When a regulator calls, you have the receipts.

Every policy edit, evidence upload, agent run, and report generation writes a row into your organisation's audit chain. Each row's row_hash = SHA-256 of its content + the previous row's hash. Re-walking the chain proves no row was added, edited, or removed retroactively.

• Download anytime as CSV (regulator-friendly) or NDJSON (machine-friendly). Headers carry X-Audit-Chain-Verified so the consumer can spot a broken chain without re-walking it.
• Auditor-recognisable format — the same hash-linked structure used in blockchain ledgers and the AWS QLDB pattern.
• Tamper-proof retention — even an admin with DB access can't silently edit history without breaking the chain.

Regulators don't accept "we'll get back to you" any more. The regulator-response agent reads the original request, pulls the relevant evidence and governance artifacts out of your pathway, and drafts a formal reply your General Counsel can sign — typically in under a day.

• Cites your audit-chain row hashes directly, so the regulator can independently verify any quoted fact.
• Speaks the regulator's language for each pack (eu_ai_act, dora_ai, sr_26_2, kenya_dpa, tanzania_dpa).
• Metered usage — pay per drafted response, not per seat. Average EU AI Act response: ~$2.40 in LLM cost; we cap each run at $0.50 unless you raise it.

Compliance posture decays. Vendor risk profiles change, models drift, DPIAs need refreshing. A weekly Celery beat task re-runs every active connector probe, identifies pathway steps whose newest evidence is older than the staleness threshold (default 14 days), and surfaces a compliance_report_ready funnel event tagged continuous_monitoring.gap_opened.

• In-app + email notifications to the org owner for each gap.
• Backoffice visibility — Finance / Ops sees the gap count per org alongside cost data, before the customer's next audit.
• Configurable cadence — defaults to Mondays 06:00 EAT (matches platform timezone); tunable per-org via Celery Beat admin.