← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for law enforcement vendors and agencies

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 6 covers AI systems used by or on behalf of law enforcement authorities to:

• (a) assess the risk of a person becoming the victim of criminal offences;
• (b) act as polygraphs or similar tools;
• (c) evaluate the reliability of evidence in investigating or prosecuting offences;
• (d) assess the risk of a person offending or re-offending not solely on the basis of profiling, or assess personality traits or past criminal behaviour;
• (e) profile people in the detection, investigation or prosecution of offences.

Article 5 draws the hard lines, in force since 2 February 2025: predicting that an individual will commit a crime based solely on profiling or personality traits is prohibited, and so is real-time remote biometric identification in public spaces outside narrowly defined exceptions. See the biometrics page for identification systems.

Registration differs too: point 6 systems go into a secure, non-public section of the EU database (Art. 49(4)).

The logging duties that follow

• Art. 12 (providers): automatic recording of events over the system's lifetime.
• Art. 19 (providers): keep logs under your control for at least six months.
• Art. 26 (deployers), the police force or prosecutor: competent human oversight (Art. 26(2)), logs kept for at least six months (Art. 26(6)), use only of systems registered in the EU database (Art. 26(8)), and, for post-remote biometric identification in a criminal investigation, prior or prompt authorisation by a judicial or administrative authority and documentation of each use in the police file (Art. 26(10)). As public bodies, deployers also carry out a fundamental rights impact assessment.

Processing-operation logs under the Law Enforcement Directive continue to apply alongside these.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

In court the defence will ask how an AI output entered the case file. The chain should show what the tool assessed, what it returned, and who relied on it.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.call","data":{"name":"load_exhibit","input":{"case":"C-2026-1183","exhibit":"EX-14","kind":"audio"}}}
{"seq":2,"type":"tool.result","data":{"name":"authenticity_check","output":{"splice_suspected":false,"confidence":0.72}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.result","action":"warn","hits":[{"rule":"low-confidence-needs-expert"}]}}
{"seq":4,"type":"tool.call","data":{"name":"refer_to_expert","input":{"investigator":"inv_331","lab":"forensic-audio"}}}

A hash chain lets the defence and the court check that the exhibit history was not edited to fit the case.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 49 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign each run that produces an output entering a case file, and store the attestation with the exhibit record. Redact operational details before export: the ledger you upload is stored for 7 days if you buy the report, while the attestation itself covers only a digest.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the assessment was reliable or its use lawful. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 49 USD.
• Compare approaches: vs. WORM storage, vs. RFC 3161 timestamping.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.