EU AI Act Audit

Generate an audit pack for EU AI Act Art 12 (automatic logging, for high-risk AI providers) and Art 26 (deployer obligations). Output is a PDF bound to an RFC 3161 timestamp, qualified on Enterprise when the external witness is reachable.

Tier gating

The audit pack endpoint shares the Compliance Reports feature gate, so it is available on every plan, including Free.

Endpoint

POST /agents/{id}/compliance/eu-ai-act generates the per-agent audit pack. The agent must belong to the caller's organization.

Request body (all optional):

from -- ISO 8601 timestamp lower bound for evidence collection
to -- ISO 8601 timestamp upper bound for evidence collection
agent_filter -- restrict to a sub-set of receipt action types

Response:

Default: binary PDF stream, Content-Type: application/pdf
With Accept: application/json (or ?format=json): JSON summary with evidence record count, article mapping, and the legal disclaimer

bash

curl -X POST https://api.asqav.com/api/v1/agents/agt_abc123/compliance/eu-ai-act \
  -H "X-API-Key: sk_live_..." \
  -H "Accept: application/pdf" \
  -o eu-ai-act-audit.pdf

What the pack contains

The audit pack stitches three regulatory sources into a single PDF, with all evidence cryptographically bound to the receipt chain.

EU AI Act Art 12 logging evidence

Agent actions (signed receipts with action type, timestamp, agent identity)
Bilateral counterparty receipts (sender + recipient signatures over the same digest)
Policy decisions (allow / deny outcomes from the policy engine, with rule id)
Approval chain entries (HITL and multi-party approvals attached to high-risk actions)

EU AI Act Art 26 deployer obligations

Human oversight records (operator identity on each approval and override)
Risk-management entries (incident records, quarantine and resolution events)
6-month retention attestation referencing ComplianceReport.expires_at

DORA Art 12(2)(d) integrity binding

Every receipt hash referenced in the pack is included with its DORA Art 12(2)(d) integrity controls: ML-DSA-65 signature, RFC 3161 qualified timestamp (Enterprise, when the external witness is reachable), and the OpenTimestamps Bitcoin anchor commitment for daily-batch verification.

Verifying the pack offline

The PDF embeds a manifest of receipt digests. A regulator with the agent's public key can re-derive the hash chain, verify ML-DSA signatures with any FIPS 204 verifier, and confirm the RFC 3161 timestamp against the TSA certificate without contacting Asqav.

Article mapping

Article	Asqav primitive
EU AI Act Art 12 (Record-keeping)	ML-DSA-65 signed receipts, HITL approvals, governance attestation
EU AI Act Art 26 (Deployer obligations, 6-month retention)	Audit log entries with RFC 3161 timestamps. Configurable retention via `ComplianceReport.expires_at`
DORA Art 12(2)(d) (Integrity of reports)	Chain-hash receipt linkage. Bilateral counterparty fields

For the standalone Article 12 and Article 14 templates without the bundled per-agent pack, see Compliance Reports.

Export and resolve audit packs from the terminal with asqav audit-pack.