Verdict captures everything automatically. Developer identity, prompts, every file read and modified, commands executed, git context, timestamps. Structured into a Change Record where every field maps to SOC 2, HIPAA, and HITRUST controls. Zero manual effort from developers.
Problem: “We can't prove the AI didn't access PHI.”
Verdict monitors and reports on every file access. PHI detection runs locally on every file the agent reads. If patient data patterns are found, it's flagged and redacted before storage. Your auditor gets a clean monitoring report for every session.
Problem: “Compliance evidence doesn't reach our GRC platform.”
Verdict syncs directly to Vanta, Drata, and Secureframe. No manual uploads. No quarterly evidence collection sprints. Your compliance dashboard updates automatically with every AI coding session. Auditors see continuous evidence.
What changes for your team
Before Verdict, the typical health IT team has two options: ban AI tools or accept the compliance risk. After Verdict:
- Developers use AI coding agents freely. Verdict runs in the background — they don't change their workflow at all.
- Compliance teams get automated, auditor-ready evidence for every AI session. They spend zero time chasing developers for documentation.
- CISOs can say yes to AI tools because the monitoring and evidence are better than what they had for manual development.
- Auditors see structured, tamper-resistant compliance records that map directly to the controls they're testing. No more spreadsheets.
Early access is open
We're working with a small group of healthcare IT teams to refine the product. Early access is free — we're looking for teams who will help us get it exactly right.
If your team is fighting the AI-vs-compliance battle, we'd love to help.
Early access is free for healthcare IT teams. Tell us about your compliance challenge, and we'll show you how Verdict solves it.
Request early access →