← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for insurtech

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 5(c) covers AI systems used for risk assessment and pricing in relation to natural persons in life and health insurance. Claims triage, underwriting assistants and pricing agents built on LLMs deserve an early look against that wording. Non-life products and purely internal tooling may fall outside it; the role of the system in the decision is what counts.

The logging duties that follow

• Art. 12 (providers of high-risk systems): automatic recording of events over the system's lifetime, so functioning can be traced and risks identified.
• Art. 19 (providers) and Art. 26(6) (deployers): keep the automatically generated logs for at least six months, unless other law says otherwise.

See Art. 12 logging and log retention. Logs cannot be backfilled: runs you do not record today will not exist when someone asks about them.

What counts as evidence

When an insured person contests a premium or a declined cover, the question is whether the record of what the agent did was rewritten after the complaint. Insurers already keep decision files under financial-services rules, and Art. 26 lets deployers that are financial institutions fold log-keeping into that documentation.

A log in your own database is your word. What convinces an outsider is a hash chain over the run's events, so edits and deletions are detectable, plus an independent signature verifiable with a public key.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that a decision was fair or the data correct. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. WORM storage, vs. signing your own logs.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.