← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

LangSmith traces as audit evidence

LangSmith records every LangChain and LangGraph run in detail. That record sits in a workspace your team can edit and prune, under a retention plan you chose. For an EU AI Act Article 12 file, or for a customer's security review, you need something stronger: a record that proves it has not changed since it was written.

The shortest path uses what you already run: OpenTelemetry.

1. Send your traces over OpenTelemetry

LangSmith ingests OTLP at https://api.smith.langchain.com/otel, authenticated with the headers x-api-key and Langsmith-Project. If your agent already exports OTel spans there (LangChain's OTel integration, OpenLLMetry, OpenLIT, the Vercel AI SDK, or your own tracer), keep it. Point OTEL_EXPORTER_OTLP_ENDPOINT at a local Collector instead.

2. Fan out: LangSmith plus a file you own

receivers:
  otlp:
    protocols:
      http: { endpoint: 0.0.0.0:4318 }
exporters:
  otlphttp/langsmith:
    endpoint: https://api.smith.langchain.com/otel      # /v1/traces is appended
    headers:
      x-api-key: "${env:LANGSMITH_API_KEY}"
      Langsmith-Project: "my-agent"
  file/evidence:
    path: /var/otel/traces.json
    format: json
service:
  pipelines:
    traces:
      receivers: [otlp]
      exporters: [otlphttp/langsmith, file/evidence]

Use the otelcol-contrib build, which includes the file exporter. LangSmith sees the same spans as before.

3. Merge and attest

jq -cs '{resourceSpans: map(.resourceSpans[])}' /var/otel/traces.json > run.otlp.json

Paste run.otlp.json into the verifier. Spans that follow the GenAI conventions (gen_ai.request.model, gen_ai.usage.input_tokens, gen_ai.operation.name) become model calls. execute_tool spans become tool calls. Each trace becomes one run in a hash-chained ledger, countersigned and timestamped (RFC 3161). The result is a report you can hand an auditor, plus a badge that shows the run still verifies.

Doing this on every release

Run the same merge in CI and send the file to the attestation API on every deploy (the Continuous plan). You get one countersigned ledger per release, next to the code that produced it. See the sample report for what the auditor receives.

Limits

This attests what the Collector saw, starting now. It does not add prompt or response bodies your spans don't carry. For those, and for policy checks before a tool runs, wrap the model client with the SDK (Start in 1 minute). Also see Vetro vs LangSmith.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.

Pricing