Blog
Runtime-AI compliance, in detail.
Deep technical notes on the regulations that apply to AI decisions in regulated products. Each post is one buyer question answered with one citation-ready source. Written by engineers who built the substrate; reviewed for accuracy against the actual article text rather than the marketing summary of it.
EU AI Act Annex III audit-log requirements — what Article 12 actually demands
Annex III lists eight high-risk AI categories. Article 12 requires every high-risk system to technically allow automatic recording of events. What does that mean in practice for an LLM-in-the-loop feature, and what does the audit log have to contain?
Read →
GDPR Article 22 — automated decisions, meaningful human oversight, and what the audit log proves
Article 22 GDPR forbids decisions based solely on automated processing in certain cases. What counts as 'solely'? What does 'meaningful human oversight' mean after the Schufa CJEU ruling? How do you prove either in an audit?
Read →
PSD3 fraud-AI explainability — per-decision reproducibility for SCA exemptions
PSD3 (the proposed successor to PSD2) tightens the explainability bar for AI-driven fraud detection and SCA exemptions. What does 'reproducible per decision' mean in the proposed Articles 87 and 88, and what evidence holds up under audit?
Read →
DORA Article 17 and 18 — incident classification when the AI subsystem fails
DORA mandates that financial entities classify ICT-related incidents by impact. When the failing component is an LLM that produced a bad decision, how do you map that into DORA's classification scheme — and what evidence does the regulator want?
Read →
How to verify an L12 receipt chain — a regulator's walkthrough
Step by step: download the verifier, download a chain, run it, read the output. What every section means. What tampering looks like. What exit codes 0/1/2 actually tell you about the operator's audit trail.
Read →
Why traditional logging (Datadog, Splunk, CloudWatch) is not an audit log
Logs you can edit are not evidence. The difference between application logs and regulator-grade audit logs is hash chaining + per-entry signing + independent verifiability. Why this matters when the regulator asks 'how do you know this log wasn't backdated?'
Read →