Compliance Bundles

Auditors want evidence. They do not want access to your dashboard, your API keys, or a live demo. They want a file they can open, verify independently, and attach to their report. Every compliance review eventually boils down to the same request: show me the proof, and let me check it myself.

The Asqav SDK now supports compliance bundle exports. One call packages your agent's signed audit trail into a single, self-contained JSON file that an auditor can verify without touching your infrastructure.

import asqav

# Collect signatures from your agent session
signatures = asqav.get_session_signatures("ses_xyz789")

# Export a compliance bundle for the EU AI Act
bundle = asqav.export_bundle(signatures, "eu_ai_act")
bundle.to_file("bundle_eu_ai_act.json")

# The file contains the receipts, the framework mapping,
# and a Merkle root over the full set

What goes into a bundle

A compliance bundle is not a log dump. It is a structured evidence package. Each bundle includes the full set of signed receipts, the metadata of the framework it targets, per-receipt hashes, and a Merkle root computed over every receipt in the set. The Merkle root means the auditor can verify that no receipts were added, removed, or modified after the bundle was generated.

When you pass "eu_ai_act", the bundle carries the EU AI Act mapping covering Articles 12 and 26 record-keeping and human oversight.

Nine regulatory regimes supported

You can generate bundles for ten framework mappings across nine regulatory regimes today:

EU AI Act (eu_ai_act): Articles 12 and 26 record-keeping and human oversight for high-risk AI systems.

DORA (dora): Digital Operational Resilience Act Article 17 evidence for financial entities.

NYDFS Part 500 (nydfs_500): 23 NYCRR Part 500 audit trail and incident notice.

Colorado AI Act (colorado_ai): SB 24-205 high-risk AI system deployer obligations.

Texas TRAIGA (texas_traiga): HB 149 intent-based liability and prohibited-use vocabulary.

NIST AI RMF (nist_ai_rmf): the voluntary GOVERN, MAP, MEASURE, MANAGE framework.

CIRCIA (circia): covered cyber incident reporting for critical infrastructure.

HIPAA Security Rule (hipaa_security): 45 CFR 164.312(b) audit controls.

SEC 17a-4 (sec_17a4a, sec_17a4b): broker-dealer 6-year and 3-year retention.

# Generate bundles for multiple frameworks at once
for framework in ["eu_ai_act", "dora", "hipaa_security"]:
    bundle = asqav.export_bundle(signatures, framework)
    print(f"{framework}: {bundle.receipt_count} receipts, root={bundle.merkle_root[:16]}...")

Verification without your keys

The auditor receives a JSON file. They install the SDK and run one command:

asqav replay --bundle bundle_eu_ai_act.json
# Reconstructs the timeline offline and reports
# Chain integrity: PASS

The same works in Python with asqav.replay_from_bundle(bundle), which returns a timeline whose chain_integrity flag tells the auditor whether the receipt chain holds. No API keys, no account access, no live connection to your Asqav instance. The bundle carries its own verification data, including the per-receipt hashes. If a single receipt was tampered with, the hash check fails and the auditor knows exactly which record is compromised.

Install or upgrade:

pip install --upgrade asqav

Full docs at asqav.com/docs. Source on GitHub. If something doesn't work the way you expect, open an issue.