← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for cybersecurity teams

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Security tooling is mostly outside the high-risk category. The recitals state that components intended to be used solely for cybersecurity purposes should not qualify as safety components under Annex III point 2. Detection models, phishing classifiers and autonomous SOC agents that triage alerts are therefore usually not high-risk on that basis.

Two things change the picture:

• Monitoring people. Insider-threat and user-behaviour analytics that monitor and evaluate employees' behaviour can fall under Annex III point 4(b). An alert that feeds a disciplinary process is employment AI, whatever the product category says. Article 5(1)(f) also bans emotion recognition at work.
• Being a requirement. Article 15 requires high-risk systems to be resilient against attacks such as data poisoning, model poisoning, adversarial examples and confidentiality attacks. Security teams inside providers of high-risk systems own that evidence.

The logging duties that follow

Where a system is high-risk, such as insider-risk scoring:

• Art. 12 (providers): automatic recording of events.
• Art. 19 (providers): keep logs under your control for at least six months.
• Art. 26 (deployers): competent human oversight (Art. 26(2)), logs kept for at least six months (Art. 26(6)), and informing workers' representatives and affected workers first (Art. 26(7)).

Where it is not high-risk, the AI Act sets no log duty, but NIS2 and DORA incident reporting will ask what your automated responders did. See tamper-evident logs.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

Security logs have a specific weakness: the attacker you are investigating may have had access to them. An agent that isolates hosts or disables accounts needs a record that cannot be quietly rewritten, by an intruder or by an embarrassed operator.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.result","data":{"name":"edr_alert","output":{"host":"fin-ws-114","technique":"T1003","severity":"high"}}}
{"seq":2,"type":"llm.response","data":{"model":"soc-agent-1","usage":{"input_tokens":5400,"output_tokens":210}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.call","action":"warn","hits":[{"rule":"isolate-finance-host-notify-oncall"}]}}
{"seq":4,"type":"tool.call","data":{"name":"isolate_host","input":{"host":"fin-ws-114","ticket":"INC-7731","oncall":"sec_oncall_2"}}}

Keep signing keys off the hosts being protected, and countersign externally, so a compromise of the SOC does not compromise its own record.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign every agent run that takes a containment action, and attach the attestation to the incident ticket used for regulatory reporting.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the containment decision was right. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. WORM storage, vs. Datadog LLM Observability.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.