CertifiedData.io
AI Compliance · Audit Trails

AI Compliance Logging

Compliance logging for AI systems means producing cryptographically verifiable records of what data was used, what decisions were made, and who certified the artifacts — before an auditor asks. This page explains the compliance logging architecture required by major AI governance frameworks.

CertifiedData's Decision Ledger turns compliance logging from a documentation exercise into a cryptographic evidence trail. Each decision record is Ed25519-signed, hash-chained to the previous entry, and independently verifiable — satisfying regulators without requiring platform access.

Two Layers of AI Compliance Logging

Layer 1 — Training Data Evidence

Compliance logs must capture the provenance of every training dataset: its origin, generation method, fingerprint, and certification status. A CertifiedData certificate serves as the primary training data evidence record — binding the exact dataset bytes (via SHA-256 hash) to a timestamped, Ed25519-signed artifact that any third party can independently verify.

Layer 2 — Decision Evidence

Beyond training data, AI compliance logging must capture operational decisions as evidence — not just what the system did, but cryptographic proof that each decision is linked to the certified dataset that informed it. The Decision Ledger provides an append-only, Ed25519-signed chain of decision records that regulators and auditors can verify without platform access.

Regulatory Framework Mapping

EU AI Act Art. 12
Automatic logging of high-risk AI system events
Transparency log + certificate issuance records
EU AI Act Art. 19
10-year retention of training data documentation
Immutable certificate store with SHA-256 fingerprints
NIST AI RMF Govern 1.7
Documented AI lifecycle governance policies
Certification artifacts as policy evidence
ISO 42001 §8.4
Training data quality management records
Certified synthetic datasets with provenance records
GDPR Art. 30
Records of processing activities
Synthetic data certificates proving no real-world records used

What a Compliance Log Entry Must Include

{
  "certification_id": "uuid",
  "timestamp": "2026-03-19T00:00:00Z",
  "issuer": "Certified Data LLC",
  "dataset_hash": "sha256:a7f3...",
  "algorithm": "CTGAN",
  "rows": 100000,
  "columns": 25,
  "schema_version": "certifieddata.cert.v1",
  "signature": "ed25519:base64url...",
  "verify_url": "https://certifieddata.io/verify/uuid"
}

Each CertifiedData certification artifact serves as a compliance log entry. The dataset_hash is the fingerprint regulators will request. The signature is independently verifiable using the public key at /.well-known/signing-keys.json.

Decision Lineage Logging

AI compliance logging extends beyond datasets to operational decisions. CertifiedData's decision lineage layer records how certified artifacts were used by AI systems — linking training data certificates to model outputs via a tamper-evident, Ed25519-signed public decision log.

Decision records include the actor (agent or system), the decision label, the confidence score, and a reference to the certificate ID of the certified dataset that informed the decision. This creates an unbroken chain from raw training data to deployed AI output.

EU AI Act Article 12 · Enforcement begins August 2026

Start logging AI decisions today.

If your AI system makes decisions, you will need an audit log that holds up in front of a regulator. CertifiedData gives you a cryptographically signed, hash-chained record. Free tier includes 1,000 records/month — no credit card.

  1. 1
    Create a free account
    No credit card. Two minutes.
  2. 2
    Get your API key
    One key. Scoped, revocable, rotateable.
  3. 3
    Send your first decision
    One curl. Appears in the public ledger within seconds.

Related Evidence

AI Compliance Logging | CertifiedData