What makes AI compliance evidence 'machine-verifiable'?

It can be checked by a machine, by anyone, without trusting the party that produced it. Each record carries a SHA-256 fingerprint of the artifact and an Ed25519 signature over a canonical payload. A verifier recomputes the hash, compares it, and validates the signature against a public key published at /.well-known/signing-keys.json. A screenshot or a database row cannot be checked this way.

Does a CertifiedData record prove my AI system is compliant?

No. It proves what happened — which artifact existed, when, issued by whom, and that it has not been altered since. That is evidence you can hand to an auditor. Whether a system meets a regulation is a determination made by your compliance function or a conformity-assessment body, not by CertifiedData.

AI governance evidence

Machine-verifiable AI compliance

Most AI “compliance evidence” is a screenshot, a PDF, or a row in your own database — none of which an auditor can check without trusting you. Machine-verifiable evidence is different: it can be verified by anyone, offline, against a published public key. CertifiedData binds your datasets, decisions, and artifacts to Ed25519-signed, SHA-256-fingerprinted records that a regulator or customer verifies themselves.

Verify a certificate How verification works

The three checks — done by the verifier, not by us

“Verifiable” means the trust does not depend on our word. Any party runs the same three steps and gets a deterministic pass or fail:

1
Recompute the fingerprint
Hash the artifact bytes with SHA-256. Identical bytes always produce the identical fingerprint.
2
Compare to the record
Match that fingerprint against the one recorded in the signed certificate. Any change to the artifact — one byte — breaks the match.
3
Validate the signature
Verify the Ed25519 signature over the RFC 8785-canonicalized payload using the issuer's public key from /.well-known/signing-keys.json. A revoked key fails.

What it proves

Which artifact existed, and its exact content (fingerprint).
When it was certified, and by which issuer key.
That it has not been altered since certification.
That the record itself is genuine and not forged (signature).

What it does not prove

That a dataset is accurate, unbiased, or fit for a purpose.
Differential privacy — unless a DP pipeline was actually run and recorded.
That your AI system is “compliant” with any regulation.
Regulatory approval — CertifiedData is not an accredited or notified body.

Where machine-verifiable evidence fits

Frameworks increasingly ask you to demonstrate what your AI did. Verifiable records are the evidence layer under that demonstration — they support your reviews; they do not, by themselves, constitute compliance.

EU AI Act

Article 12 record-keeping and Article 10 data-governance reviews expect durable, tamper-evident logs of what happened.

EU AI Act →

NIST AI RMF

Measure and Manage functions call for documented, traceable evidence across the AI lifecycle.

AI governance →

ISO/IEC 42001

An AI management system needs auditable records of controls and decisions over time.

Decision Ledger →

CertifiedData provides verifiable evidence to support these reviews. It does not certify regulatory compliance, and it is not an accredited or notified body.

The verifiable AI workflow

Generate → Certify → Verify → Log decisions — each step produces evidence the next can check.

Certify a dataset Verify an artifact Log AI decisions Public transparency log

Dataset Certification · Tamper-evident provenance

Produce evidence an auditor can actually check.

SHA-256 fingerprint · Ed25519 signature · publicly verifiable — no account required to verify.

1
Upload or point to your dataset
Drag-and-drop or API. Supports CSV, JSON, Parquet.
2
Receive a signed certificate
SHA-256 hash + Ed25519 signature. Immutable record.
3
Share a verifiable proof link
Anyone can verify at /verify — no account required.

Certify a dataset →Verify a certificate Browse the marketplace