← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for compliance consultants

*Engineering guidance, not legal advice. You and your client decide how the Act applies to their systems.*

The gap in every engagement

An AI Act engagement usually produces the paper side well: a risk classification, a register of AI systems, policies, a literacy plan, a fundamental rights impact assessment. The part that stalls is technical evidence. Art. 12 asks providers of high-risk systems to record events automatically over the system's lifetime; Art. 19 and Art. 26(6) ask providers and deployers to keep those logs for at least six months. When you ask a client "show me the logs of what your agent did last Tuesday", the answer is often a dashboard screenshot or a database table anyone on their team could have edited.

That is the client's word, not evidence. What convinces an auditor, a market surveillance authority or an opposing lawyer is a log whose integrity can be checked by someone who does not trust the client: a hash chain over the events, so edits and deletions show, plus an independent signature verifiable with a public key.

See Art. 12 logging and log retention under Art. 26.

What you can deliver with Vetro Attest

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger from your client's agent, with nothing to install on their side. For each ledger it produces:

• a free integrity verification (does the hash chain hold, is anything missing);
• a full EU AI Act report in Markdown and HTML mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, which anyone can verify with our published public key.

The report is a deliverable you can attach to your own assessment. It does not replace your judgement: the countersignature proves the log verified clean at a point in time, not that a decision was fair or the data correct, and the report is not a conformity assessment.

The Agency plan: one key for all your clients

For 149 USD a month (cancel anytime) the Agency plan gives you:

• up to 25 distinct client ledgers attested per billing month, and re-attesting the same ledger after a new release does not use quota;
• one API key for all clients: no checkout per client, no client card on file;
• every report headed Prepared for <client>: add "client": "<name>" to the request and the report carries your client's name.

At 25 clients that is under 6 USD per client per month, against 29 USD for a single one-off report. Re-attestation runs over the same API (POST /api/renew with your key), so a monthly evidence refresh can be part of a retainer instead of a one-off project.

For clients with no logs yet

Many clients are deployers of third-party AI and have no agent ledger at all. For them the EU AI Act document pack (99 USD) compiles, from one form, a fundamental rights impact assessment (Art. 27), an Annex IV technical documentation draft, an AI literacy plan (Art. 4) and Art. 50 transparency notices, countersigned over the pack digest and verifiable with the same public key. It is a starting draft for you to review and adapt, not a finished legal opinion.

Next steps

• Run the free Art. 12/14 checker on a client's current setup before your first meeting.
• Browse the free EU AI Act tools: high-risk classifier, penalty calculator, FRIA and Annex IV generators, in English, German, French and Italian.
• See a sample ledger verified in one click, then start the Agency plan.
• Build a document pack for a client without logs.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.