Article 12 and the difference between a log and evidence

The AI Act asks providers of high-risk systems to keep records over the system's lifetime. Article 12 reads like a storage clause, and most teams treat it that way: capture enough, keep it long enough, produce it on request. The harder requirement is sitting underneath that. The records only matter at the moment someone outside the operator picks them up and tries to use them, and at that moment the question is not "did you keep a log" but "can I believe this one without believing you."

Those are different problems, and almost all agent logging only answers the first. The system writes down what it did, in its own format, in its own database, and the result is a faithful account from the operator's point of view. A regulator, an auditor, or a counterparty reading it later has no way to check any of it on their own. They can read the story; they cannot test it. They either trust the infrastructure that produced the record or they do not, and a longer, more detailed log does not move that at all.

This stays invisible while everyone trusts each other and decides the case the moment they stop. Think about when an Article 12 record actually gets pulled: a dispute eighteen months after the fact, a regulator questioning the same system that produced the evidence, someone harmed by one specific action the agent took. In each one the log can be complete, well formatted, and intact and still prove nothing, because the thing being questioned is the operator's own record of its own behavior. You do not close that gap with more fields. You close it by making the record checkable without the operator in the loop.

That one requirement, verifiable by someone who has no reason to trust you, forces most of the design on its own.

So each action the agent takes becomes a signed receipt over a canonical form of that action, using published canonicalization rules (JCS, RFC 8785). Because the rules are declared rather than internal, anyone holding the inputs can recompute the same bytes and check the signature. No vendor software anywhere in that path.

A second, independent checker then has to exist. If the only thing that can verify a receipt is the tool that made it, the maker is still the root of trust and nothing has really changed. The bar I hold myself to is a verifier written from scratch, sharing no code with the generator, that reproduces the same receipt byte for byte. The one I ship is a single file whose only dependencies are two public libraries, and it imports none of my code. It re-derives the receipt from the bytes and the public key alone; change one field and it fails.

The record also has to show what is missing, not only what is present. A pile of valid signatures is not a complete account. Receipts carry a sequence and a terminal marker, so a gap is legible: if the agent acted three times and the record holds seq 0 and seq 2, the check reports seq 1 missing instead of handing you two valid receipts as a tidy trail. Completeness is part of what record-keeping has to support, and a bag of signatures does not give it to you.

And verification fails closed. A broken signature, a tampered field, a gap, a reordered step: each is a hard failure, not a warning a tired reader scrolls past. The verifier returns a verdict, not an impression.

None of this is a product, and that is the point. The canonicalization, the receipt shape, the test vectors, and the checker are all open, on the Vaara page (https://vaara.io). If verification depended on buying something from me, it would be worth exactly as much as the log it replaced. It works as evidence precisely because it does not depend on me: an auditor recomputes the bytes and either the signature holds or it does not.

I think this is close to what Article 12 turns into once people stop reading it as a storage line. The obligation is not really to remember. It is to be able to prove, to someone with no reason to extend you any goodwill, that a particular thing happened and that nothing was quietly dropped along the way. A record only its author can vouch for is documentation. A record a stranger can recompute is evidence. The Act is asking for the second one even where it says the first.