AI provenance and the EU AI Act: the evidence you actually need

The EU AI Act, whose obligations for general-purpose and high-risk systems become broadly applicable in 2026, moves organizations toward AI they can attribute, document, and audit. In practice that shows up as transparency to users, record-keeping and logging, and technical documentation of the system.

None of that is satisfied by a marketing claim. An assessor wants artifacts: evidence that a given output really came from your system, an auditable record that it hasn’t been quietly changed, and documentation of the components and cryptography involved.

A signed receipt on each answer establishes attribution and integrity — the output came from this system, unaltered — which is exactly the kind of tamper-evident record transparency and record-keeping duties call for.

An append-only transparency log (built like Certificate Transparency, publishing only hashes, never content) gives you a record a past output cannot be silently rewritten in. And a Cryptographic Bill of Materials documents every primitive in use, mapped to its standard — the kind of technical documentation an assessor can actually check.

This is the part to be careful about. Cryptographic provenance SUPPORTS these obligations by producing evidence for them. It does not make you “compliant,” and it is not a certification or a declaration of conformity.

Which obligations actually apply — and to whom — depends on your system’s risk classification under the Act, which only you and qualified counsel can assess. Any tool that hands you a “you’re compliant” verdict is overreaching; the right output is factual evidence you can put in front of an assessor, plus a clear note that the legal determination is yours to make.

The concrete deliverable is a portable, signed evidence artifact: the answer, its post-quantum signatures and the public keys to check them, and the obligation mapping — an object your counterparty or assessor can re-verify themselves, offline, years later, without trusting your servers.

That turns an abstract obligation (“maintain documentation you can demonstrate to third parties”) into a file you can hand over and they can check — which is the whole point of provenance.