Certificates for high-risk AI

AI Act · Article 12, Record-keeping

“High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system… to ensure a level of traceability of the functioning of a high-risk AI system that is appropriate to the intended purpose of the system.”

A hash-chained audit trail is built to prove exactly that property: an unbroken, automatic record of every event, checkable by anyone, without taking our word for it.

Is your use case high-risk?

Article 6 sets the test. We won't guess which path applies to you; that's a legal determination, not a marketing quiz.

Path 1 · safety component

The system is a regulated product, or a safety component of one, that already requires third-party conformity assessment under EU product law.

Path 2 · Annex III use case

The system falls in one of the Annex III categories, unless it performs only a narrow procedural task that doesn't materially influence the outcome.

What doesn't need a determination: the traceability the Act asks for is the same traceability a compliance officer, an auditor, or a client asking “how did your AI decide this?” already wants.

Three levels of proof, on every answer

Not a separate compliance dashboard. The certificate sits with the answer, in the product, one click away.

Plain

What an ordinary AI assistant gives you: the answer, and a link. Nothing underneath to show anyone.

Provenance default

The exact answer and its sources, written to an unbroken hash chain. Change one character and the check fails.

Best match

For the technical reader: a reproducible proof that the answer is the strongest-supported one among the documents considered.

Questions before you rely on it

Does using Qriton KB make us AI-Act compliant?

No, and be wary of any vendor who says otherwise. Compliance is a full programme: risk management, human oversight, conformity assessment where it applies, and more. A certificate addresses one specific duty: the traceability Article 12 asks for. That's a real piece of the work, not the whole of it.

Is a hash chain literally what Article 12 requires?

Article 12 requires logging that enables traceability and post-market monitoring, but it does not mandate a technology. Our chain meets that goal and adds tamper-evidence on top. Whether it satisfies your specific obligations is a question for your counsel, not for marketing copy.

What if we're not sure our system is classified high-risk?

Article 6 sets a two-part test, and it is genuinely not always obvious. That's a determination for your legal team. The audit trail is useful either way, because it's the same traceability your auditors and your own risk function want, classification or not.

Does the certificate cover facts we edit or correct?

Yes. Every governed edit, whether a correction a named reviewer approves or a deletion, is sealed into the same chain as answers and refusals. Nothing changes the knowledge base silently.

Can we show a certificate to an actual regulator or auditor?

Anyone can verify a receipt against the live chain at /verify On this public demo that needs no account. On a confidential deployment, receipt access is yours to control (see below). Whether it satisfies a specific audit is between you and that auditor; we don't represent it as pre-approved by any regulator.

Where does our data go?

Nowhere outside your building. Qriton KB installs on your own servers and answers only from documents you provide. Nothing is sent to an outside service.

Every answer, certified.