Most organizations believe they are compliant because they have logs. They are not.
A log is generated by the system. Legal evidence must survive outside the system.
The problem: a false sense of compliance
Article 12 of EU Regulation 2024/1689 (AI Act) enters full application on August 2, 2026. For high-risk AI systems, it requires automatic event logging throughout the system lifecycle, with logs retained for at least six months and subject to oversight by competent authorities.
The problem is not technical. Organizations already have logs. The problem is that internal logs — generated by the system itself — do not meet the requirements of legal admissibility under real pressure: regulatory audit, legal challenge, contractual dispute.
A checkbox on a UI is not accountability.
If it cannot be demonstrated in a verifiable and independent way, it is not defensible.
The real risk is this: an organization invests in AI systems, produces documentation, passes internal audits — and then, at the first legal challenge or serious regulatory audit, discovers it has nothing that holds up in court.
The regulatory gap: logs vs legal evidence
Article 12 requires traceability. But traceability and legal admissibility are not the same thing. This is the distinction most legal and compliance teams have not yet fully understood.
| Dimension | Internal Log | EVIDE Evidence |
|---|---|---|
| Independence | ✗ Generated by the system being verified | ✓ Deposited externally, outside the source system |
| Immutability | ✗ Modifiable by system administrator | ✓ SHA-256 hash, not alterable after deposit |
| Structure | ✗ Narrative text, difficult to compare | ✓ Structured schema, classifiable, comparable |
| Classification Replay | ✗ Not available | ✓ taxonomy_version anchored to the record |
| Third-party verification | ✗ Requires access to source system | ✓ Independently verifiable via reference ID |
| Survives legal dispute | ✗ Contestable as self-produced | ✓ Designed to support admissibility as independent external evidence |
The solution: from internal log to external evidence with EVIDE
EVIDE — External Evidentiary Deposit — is the evidentiary layer that transforms a decision record into a portable, verifiable, and legally admissible object.
What changes with EVIDE
From internal to external — the record is deposited outside the source system
From mutable to immutable — SHA-256 hash computed at deposit time
From narrative to structured and replayable — standardized schema with taxonomy_version
From declared to demonstrable — human oversight becomes a state, not a statement
Key fields of the EVIDE v1.3 payload
- authority.verification — supervisor identity verified via DAPI
- intervention.rationale — free-text justification, not compressed
- intervention.rationale_type — structured classification of the rationale
- intervention.taxonomy_version — taxonomy version anchored to the record for classification replay
- content_hash — SHA-256 hash of the payload for integrity verification
The full schema is public and available at: app.certifywebcontent.com/json
Beyond anchoring: EVIDE + FEDIS for full forensic admissibility
An EVIDE deposit is necessary. It is not sufficient for full legal admissibility. That is why FEDIS exists.
EVIDE — Evidence Layer
Anchors the decision record externally. Guarantees structural integrity, hash, UTC timestamp, verified authority. The record exists, is immutable, is portable.
FEDIS — Legal Admissibility Layer
Forensic Evidence Declaration and Integrity Statement. Wraps the EVIDE deposit with acquisition methodology, documented chain of custody, and a signed integrity declaration. The record becomes usable in judicial proceedings.
The distinction that matters:
EVIDE guarantees that the record exists and has not been altered.
FEDIS guarantees that the record is admissible as evidence in a legal or regulatory proceeding.
Who needs this solution
- ⚖️ Legal Teams and Law Departments
- 📋 Compliance Officers and DPOs
- 🏛️ AI Governance Leads
- 🔍 Risk Managers and Internal Audit
- 🏥 Healthcare and AI Diagnostics
- 🏦 Fintech, Capital Markets, M&A
- 👥 HR and AI Evaluation Systems
- 🏢 Enterprise with High-Risk AI Deployment
If your AI system makes decisions that affect people — hiring, credit, diagnosis, access to services — you are within the scope of AI Act Article 12.
August 2026 is not far away. The first regulatory audit will establish what “traceability” means in practice.
Verify your AI Act Article 12 compliance
Consult the public EVIDE schema or request a demo to see how EVIDE + FEDIS integrates into your system.
The framework is publicly defined as “The </AI> Protocol” and is forensically certified via CertifyWebContent. This documentation constitutes a verifiable and timestamped record of its structure, concepts, and implementation.
