The EU AI Act in practice: what does the duty to provide evidence look like in code (Ed25519 instead of Word documents)?

The misunderstanding

Many EU AI Act compliance projects end in a folder: risk assessment, process description, role matrix. That is necessary – but it does not answer the question an auditor eventually asks: what did the system do with this case on this day, and how do you know?

For high-risk systems, Art. 12 requires automatic logging over the whole lifetime, Art. 14 human oversight, Art. 26 log retention by the deployer. A log the deployer can change at any time is weak evidence for any of that.

The decision: evidence as artefacts

ATF creates evidence at execution time and seals it with one asymmetric identity (Ed25519, EVIDENCE_SIGNING_KEY). The public key is served as JWKS at /.well-known/atf-evidence-jwks.json. Whoever verifies needs no secret and no access to the platform.

Duty	Artefact in ATF
Art. 12 – record-keeping	Hash-chained audit log with signed anchors; debug trace with flow_version and flow_digest
Art. 13 – transparency	Explain card per answer: model, sources, policy decisions, routing
Art. 14 – human oversight	Approval decisions including timeouts as audit entries, fail-closed
Art. 15 – robustness	Eval history, red-team posture score, production gates
Art. 50 – marking	AI_DISCLOSURE=header|field as a machine-readable marker
GDPR Art. 17	Signed erasure receipt across all services

What it looks like in code

An evidence bundle binds an execution to its inputs (already PII-masked), policy decisions, sources and answer. Content hash and signature sit in the envelope:

{
  "bundle": { "version": 1, "executionId": "8e8b46df-…", "card": { "flowId": "refund-agent", "…": "…" } },
  "contentHash": "sha256:…",
  "algorithm": "ed25519",
  "kid": "e3bWHJM6PWuIanrPNdmBuUHHsJjr2WYsGRCNbghINNE",
  "signature": "…"
}

Verification happens offline, with a standalone tool:

$ atf-verify --bundle evidence-bundle.json --jwks https://atf.example/.well-known/atf-evidence-jwks.json
  algorithm:    ed25519
  content hash: VALID
  signature:    VALID
RESULT: VALID

The same tool verifies decision receipts (COSE_Sign1 with a Merkle inclusion proof against a signed tree head), erasure receipts, flow release receipts and audit exports including anchors. Exit code 0 means verified, 1 means tampering – machine-readable for your own audit pipelines.

Why Ed25519 and not HMAC

An HMAC-signed record can only be checked with the same secret that created it. Whoever can verify can therefore also forge. For an external auditor that is worthless. Ed25519 separates the two: the operator signs, everyone else verifies. ATF branches strictly on the declared algorithm – there is no silent fallback to HMAC.

What ATF does not do for you

Your role (provider or deployer), the high-risk classification, the risk assessment, AI literacy training under Art. 4 and informing affected persons remain your job. ATF provides templates (DPIA, record of processing), an article mapping and a generated dossier – and the evidence all of that rests on.

The difference from the folder: this evidence is created automatically, at every execution, and it cannot be prettified afterwards.