The EU AI Act deadline did not move.
Your evidence layer needs to.

August 2026 is not a suggestion.

EU AI Act Article 12 requires high-risk AI systems to record decisions, ensure traceability, and support auditability across their lifecycle. Enforcement begins August 2026.

Most systems have logs. Those logs are mutable, internal-only, and not independently verifiable. A regulator will treat a mutable log like a bank statement you typed yourself.

What an auditor will actually ask

1. 1Show every decision your AI made about this subject.
2. 2Show which model version produced each decision.
3. 3Show which dataset trained that model.
4. 4Prove none of those records have been modified since they were written.

Most organizations can answer 1–2. Almost none can prove 4 without a backup and a prayer.

From documentation to evidence

Article 12 pressure changes what audit trails need to prove.

Policies describe controls. Spreadsheets track responsibility. Internal logs show system activity. But high-risk AI systems need records that can survive review after the fact.

Decision Ledger turns AI decision events into tamper-evident records that can be independently verified through canonical payloads, cryptographic hashes, digital signatures, and hash-linked logs.

90-day evidence sprint

What high-risk AI teams should start now.

The deadline pressure is not only legal. It is operational. Teams need to know which systems are in scope, who owns them, and what evidence will exist when the system is reviewed.

1. 1Inventory Annex III candidate systems
2. 2Assign business, legal, and technical owners
3. 3Identify high-risk decision workflows
4. 4Map decisions to datasets, models, policy versions, and artifacts
5. 5Define required decision record fields
6. 6Start signing records before audit pressure arrives
7. 7Test verification outside the dashboard
8. 8Connect decision lineage to artifact certification where possible

Live proof — not a marketing badge

This is the most recent record in the public decision ledger. Signed, chained, and published the same way your decisions will be. Anyone can re-verify it independently.

Logging vs. evidence

This is not observability. This is evidence.

How it works

1. 1
   Your AI system makes a decision.

   Inference, approval, routing, pricing, denial — any action that needs a record.
2. 2
   Your service calls POST /v1/decisions.

   One HTTP request with actor, entity, label, selected option, and any cert or model reference.
3. 3
   We canonicalize, hash, and sign.

   RFC 8785 JCS canonical JSON, SHA-256, Ed25519 — deterministic and independently reproducible.
4. 4
   Dual-chain write.

   Internal record keeps full context. Sterilized public projection goes into a separately chained public log.
5. 5
   Hourly sealed checkpoints.

   Signed checkpoints seal the public chain. Any tampering breaks the seal — verifiably, forever.
6. 6
   Anyone can verify.

   GET /api/decision-log/:id/verify re-computes the hash and checks the signature against the published signing key.

Log your first decision in minutes

curl -X POST https://certifieddata.io/v1/decisions \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "actor": { "type": "system", "id": "loan-engine-v3" },
    "decision": {
      "label": "loan_decision",
      "selectedOption": "approved"
    },
    "explanation": {
      "reasonCodes": ["credit_score_above_threshold", "dti_within_policy"],
      "rationaleSummary": "Applicant meets underwriting criteria."
    },
    "publicMode": true
  }'

Who this is for