DARKMATTER
Try it free
Regulatory readiness

EU AI Act Article 12.
Automatic logging, without trusting your own logs.

High-risk AI system providers must produce automatic, traceable event records. DarkMatter is a proof engine for AI agents, the record is sealed at the moment of action and verifiable by anyone, including regulators, without your involvement.

Applies from 2 December 2027 (deferred from 2 August 2026 by the Digital Omnibus).
What Article 12 requires

The text in plain language

Article 12 of the EU AI Act requires providers of high-risk AI systems to ensure their systems technically allow for the automatic recording of events over the lifetime of the system. The events recorded must be sufficient to:

  • Identify situations that may result in the AI system presenting a risk under Article 79(1), or in a substantial modification of the system.
  • Facilitate post-market monitoring as referenced in Article 72.
  • Monitor the operation of high-risk AI systems referred to in Article 26(5).

"Traceability" is the operative word. The European Commission's interpretive guidance treats it as a property of the record itself, not just a claim about how the record was made.

Not legal advice. This page describes how DarkMatter's technical properties align with Article 12's logging and traceability requirements. Compliance with the EU AI Act is determined by your legal counsel and notified body, not by us.

How DarkMatter maps to the requirements

What you get, requirement by requirement

Article 12 requires
Automatic recording of events sufficient to identify risk situations and substantial modifications.
DarkMatter provides
A single line of code at decision time emits a signed, hash-chained record. Every agent action, decision, override, and consent event is captured automatically as a Context Passport, including those that turn out to be the risk situation later.
Article 12 requires
Records sufficient to facilitate post-market monitoring under Article 72.
DarkMatter provides
A queryable, replayable chain of every decision the agent made, with parent linkage. Reconstruction of any incident is byte-exact, not approximate.
Article 12 requires
Traceability sufficient to monitor operation under Article 26(5).
DarkMatter provides
Every record commits to the hash of the one before it and to a Merkle log, and an export bundle carries the inclusion proofs with it. Tampering at any point breaks the chain, and a regulator can detect it from the bundle alone using the open-source verifier, without our involvement.
Article 12 implies
The record must be credible to the regulator, not just to you.
DarkMatter's structural property
Records are hashed at the moment of action and chained, so any later change breaks verification for every record that follows. At L3 they are also signed with a key only you hold, before they reach us, so we could not have produced them. An export you already hold verifies offline against the open-source verifier, with no call back to us.
Why a self-hosted Postgres log will not satisfy Article 12

The traceability problem

A standard Postgres audit table records what your application says happened. The regulator's question is whether that record can be trusted. If the record lives inside the system being audited, the answer is no, that's a self-report, not an audit trail.

Article 12 does not say "log events." It says "automatic recording of events" with traceability. The European Commission and notified bodies are interpreting "traceability" as a structural property: tamper-evidence, independence, and external verifiability. A row in your own database does not satisfy any of those.

DarkMatter's records are hashed at the moment of action, on your machine before transmission when you use an SDK, and signed with a key you hold at L3. The log root is signed on a ten-minute cycle. The verifier is open source. A regulator can take a single Context Passport, run the verifier offline, and confirm that the record has not been altered since the moment it was created. That is what "traceability" actually means.

Applies from 2 December 2027.
Set up takes 15 minutes.

One line of code at decision time, one open-source verifier, one export bundle that still verifies without us. Start free, no card required.

Start for free →