EU AI Act mapping
The open build demonstrates the record-keeping and integrity obligations directly. The dossier-shaped obligations (Annex IV documents, qualified signatures, incident notifications) are Enterprise, and labeled as such.
Obligation to mechanism
Nothing below is sold as shipping in the open build unless the status says so.
Article 12 · Automatic event logging over the system lifetime
Ed25519-signed receipt per verdict, hash-chained append-log per run · verifiable offline
LiveIntegrity of records
iaga replay --verify-only and iaga-verify: offline chain re-verification against one public key
LiveDocumented risk controls
Dictum typed policies plus the Hindley-Milner type checker
LiveArticle 11 + Annex IV · Technical documentation
Dossier generation from the receipt chain
Enterprise · plannedSignatures backed by a qualified trust service (eIDAS)
Planned integration with a qualified Trust Service Provider under Regulation (EU) No 910/2014
Enterprise · plannedArticle 72 · Post-market monitoring
Continuous drift monitoring · open build captures the inputs a drift check needs
EnterpriseArticle 73 · Serious incident reporting
AI Office notification generation
Enterprise · plannedWhy offline verification matters
A receipt is only useful to a regulator if it can be trusted without trusting the vendor. IAGA receipts verify offline against their signed hash chain, so anyone holding the public key — your auditor, a counterparty, an opposing expert — can check every signature with the standalone iaga-verify binary. Whether a given authority or tribunal accepts a record as evidence is their determination, not ours; what we can give you is a record that does not require trusting us. The receipt chain works even if IAGA disappears. That independence is the point.
The full mapping
The article-by-article mapping across the AI Act, GDPR, and DORA, and what Enterprise turns each obligation into, is in ENTERPRISE.md on GitHub.