Compliance
Decision receipts as compliance evidence
An agent that asks CrawlCheck before it acts gets a signed receipt for every decision. Kept, those receipts are a log of what the agent was told about each site and tool before it acted, which is the kind of record that record-keeping and monitoring duties for automated systems ask for. This page maps the receipts to two frameworks and gives one export per framework.
Mapping, not legal advice. Whether a duty applies to your system, and whether these records meet it, is for your own legal review.
Make a pack
Send the receipts you kept (or, for receipts less than a day past expiry, just their digests):
curl -s -X POST "https://crawlcheck.io/api/v1/compliance/pack?framework=eu-ai-act-art12" \
-H "content-type: application/json" \
-d '{"receipts": [ ...the signed receipts... ]}'Each receipt is checked: its signature against CrawlCheck’s published key, the Resolve answer it was made from (archived with no expiry), and that answer’s place in the transparency log an outside witness co-signs. The pack lists every record with the fields the framework asks for, counts records that carry all of them, and states what receipts do not cover. It is signed and verifies offline with crawlcheck-verify.mjs. Up to 200 receipts per pack.
EU AI Act: record-keeping (Article 12) and log retention (Articles 19 and 26(6))
Providers and deployers of high-risk AI systems. Article 12 asks that the system technically allow automatic recording of events over its lifetime; Articles 19 and 26(6) ask that the logs under each party's control be kept for a period appropriate to the purpose, at least six months unless other law says otherwise. Source: Regulation (EU) 2024/1689.
| Duty | What it asks | How decision receipts support it | Fields |
|---|---|---|---|
| Art. 12(1) | Automatic recording of events (logs) over the lifetime of the system | Each receipt is a machine-generated, timestamped and signed record of one decision taken before the agent acted. The pack proves each record is unaltered (signature by a published key) and anchored (its Resolve answer's leaf in an append-only log co-signed by an outside witness). | sha256 decided_at signature_valid log_state log_batch log_witnessed |
| Art. 12(2)(a) | Events relevant to identifying situations where the system may present a risk (Art. 79(1)) or undergo substantial modification | The decision (allow, warn, require_confirmation, block) and its reason codes record each time the agent met a risk signal: a lookalike domain, an owner incident, a poisoned tool, a changed checkout, a stale reading. engine.rules_sha256 records which rule tables decided, so a change in the deciding rules is visible. | domain action decision reason_codes human_confirmation_required rules_sha256 |
| Art. 12(2)(b) | Facilitating post-market monitoring (Art. 72) | The pack summary counts decisions by action and outcome over the period, and every record links to the exact answer it was made from, so monitoring can be repeated from the evidence rather than from memory. | decided_at action decision resolve_archive |
| Art. 12(2)(c) | Monitoring the operation of the system by the deployer (Art. 26(5)) | Which agent asked, about which site, for which action, and whether it was told to stop or confirm with a human. | agent template domain action decision human_confirmation_required |
| Art. 19(1), Art. 26(6) | Keep automatically generated logs for at least six months | The receipts are the operator's to keep. What CrawlCheck keeps: every Resolve answer a receipt was made from (archived with no expiry, fetchable by its digest) and the transparency log of answers, so the evidence behind a kept receipt outlives the receipt's own expiry. The pack states the oldest and newest record so the retention window can be checked. | decided_at resolve_sha256 resolve_archived |
Not covered by receipts:
- The AI system's own inputs, outputs, model versions and internal events: receipts log the verification step before an action, not the system's whole operation.
- Technical documentation (Annex IV), risk management (Art. 9), human oversight design (Art. 14) and conformity assessment.
- Whether a given system is high-risk at all: that is a classification under Article 6 and Annex III.
Preset: POST /api/v1/compliance/pack?framework=eu-ai-act-art12 (JSON, signed) or &format=csv for a log system.
NIST AI Risk Management Framework 1.0
Voluntary framework for organisations that design, deploy or use AI systems. The receipts support the subcategories below for an agent that acts on third-party websites and tools. Source: NIST AI 100-1 (January 2023).
| Duty | What it asks | How decision receipts support it | Fields |
|---|---|---|---|
| GOVERN 6.1 | Policies and procedures address AI risks associated with third-party entities | Each receipt shows the policy applied (policy block) and the decision taken about a third-party site or tool before the agent relied on it. | domain action policy decision |
| MAP 4.1 | Approaches for mapping legal and technology risks of components, including third-party data or software, are in place and documented | Records name the third-party site, the action and the evidence (Resolve answer, report, evidence manifest) the risk call was made on. | domain resolve_sha256 evidence_manifest_sha256 reason_codes |
| MEASURE 2.4 | Functionality and behaviour of the system and its components are monitored in production | A time-ordered, signed series of decisions per agent and action; counts by decision in the summary. | decided_at agent action decision |
| MEASURE 2.8 | Risks associated with transparency and accountability are examined and documented | Every decision is reproducible from its archived answer and the rule tables hash, and verifiable offline without trusting CrawlCheck's servers. | sha256 signature_valid resolve_archive rules_sha256 |
| MANAGE 4.1 | Post-deployment monitoring plans are implemented | The pack is a repeatable export: same receipts in, same signed pack out, with the period, counts and gaps stated. | decided_at decision log_state |
Not covered by receipts:
- Organisational governance, roles and training (GOVERN 1-5).
- Measurement of the model itself: accuracy, bias, robustness.
- Incident response procedures beyond the record of the decision.
Preset: POST /api/v1/compliance/pack?framework=nist-ai-rmf (JSON, signed) or &format=csv for a log system.
What to keep
Keep the receipt with the action it authorised. CrawlCheck keeps the answers behind the receipts and the log, not the receipts themselves past a day after expiry: the operator’s copy is the record. Report what happened to /api/v1/outcome with the receipt digest so the decision and its result sit together.