Witnium logo
WITNIUM. Chain.
Where the chain belongs underneath

Audit-grade evidence, in seven AI verticals — and far beyond them.

In production since 2018. Eight years before the EU AI Act made cryptographic audit a regulatory baseline.

The EU AI Act will make verifiable AI logging a regulatory requirement from December 2027. That deadline is the catalyst for many of our customers. But the underlying technology has been in production for eight years, and it solves a problem older and broader than AI: how to prove that something happened, exactly when and how it happened, in a way no party — not even Witnium — can later modify.

This page walks through where that capability matters most. First, in the seven verticals where AI Act enforcement is driving urgency. Then, across the wider set of problems where the chain has been quietly load-bearing all along.

How witnessing actually works

Three steps, taken in milliseconds.

A short primer for readers who haven't yet seen the technology in action.

01Capture

Your system produces something worth proving.

An AI model generates a contract clause. A hiring platform recommends a candidate. A diagnostic tool flags a scan. A sensor reports a reading. Whatever the event, your application captures the inputs, the output, and the context — model version, timestamp, operator, anything that would matter later.

02Hash

Your application computes a fingerprint.

A cryptographic hash (SHA-256) reduces all of that information to a 32-byte fingerprint that uniquely represents it. Change a single character and the fingerprint changes completely. Witnium never sees the original — only the signed fingerprint reaches us, signed with a key that lives on your side of the wire.

03Seal

The chain seals it.

The signed fingerprint is recorded on a tamper-evident chain operated across distributed EU validators. Anyone — your customer, your auditor, a regulator, a court — can later verify, independently of Witnium, that the fingerprint was sealed at the recorded time, by the recorded key, on the recorded chain.

That's the entire mechanism. No blockchain tokens, no proof-of-work, no public ledger of your business. A cryptographic primitive for proving that something happened, made available through one MCP server, one REST API, and one TypeScript SDK.

The rest of this page is about where that capability matters.

AI cluster — Article 12 urgency

Seven verticals. One regulatory clock.

From December 2, 2027, every high-risk AI system listed in Annex III of the EU AI Act must keep automatic, tamper-evident logs. Penalty: up to €15M or 3% of global turnover.

HR-tech and people decisions

Hiring, scoring, termination — the decisions a tribunal will ask about.

Hiring screens, performance scoring, and termination-support tools are explicitly named as high-risk under Annex III. The reason is straightforward: when an AI-influenced decision materially affects someone's employment, that person has a right to understand and challenge it.

A Helsinki-based recruitment platform serves several thousand corporate customers across the Nordics. Each candidate flows through automated screening before a human reviews the shortlist. When a rejected candidate files a complaint with the Discrimination Ombudsman, the question becomes: what did the model see, what did it score, and which human signed off on the decision?

With Witniumchain, every screening decision is witnessed — the candidate's anonymised application fingerprint, the model's output score, the threshold applied, the human reviewer who confirmed or overrode it. The platform doesn't have to defend its logs; it points the regulator at the chain.

Insurance

One forensic timeline per claim — from intake to settlement.

Claims adjusting is being transformed by AI faster than most observers realise. A claim is filed, photos are uploaded, an AI estimates damage, a settlement offer is generated. Speed has improved dramatically. Trust has not.

When a claimant disputes a settlement — particularly in jurisdictions where insurance ombudsmen take consumer complaints seriously — the insurer needs to demonstrate not just that the AI worked, but exactly what it worked on. Were the submitted photos altered between intake and adjudication? Did the model see the medical report or only the summary? Was the damage estimate based on the actual damage description or an autocomplete artefact?

Witniumchain gives insurers a single forensic timeline per claim: every input the model saw, every output it produced, every human override, sealed in real time. The same record satisfies internal audit, the ombudsman, and — increasingly — the reinsurance partner who wants to verify that the underwriting AI is operating within its declared parameters.

Financial services and credit

Where credit scoring meets operational-resilience obligations.

Credit scoring is named in Annex III. AI-assisted underwriting and AML decisions sit one regulatory shock away from being treated identically. DORA, separately, imposes operational-resilience and forensic-readiness obligations on financial entities and their critical ICT providers. Witniumchain sits squarely in the intersection.

A consumer lender uses a model to score loan applications. The model is well-documented, the development team is competent, but six months from now a borrower will default, a regulator will ask why the loan was approved, and the answer "our model thought it would work out" will not be sufficient. The lender needs to demonstrate that the inputs the model saw were the inputs the borrower provided, that the score the model produced was the score the underwriter saw, and that any human override is logged with a reason. That entire chain is what Witniumchain provides as a primitive.

Healthcare AI

When unverifiable evidence is treated as documentation, not proof.

Clinical decision support, triage, and diagnostic AI inhabit Annex I (product-embedded) and Annex III (high-risk) at once. They also operate in an environment where the cost of an unverifiable decision is, occasionally, someone's life.

A hospital uses a diagnostic AI to flag chest X-rays for radiologist review. The system performs well in the validation studies, the deployment goes smoothly. Two years later, a malpractice case alleges the AI missed a finding that should have been caught. The hospital's defence depends on being able to demonstrate: the model version in use at that time, the image hash submitted, the model's actual output, the radiologist's review and confirmation, and the time elapsed between each step. Without an external chain, all of that is reconstructed from internal logs the hospital itself controls — which, in adversarial proceedings, is treated as documentation rather than as evidence.

Witniumchain externalises that chain. The hospital is no longer asking the court to trust its own records.

Education and ed-tech

Grading, admissions, proctoring — appeals on verified evidence.

Annex III names AI used for "determining access or admission" to educational institutions, for "evaluating learning outcomes," and for "monitoring and detecting prohibited behaviour of students during tests" as high-risk. The implications are not yet fully absorbed by the ed-tech sector.

A Nordic ed-tech company offers AI-assisted essay grading to upper-secondary schools across three countries. Students whose grades have material consequences for university admission are entitled, under both the AI Act and existing GDPR Article 22 provisions, to understand and challenge the automated decision. The school is the deployer, the ed-tech company is the provider, and both have obligations.

With Witniumchain, every graded essay is witnessed: the essay fingerprint, the model output, the rubric applied, the teacher's review status. When a student appeals a grade, the appeal process operates on cryptographically verified evidence rather than on the company's word. This is, increasingly, what schools' procurement teams are asking for.

Public sector AI

Audit trails procurement teams require to be vendor-independent.

Benefits eligibility, asylum and migration processing, and law-enforcement-adjacent AI are uniformly Annex III. Public-sector deployers operate under the additional constraint that their procurement processes increasingly require demonstrable independence of the audit trail from the vendor providing the AI.

A government agency uses AI to triage incoming applications for a benefit programme. Some applications are approved automatically, some flagged for human review, some rejected. When a rejected applicant requests reasons under administrative-law obligations, the agency must produce not just an explanation, but evidence that the explanation matches what actually happened.

Witniumchain provides that evidence as a primitive. The agency does not have to defend its internal logs. It points the appellant — and, if necessary, an administrative court — at a chain it does not control.

Beyond AI

The technology is older than AI. Some applications have nothing to do with it.

In production since 2018. The chain is a general primitive: any event worth proving can be witnessed, any party with the fingerprint can verify it.

Multi-party contracts and signatures

Several parties need to agree on the same document. Traditional e-signature solutions prove that signature A was applied to document B. They do not prove the full sequence — when each party reviewed, in what state of the negotiation, on what version. With multi-party witnessing, each signature is a separate sealed event, and the final document carries a verifiable chain of every interaction that produced it. The applications are obvious in any high-value transaction: M&A, real estate, syndicated lending, complex commercial agreements.

Whistleblower and regulatory submission integrity

A regulated company is required, under EU and national whistleblower-protection laws, to maintain a confidential reporting channel. The submissions arrive, the company investigates, the regulator may later audit the process. Two opposed requirements collide: the reporter's identity must remain protected, but the timing and content of the report must be verifiably preserved. Witnium witnesses the submission at intake — the report content is hashed, the timestamp sealed — without recording the reporter's identity anywhere on the chain. Years later, the company can prove what was received and when, without ever revealing who sent it.

Board and governance decisions

A board votes on a strategic decision that will, three years later, be examined by shareholders, regulators, or successor management. The minutes record the outcome. They do not, ordinarily, prove the deliberation: which directors saw which materials, when each accessed them, who participated in the vote, in what state of information. Witnessing those events at the time of the meeting produces an immutable governance record. For listed companies, family-owned conglomerates, and any institution where the cost of a contested decision is years of forensic discovery, this is a quiet but high-value application.

Chain of custody for evidence and incident response

A security team responds to a breach. A regulator's investigator collects digital evidence at a site visit. A forensic accountant takes images of a fraud-relevant database. In each case, the evidence has to survive months or years of legal process, and the question that will be asked in court is: can you prove this material has not been altered since you collected it? Witnessing each artefact at collection — the photograph, the disk image, the database snapshot — produces a cryptographic chain that answers that question definitively, without depending on the trustworthiness of the collecting party.

Scientific data and research integrity

Research fraud cases have made replicability and data provenance front-of-mind concerns for universities and journals. A laboratory takes measurements over the course of an experiment. The dataset will eventually appear in a paper. Witnessing each measurement at the moment of capture — the raw value, the timestamp, the instrument identifier, the operator — produces a record that, years later, makes it possible to prove the paper's data was not selectively edited after the fact. The same approach applies to clinical trial data, environmental monitoring, sensor networks, IoT telemetry, and any other domain where the integrity of machine-generated data matters.

Start

One primitive. Many problems. Always third-party verifiable.

Whatever you need to prove — an AI output, a human signature, a sensor reading, a regulatory submission — Witniumchain is the audit layer underneath. Start free. Run your first witness in an afternoon.