← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools
OpenTelemetry GenAI traces as compliance evidence
Many agent stacks already emit OpenTelemetry traces using the GenAI semantic conventions (gen_ai.* attributes): the OpenAI and Anthropic SDK instrumentations, LangChain and LlamaIndex integrations, Vercel AI SDK telemetry, and most LLM observability vendors. If that is you, you are closer to an AI audit trail than you think.
What GenAI spans already capture
| EU AI Act record-keeping need | GenAI span data |
|---|---|
| Which model ran | gen_ai.request.model, gen_ai.response.model, gen_ai.system |
| Parameters | gen_ai.request.temperature, max_tokens, … |
| Usage | gen_ai.usage.input_tokens, output_tokens |
| Tool use | tool-call spans and attributes, depending on instrumentation |
| Order and timing | span start/end times, parent/child structure |
| Inputs and outputs | prompt/completion events, if content capture is enabled |
What they miss
- Integrity. OTLP is a transport format. Once spans land in a backend they are rows in a database; nothing in the trace detects an edit (see tamper-evident logs).
- Content, by default. Most instrumentations do not record prompts and completions unless you opt in, so the trace shows *that* a call happened but not *what* was said.
- Policy decisions. Budget checks, blocked actions and content filters usually live in application code and never become spans. Refusals are exactly what a reviewer wants to see (see human oversight evidence).
- Retention. Observability backends typically keep traces for 14 to 30 days. Deployers need at least six months.
- Attribution. Nothing says which system produced the trace, or proves it.
Closing the gaps without re-instrumenting
- Turn on content capture for the systems in scope (and handle the personal data it implies).
- Emit policy decisions as spans or span events.
- Export traces for in-scope systems to long-term storage, separate from the observability backend.
- Seal exported traces: hash and sign them at export so later edits are detectable.
Checking a trace
Vetro Attest accepts OTLP JSON with GenAI spans as well as native Vetro ledgers. The free check shows which record-keeping items your trace covers and which are missing; the 29 USD report seals the trace with an ed25519 counter-signature and maps it to Articles 12, 19 and 26.
See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.