Evidence is a query, not a quarter.
Article 12 asks for automatic, lifetime event records. Article 19 asks you to keep them six months. This runtime already signs receipts for Agent API, public /invoke, and standard MCP tools/call executions; authorization decision — compliance is querying records you already have, not instrumenting code you haven't written.
receipts for ai systems · explicit authority · no ambient trust
Commission guidance currently lists 2 December 2027 for certain stand-alone high-risk systems and 2 August 2028 for systems embedded in regulated products. Confirm your category and the law in force.
Four articles. Four primitives. Zero instrumentation.
asks · High-risk AI systems must technically allow automatic recording of events over their lifetime.
runtime · Agent API, public /invoke, and standard MCP tools/call executions seal Ed25519 receipts: caller, skill, input evidence, verified grants, outcome, and timing.
asks · Provider-controlled automatic logs are kept for a purpose-appropriate period of at least six months, unless other applicable law provides otherwise.
runtime · Retention policy floored at 180 days while the EU AI Act framework is active — enforced at write time and re-checked inside the purge path. Legal hold blocks deletion outright.
asks · Systems are designed so natural persons can effectively oversee them.
runtime · Platform-managed approval and decision workflows record who decided—auto, policy, or human. Those records remain separate from execution receipts unless explicitly correlated.
asks · Documentation is drawn up before market placement and kept current.
runtime · Agent card, version, image digest, risk tier, intended purpose, and oversight statement export as a per-system dossier inside the evidence pack.
One query across every decision your agents made.
Skill executions, authorization decisions, and administrative actions normalize into a single record shape. Filter by agent, outcome, kind, or date range. Open a record and the platform re-verifies its Ed25519 signature in front of you — proof, not a promise.
No second store to sync, no ETL to a compliance warehouse. The records the auditor reads are the records the runtime wrote.
See replay & receipts →{
"record_id": "rcpt_<id>",
"kind": "skill_execution",
"agent_name": "<agent>",
"actor": "user:<caller>",
"action": "skill:<skill>",
"outcome": "ok",
"occurred_at": "<iso-8601>",
"verifiable": true,
"signature_status": "valid",
"details": {
"grant_ids": ["gr_<id>"],
"tool_calls": 3,
"eval_score": null
}
}Field shape only — illustrative, not a real customer run. Records the platform sealed are served from the API and rendered at /replay.
The evidence pack answers the questionnaire.
A single JSON export: decision records, agent dossiers, signature verification results, and the control mapping inlined — an auditor who has never seen this platform can read it cold.
EU AI Act
Queryable decision records, 180-day floored retention, human-oversight attribution, and per-system documentation. The Commission's current timeline distinguishes December 2027 stand-alone and August 2028 product-embedded high-risk systems.
NIST AI RMF 1.1
Org policy with named owners, agent inventory with risk tiers, separately recorded eval scores, scoped authority and budget caps — mapped function by function in the export.
ISO/IEC 42001
The evidence pack answers the AI-management-system questionnaire your buyer's procurement team sends: traceability, operational control, performance evaluation.
Governed agent execution creates the evidence layer.
Run
Supported delegation and workspace operations can execute under scoped, signed grants. Agent-local filesystem, network, database, and configured-secret access use separate controls.
Record
The control plane seals authenticated Agent API calls and trusted public /invoke or standard MCP tools/call executions into signed receipts. Zero agent-code instrumentation.
Query
Decision records are one API: filter by agent, outcome, kind, date range. Signature re-verified when you open a record.
Export
One click produces a self-describing evidence pack — records, agent dossiers, control mapping — ready for auditors and procurement.
Verify the obligation and the current timeline.
Regulation (EU) 2024/1689 ↗
Official text: Article 12 record-keeping, Article 19 retention, and the enacted application provisions.
European Commission AI Act overview ↗
Current Commission overview, including the implementation timeline after the May 2026 political agreement.
High-risk system guidance ↗
Classification guidance and the current December 2027 / August 2028 high-risk dates.
Last checked 11 July 2026 · technical controls are not legal advice
Deploy governed. Query the evidence.
Retention windows only protect the records that exist. Every day agents run ungoverned is a day of evidence you can't produce later.