Qualified audit trails
for AI Act Article 12
TrustBeat provides eIDAS-qualified tamper-proof anchoring for every AI decision. Bind model input, output, and decision metadata to a single qualified proof — privacy-safe, independently verifiable, legally presumed accurate under EU law.
AI Act Obligations
Which AI Act articles does this cover?
High-risk AI systems must automatically log events throughout their lifetime
The challenge
Proving that a specific model version made a specific decision at a specific time, without retroactive alteration of logs.
TrustBeat solution
Anchor SHA-256 hashes of model input and output together with decision metadata to a qualified eIDAS timestamp — immutable evidence of the decision state at time T.
High-risk AI systems must be designed to enable users to interpret outputs
The challenge
Demonstrating to regulators that decision logs accurately reflect the model's actual operation, not a post-hoc reconstruction.
TrustBeat solution
The combined hash binds model ID, system name, decision type, and time envelope to the proof. Any retroactive change to metadata is cryptographically detectable.
Appropriate human oversight measures must be implemented
The challenge
Evidencing that human oversight was present (or absent) for each high-risk decision at the time it was made.
TrustBeat solution
The human_oversight flag is bound into the combined hash. Its value at the time of anchoring is sealed — it cannot be changed after the fact without invalidating the proof.
Technical flow
How AI Decision Anchoring works
The combined hash binds input, output, and metadata deterministically. Any tampering — including retroactive metadata edits or post-hoc log reconstruction — is cryptographically detectable.
Hash input and output locally
Your application computes SHA-256 of the model input data and the model output/decision. Neither is ever sent to TrustBeat — only the 64-character hex digests.
input_hash = SHA-256(model_input_bytes) output_hash = SHA-256(model_output_bytes)
Submit to TrustBeat
POST both hashes plus decision metadata (model ID, system name, risk category, human oversight flag, inference time window) to /v1/ai/decisions/anchor.
POST /v1/ai/decisions/anchor
{
"input_hash": "a665a4...",
"output_hash": "b94f6f...",
"metadata": {
"model_id": "claude-3-5-sonnet",
"risk_category": "employment",
"human_oversight": true
}
}Combined hash is anchored
TrustBeat computes SHA-256(input_hash ‖ output_hash ‖ JCS(metadata)) and queues it for the next 10-minute Merkle batch. Both hashes and all metadata are cryptographically bound together.
combined = SHA-256( input_hash_bytes || output_hash_bytes || UTF-8(JCS(metadata)) )
Retrieve qualified proof
After batching, retrieve an inclusion proof linking the combined hash to an eIDAS-qualified timestamp from an EU Trusted List QTSP. The proof bundle is self-contained and independently verifiable.
GET /v1/ai/decisions/{id}/export
→ {
"verification_status": "VERIFIED",
"anchored_at": "2026-04-15T10:10:00Z",
"token": "MIID..."
}Why TrustBeat for AI Act compliance
Decision integrity
Not just 'this model ran' — 'this model produced this output from this input at this exact time, with human oversight in place.'
Privacy-safe by design
Only SHA-256 hashes are sent to TrustBeat. Raw model inputs and outputs never leave your system. Fully GDPR-compatible.
30-year archive chain
Archive stamping runs automatically before each TSA certificate expires. Evidence remains valid for 30+ years under eIDAS.
Portable proof bundle
Export a self-contained JSON bundle per decision — includes Merkle proof, RFC 3161 token, and all LTV archive stamps. Independently verifiable offline.
Annex III — High-risk AI systems
If your AI system falls into any of these categories, Article 12 record keeping obligations apply from August 2026.
Legal basis
EU AI Act (EU) 2024/1689 — Article 12
High-risk AI systems shall be designed to automatically record events (logs) throughout their lifetime. Record-keeping obligations apply from August 2026. TrustBeat provides the qualified cryptographic evidence layer proving these records existed and were unmodified at the time of creation.
eIDAS Regulation (EU) 910/2014 — Article 42
A qualified electronic timestamp carries the legal presumption of accuracy of the date and time it indicates and of the integrity of the data to which it relates. Issued by an eIDAS-qualified QTSP on the EU Trusted List. The presumption is reversed — your counterpart must prove the timestamp invalid.
Simple, flat pricing
One plan covers up to 50,000 AI decision anchors per month. No per-decision metering.
- 14-day free trial — no credit card
- 50,000 AI decision anchors / month included
- Standalone or alongside other TrustBeat products
- Cancel any time
Ready to anchor your first document?
Start free. No credit card required. Your first 100 hashes are on us.
eIDAS Regulation (EU) No 910/2014 · Art. 41 legal presumption · EU Trusted List QTSP