The deadline. The mechanism. The packs. The catalogue. How it compares. What's at stake. Eight short chapters, laid out so a compliance officer, a CISO and an auditor can each find the part they need.
Article 12 of the EU AI Act is short. Three paragraphs. The operational implications are enormous, and most firms reading the text the first time underestimate the engineering work required to comply.
Datadog and Splunk capture HTTP-level activity. Drata and Vanta collect static control evidence. None of them produce runtime agent action records in the format the AI Office has signalled as adequate.
Meanwhile, Lloyd's cyber and Tech E&O underwriters increasingly require AI logging at renewal — and price the answer.
Regulation (EU) 2024/1689, Article 12 §1–3. Penalties: Article 99. Applicable to high-risk AI systems from 2 August 2026. UK firms in scope extraterritorially where outputs touch the EU.
SHA-256 chain · receipts · timestamping authority
// One receipt per agent action { "event_id": "evt_8f2a4b...", "agent_id": "claims_triage_v3", "ts": "2026-06-07T14:23:11Z", "action": { "type": "tool_call", "name": "lookup_customer", "params_hash": "sha256:a1b2..." }, "resource": { "classification": ["PII", "financial"] }, "redacted_input": "lookup [REDACTED]", "redacted_output": "{age: 34, ...}", "prev_hash": "sha256:7c9d4e...", "signature": "30450221..." }
# pip install agentaudits import agentaudit from openai_agents import Agent agentaudit.init( api_key="aa_live_...", agent_id="claims_triage_v3", ) agentaudit.instrument_openai_agents() # Your agent runs as normal — # receipts flow automatically. agent = Agent(name="claims_triage_v3", ...) agent.run(customer_query)
# Query every action on a customer curl https://api.agentaudit.co.uk/receipts \ -H "Authorization: Bearer aa_live_..." \ --data-urlencode "agent_id=claims_triage_v3" \ --data-urlencode "resource_id=cust_4910" \ --data-urlencode "period_from=2026-03-01" \ --data-urlencode "period_to=2026-03-31" # Or generate the evidence pack curl https://api.agentaudit.co.uk/packs/eu-ai-act-12 \ -H "Authorization: Bearer aa_live_..." > pack.html
We engineered the EU AI Act Article 12 evidence pack from the regulation itself, the AI Office's published guidance, and conversations with external auditors at compliance review pilots.
Eight pages. Cover, executive summary, system inventory, operational summary, material event analysis, integrity proof, manifest, auditor sign-off. PDF for the auditor, machine-readable JSON for the regulator's analyst.
As the catalogue grows — ICO, FCA, NIST, insurance — the format your team produces stays consistent. The regulations evolve. Your packs evolve with them. You don't.
Six packs in active development. Each engineered against the underlying regulation and validated with practising auditors. The same hash-chained receipt feeds all of them — meaning when a new regulator gets its question ready, the answer is already in your data.
| Datadog / Splunk | Langfuse / Helicone | Drata / Vanta | Agent Audit | |
|---|---|---|---|---|
| Per-agent-action records | — HTTP only | ~ dev tracing | — static controls | ✓ Native |
| PII redaction at the SDK | — | — raw prompts stored | — | ✓ 7 patterns + Luhn |
| Cryptographic hash chain | — | — | — | ✓ SHA-256 + RFC 3161 |
| Regulator-ready export packs | — | — | ~ SOC 2 / ISO only | ✓ 6 jurisdictions |
| Cross-vendor (OpenAI · Claude · MCP) | ~ via integrations | ✓ | — | ✓ Native adapters |
| UK data residency default | ~ region selectable | ~ EU option | ~ EU option | ✓ London by default |
| Built for | SRE teams | ML engineers | SOC 2 compliance | CISOs · auditors · regulators |
If our underwriting agent rejected a claim wrongly and the customer escalated to the ICO, I genuinely do not know whose desk that lands on. We log to Datadog. But could I produce an evidence pack for that specific decision in under a quarter? Probably not. And we have insurance renewal in March.
