The compliance brief.
What the Act actually requires, when it activates, who it affects, and how Witniumchain maps to the requirements. Written for engineers and compliance officers, not lawyers.
The Act in one paragraph.
The EU AI Act is the world's first comprehensive AI regulation. It sorts AI systems into risk tiers (prohibited, high-risk, limited-risk, minimal-risk) and imposes obligations accordingly. High-risk systems — including HR-tech, credit scoring, biometrics, education AI, public-sector AI and AI used by courts — must log events automatically across their lifetime. That is what Article 12 codifies. The Act requires the logs; Witniumchain makes them provable.
The four enforcement dates.
AI must declare itself
Article 50 transparency obligations apply: people must be told when they interact with AI, and AI-generated content must be marked. Obligations for general-purpose AI models have applied since August 2025; from now the Commission can fine their providers.
Marking for systems already on the market
Generative AI systems placed on the market before August 2026 must now also mark their output in a machine-readable way. Marks can be stripped. A sealed record can't.
High-risk AI logging
Annex III high-risk obligations apply, including Article 12: automatic logging across the lifetime of every high-risk AI system. Under Articles 19 and 26(6), providers and deployers keep the logs under their control for at least six months. The Act requires the logs. Tamper-evidence is what makes them hold up.
Product-embedded AI
Annex I obligations apply to AI in regulated products such as medical devices, toys and radio equipment.
Article 12 in plain language.
High-risk AI systems must automatically record events over their lifetime, so that their functioning can be traced. The Act says what to record, not how to protect it. A log its operator can quietly edit is weak evidence in front of an auditor or a court. Witniumchain makes every change detectable.
Independence, and how Witniumchain delivers it.
Article 12 requires the logs; it does not say how to protect them. A log that the vendor controls is documentation. A log that the vendor cannot modify is evidence. That difference is what Witniumchain adds.
Witniumchain delivers independence by construction, not by promise. The architecture is built so Witnium itself cannot read customer data, hold customer private keys, or alter customer records.
Here is what that means in practice:
Owner keypairs are generated in the customer's browser or backend using Ed25519. The private key never reaches Witnium's servers. There is no recovery flow that involves us, because there is no copy of the key on our side to recover from.
Witness content is hashed client-side before submission. What reaches our API is the SHA-256 fingerprint of the data — a 32-byte string from which the original content cannot be reconstructed. The content itself stays on the customer's systems.
Signatures are produced locally using the customer's keys and submitted to us as opaque bytes. We verify them against the registered public keys; we do not produce them, and we cannot forge them.
The metadata we do retain — timestamps, public keys, fingerprints, witness counts — is required for credit accounting and chain integrity. It contains no content. It cannot be reverse-engineered into content.
The chain itself is independently verifiable at witniumchain.com. A customer, their auditor, their regulator, or any third party can confirm that a given witness was sealed at a given time, by a given key, against a given fingerprint — without trusting Witnium's word for any of it.
This is the property that distinguishes audit-grade logging from ordinary logging. A vendor who can modify the record is part of the trust chain. A vendor who cannot is outside it. That is the difference between a log and proof.
Provider vs deployer.
A provider places the AI system on the market. A deployer uses it. Both have obligations. Article 12 logging is primarily a provider obligation, but deployers in regulated industries will be asked to demonstrate they only use compliant systems. Witniumchain serves both: providers integrate it into their platform; deployers require it from their providers.
Witniumchain → Article 12.
On-chain witness records on Hyperledger Besu / QBFT consensus.
Configurable up to 10 years on Business plan; custom on Enterprise.
Independent verification via chain-api or any Besu peer.
Every propose → sign → finalize cycle is recorded.
SHA-256 hashes anchor inputs and outputs without storing PII.
Model name, version, actor identifier captured per witness.
Penalties.
- Up to 7% of global annual turnover for prohibited practices.
- Up to 3% for non-compliance with most obligations including Article 12.
- Up to 1.5% for misleading information to authorities.
Beyond the AI Act.
The same chain serves GDPR Article 22 (automated individual decisions), DORA (financial sector ICT risk), NIS2 (critical infrastructure), CSRD (sustainability disclosures), and EUDR (deforestation due diligence). One audit primitive, multiple regulatory regimes.
Ready to integrate?