SZL HOLDINGS · HONEST BY DESIGN

EU AI Act Article 12: record-keeping that verifies, not just records.

Article 12 of Regulation (EU) 2024/1689 requires high-risk AI systems to technically allow the automatic recording of events over the lifetime of the system. Those obligations reached full application for Annex III high-risk systems on 2 August 2026, and Article 26(6) separately requires deployers to retain the logs under their control for at least six months. GovernedAction/v1 — the open receipt format behind every a11oy gated action — was built to be exactly that record: automatic, tamper-evident, and verifiable offline.

The deadline is not upcoming. It passed.

MEASURED 2 August 2026 — full application of the high-risk obligations (Articles 9–17 for providers, Article 26 for deployers) under Regulation (EU) 2024/1689. Automatic event logging under Article 12 is now enforceable law for in-scope systems, and deployers carry the mirror duty to keep those logs for at least six months. Maximum penalties under the Act reach €35M or 7% of global turnover for the most serious infringements.

Every required audit-trail field, mapped to a receipt field

2026 audit-trail checklists for SOX, HIPAA, the EU AI Act, FFIEC, and PCI DSS v4.0 converge on the same twelve fields. Each maps to a field a GovernedAction/v1 receipt already carries:

Required audit-trail fieldGovernedAction/v1 receipt binding
Timestamp (NTP-synced, UTC)issued_at — UTC issuance time inside the signed envelope
Unique decision IDaction_id — unique per gated action
Authenticated human identityapprover — approval tier and identity, where a human gate fired
AI system identity and versionsubject digest + source revision binding
Model identity and versionModel/provider provenance recorded per response
Inputs received, with source attributionEvidence references bound into the payload digest
Policy, rule, or prompt invokedpolicy_gates — the gates traversed, by name and version
Reasoning in human-readable languageBounded loop trace attached to the receipt
Output producedOutput digest inside the signed subject
Action taken downstreamadmission result — admitted, held, or denied, with the executed effect
Human review / approval identityApproval record at the caller's tier
Tamper-evident integrity proofDSSE envelope, ECDSA P-256 signature, hash-chained ledger — alter one byte and offline verification fails

Prove it without talking to us

Offline verification, no server in the trust path

Take any receipt to /verify. The check runs entirely in your browser against the published keys. Tamper a byte and watch it fail. No SZL server decides anything — that is the difference between a governance dashboard and governance proof.

Adversarial test suite

The GovernedAction/v1 format ships with a public adversarial suite — 64 held proof-of-concept attacks against the receipt claim — plus PASS/FAIL-labeled conformance vectors so you can test your own verifier against ours.

Honest boundaries

Start

The 30-day Governed Evidence Pilot wires one of your agent workflows end to end: policy gates on every action, signed hash-chained receipts, ten controls mapped to ISO/IEC 42001, the EU AI Act, and NIST AI RMF, an auditor export bundle, and an external adversarial review — fixed scope, fixed price, measurable acceptance in writing up front.