Radoslav Y. Radoslavov, Lead Architect, Patent Pending (ZKAP)
The regulatory moment
In June 2026 the Council gave its final approval to the Digital Omnibus on AI. The obligations for high-risk AI systems, originally applicable from 2 August 2026, have been deferred. Standalone high-risk systems under Annex III now face a deadline of 2 December 2027, while systems embedded in regulated products under Annex I move to 2 August 2028. The transparency obligations of Article 50 remain applicable on schedule from 2 August 2026, and the deferred regime is now coupled to a mandatory pre-market registration mechanism administered through the AI Office.
The stated rationale deserves close reading. The deferral was not granted because the obligations were found excessive, nor because the risks they address were reassessed downward. It was granted because the instruments required to demonstrate compliance do not yet exist. Harmonised standards are not finalised, notified bodies are not ready, and most fundamentally there is no accepted methodology that allows a deployer to prove, continuously and per decision, that a high-risk system satisfies Articles 9 to 15.
This is not a postponement story. It is an institutional admission.
The Union has in effect formally recorded that the conformity assessment problem for high-risk AI is unsolved with available means. The clock was not stopped. It was structured, with registration first, obligations later, and a defined window in between. The question is what that window is for.
Why the problem could not be solved in time
I have argued in previous contributions to this community, in April 2026, that the difficulty is structural rather than administrative. Meaningful assessment of a high-parametric model requires access to the model, its data, or its internals. Granting that access conflicts with trade-secret law under Directive 2016/943 and with the data-minimisation principle of Article 5 GDPR, and for frontier-class systems it may itself materialise the security risk the assessment is meant to verify. Self-attestation is precisely what Article 43 excludes for Annex III systems. And classical audit, applied to systems that change with every inference, produces at best a snapshot valid for a single output. That is the form of an audit without its function.
No quantity of guidance documents resolves this tension, because it is not a documentation problem. It is an architectural one. The supervisory instrument itself is missing, and the Digital Omnibus deferral is the legislative acknowledgement of exactly that.
The elimination. Five candidate approaches, four binding constraints
Any conformity assessment instrument for high-risk AI must simultaneously satisfy four constraints that follow directly from the legal texts rather than from anyone's preference.
The first constraint is continuity. Articles 9 to 15 require compliance of the system in operation, per decision, over its lifecycle, and not a certificate frozen at a point in time. The second is non-disclosure. The instrument must not require handing model internals, training data or personal data to a third party, for reasons grounded in Directive 2016/943, in Article 5 GDPR, and for frontier systems in the security argument itself. The third is independence. Article 43 excludes self-attestation for Annex III, so verification must not rest on provider-controlled trust assumptions. The fourth is scalability. Notified bodies must be able to process the volume the market will present, within the resources notified bodies actually have.
Now test every approach currently on the table against these four.
Direct inspection through privileged access fails continuity, because it yields a snapshot. It fails non-disclosure, because it requires disclosure by definition. It fails scalability, because it consumes months per system. For frontier-class models it additionally materialises the very risk it is supposed to assess.
Documentation-based CE marking and quality management review fails continuity and independence. It verifies that processes are described, not that any given inference obeyed them. It is precisely the institutional-trust architecture that Article 43 was written to exceed.
Self-attestation with logging fails independence by definition. The log is the provider's own artefact, alterable by the very party it is meant to constrain.
Trusted execution environments and secure enclaves improve non-disclosure but fail independence and continuity at the supervisory level. The attestation chain terminates in trust toward a hardware vendor, the constraint logic remains invisible to the verifier, and no per-decision legal predicate is proved. What is proved is only that some code ran unmodified.
Regulatory sandboxes and audit by sampling fail continuity structurally. Whatever is verified inside the sandbox or the sample says nothing mathematically binding about the decisions taken outside it.
One class remains, and that is cryptographic verification. It is an architecture in which every decision carries a proof, checkable by anyone against a signed rule set, disclosing nothing. It satisfies continuity because it works per inference. It satisfies non-disclosure because it is zero-knowledge by construction. It satisfies independence because verification runs against a public key with no provider trust anywhere in the chain. And it satisfies scalability because verification completes in milliseconds at logarithmic cost.
This is not an advertisement. It is an elimination. If a fifth path exists that satisfies all four constraints, this community is the right place to name it. Until one is named, the question is not whether a cryptographic audit layer should exist, but whose implementation, standardised how, and piloted where.
A solution already on file
A cryptographic audit layer resolves the tension by changing the question, from show us the system to prove that this decision satisfied the signed rule set.
The Zero-Knowledge Audit Protocol, ZKAP, is such a layer. Its architecture is fully specified in patent applications BG/P/2026/114317, covering the hardware variant and filed on 30 March 2026, and BG/P/2026/114328 with filing receipt PTBG202600000316742, covering the software variant and filed on 12 April 2026. International filings before the EPO, the UKIPO and under the PCT are in preparation within the Paris Convention priority window. As described in my earlier posts, the protocol rests on four commitments. Rules are formalised and signed by an authorised body. Enforcement happens at inference, either in a strict configuration where no output is released without a verifying proof, or in a monitoring configuration where the output is released while a pre-commitment record is written to an append-only chain, so that any deviation remains permanently and irreversibly visible. External verification takes milliseconds and uses only the authorised body's public key. And every proof is chained into a tamper-evident structure anchored to a public transparency log.
The properties of this architecture map directly onto the gap the Omnibus has now formalised. It delivers continuous per-decision conformity rather than periodic snapshots, which is what Articles 9 to 15 substantively require. It discloses no model weights, no training data and no personal data to any verifying party, so the GDPR and trade-secret conflict dissolves instead of being balanced away. It gives notified bodies scalable verification, since a proof is checked in milliseconds and conformity assessment stops being gated on months of privileged access to proprietary systems. And it is registration-compatible by design, because a system registered with the AI Office can be bound to a signed constraint set from day one, so that the new registration mechanism carries verifiable substance rather than declarations.
The method operates strictly on formalised rules such as thresholds, deadlines, admissibility conditions and protected-attribute tests. Qualitative legal concepts remain, deliberately, in the domain of human judgement. The protocol enforces what an authorised body has signed, and the correctness of that translation is a legal responsibility rather than a cryptographic one, which is exactly where the Act places it. Nor does the argument claim novelty for zero-knowledge machine learning as such. The cryptographic building blocks are established, open and improving. The claim is architectural. It concerns the specific supervisory construction that binds signed legal constraints, per-decision enforcement in two configurations, public verifiability and tamper-evident chaining into one conformity instrument, and that construction is what has been filed. The practical applicability of the framework as an instrument has been confirmed by academic reviewers, and the underlying constructions are being prepared for peer-reviewed submission. The limitations stated in my April contribution remain stated. No production prototype exists yet, and proof-generation cost for the largest models is an open engineering question. That is a property of zero-knowledge systems generally rather than of this protocol specifically. Recursive folding amortises the cost, and the deferral window is precisely the time in which that engineering figure becomes an empirical one. Standardisation work under way in the European standardisation organisations is complementary rather than competing. Standards will define what must be demonstrated. A cryptographic layer defines how demonstration can be made verifiable at all.
What the window is for
Here is the constructive reading of the deferral. December 2027 is not far. The period between now and then is exactly the time in which member states, notified bodies and the AI Office can validate whether a cryptographic conformity instrument is acceptable, through pilots, through reference implementations, and through the standardisation channels that the Omnibus itself presupposes. A deployer that reaches December 2027 with a verifiable compliance layer already operating will not experience the deadline as a cliff. A member state that pilots such an instrument in its public administration will not merely comply. It will have co-authored the supervisory practice the rest of the Union must adopt.
The deferral bought time. Time is only worth what is built in it.
The question for this community
In April I asked under what conditions a cryptographic audit instrument would be acceptable to a notified body under Article 43. The Digital Omnibus has since answered the prior question, whether existing means suffice, in the negative and in legislative form.
So the question sharpens. Given that the Union has now formally deferred the high-risk regime for lack of workable conformity instruments, what concretely should be piloted, standardised or procured between now and December 2027, so that the deferral ends in readiness rather than in a second deferral?
A patent-filed architecture for exactly such an instrument already exists, and the priority window aligns with the December 2027 horizon. That is where this discussion should now go.
- Log in to post comments