← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for data protection officers

*Engineering guidance, not legal advice. Your organisation decides how the Act applies to its systems.*

Why the AI Act lands on your desk

The AI Act does not create a DPO role, but in most organisations the questions arrive at the DPO anyway: AI systems process personal data, the fundamental rights impact assessment (Art. 27) sits next to the DPIA (GDPR Art. 35), and deployers of high-risk systems must keep the automatically generated logs for at least six months (Art. 26(6)). The same logs are what you would need to answer a data subject, investigate an incident or respond to a supervisory authority.

See log retention under Art. 26, the FRIA under Art. 27 and GDPR and AI agent logs.

The question to ask the engineering team

"Can you prove the log of this AI run is complete and has not been edited since?" A table in an application database, or a vendor dashboard, cannot answer it: whoever administers the system can change it. What can answer it is a hash chain over the run's events, so any edit or deletion is detectable, plus an independent signature over the result that anyone can verify with a public key.

Two tensions to keep in view:

• Retention vs minimisation. The AI Act sets a floor of six months; GDPR says no longer than necessary. Decide the retention period per system and write down why.
• Logs are personal data. Prompts and outputs often contain it. Evidence that a log is intact should not require copying it into more places than needed.

How Vetro Attest fits

Vetro Attest takes an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install.

• Verification is free: it checks the hash chain and tells you whether anything is missing or altered.
• For 29 USD per ledger, one-off: a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show, and an ed25519 countersignature over the ledger digest, event count and timestamp.
• Paid ledgers are deleted after 7 days; the report and attestation are emailed to you to keep. We do not become another long-term store of your personal data.

Limits, stated plainly: the countersignature proves the log verified clean at a point in time, not that a decision was lawful or the data correct. The report supports your assessment; it is not a conformity assessment.

If you are an external DPO

External DPOs and privacy consultancies serving several organisations can use the Agency plan (149 USD a month): up to 25 distinct client ledgers per billing month on one API key, each report headed Prepared for <client>. See the page for compliance consultants.

For organisations that deploy third-party AI and have no logs of their own, the document pack (99 USD) drafts a FRIA (Art. 27), an Annex IV documentation draft, an AI literacy plan (Art. 4) and Art. 50 notices from one form, countersigned and verifiable. It is a draft for you to review, not a finished opinion.

Next steps

• Run the free Art. 12/14 checker against your organisation's setup.
• Try the free FRIA generator and the log retention tool.
• Verify a trace free, then get the countersigned report.
• Build a document pack.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.