Open verification infrastructure for EU AI Act Article 12 evidence

A drop-in tamper-evident audit log + regulator-runnable verifier for any high-risk AI system. Public cryptographic commitments. Private decision payloads. GDPR-compatible by construction.

View on GitHub Watch the 27-second demo
EU AI Act Article 12 enforceable from 2 August 2026 · €15M / 3% global turnover penalties
27-second screencast: Attestly demo running. Initialise a ledger, append 50 synthetic credit decisions, publish a signed checkpoint, export a regulator evidence bundle, verify it (PASS), then watch the operator tamper with the database — and the verifier catch it (FAIL TAMPERED, with hash mismatch reported).

Real cryptographic tamper detection, end-to-end, in 27 seconds.

Three primitives. One drop-in library.

Apache-2.0 in perpetuity. No commercial dependency. No vendor lock-in.

01 · LEDGER

Append-only signed events

Every AI decision is canonically hashed, signed with the system's Ed25519 key, and appended to a hash-chained ledger. Database triggers enforce append-only at the SQL layer.

02 · COMMITMENT

Public Signed Tree Heads

Merkle roots are published to a transparency log as signed commitments — never the decision payloads themselves. The architectural pattern is Certificate Transparency.

03 · VERIFIER

Regulator-runnable, no operator trust

A standalone CLI + browser-WASM verifier. A regulator drops an exported evidence bundle into the tool — and mathematically detects any post-publication tampering.

Article 12 mandates logging. It does not mandate that the logs can be trusted.

From 2 August 2026, every high-risk AI system in the EU (credit scoring, hiring, biometric, employment, essential services, law enforcement, migration, justice — Annex III) must maintain automatic logs over its lifecycle. The regulatory framework has no technical assurance layer for evidence integrity.

Attestly is that layer, published as open digital base infrastructure — not a SaaS product, not a vendor stack.

Five minutes to a working demo

Rust 1.85+ required. SQLite bundled. No other dependencies.

# Clone and build
git clone https://github.com/attestly/attestly
cd attestly
cargo build --release

# Run the end-to-end demo (bash)
bash examples/demo.sh

# …or PowerShell on Windows
pwsh examples/demo.ps1

# …or render the screencast yourself
python examples/render_demo.py