The EU AI Act's logging rule moved to December 2027. The logs did not get easier

Description and use

Verax meets EU AI Act logging requirements by inserting signed, chained audit records for every tool call in high‑risk AI systems.

Problem

High‑risk AI systems must record detailed logs per Article 12 of the EU AI Act, but existing agent stacks lack the required granularity and integrity, making compliance impossible.

Outcome

Verax enables AI systems to meet the EU AI Act’s logging requirements by providing a lightweight, open‑source middleware that records, signs, and chains audit logs locally, avoiding vendor cloud pitfalls.

Workflow

• 1. Agent authenticates with a token specifying scopes.
• 2. Agent sends request; Verax hashes the exact call and records it.
• 3. Policy gate evaluates request, producing a signed decision record with policy hash and reason code.
• 4. If approved, the tool runs and Verax logs an effect row with result hash, reconciled against the decision.
• 5. All records are signed, chained, and stored locally; a ledger copy is kept beside the original.
• 6. Verax doctor verifies ledger integrity and reports discrepancies.

Evidence

Article 12 of the Act is short. A high‑risk system must technically allow the automatic recording of events over its lifetime…

Source

We ended up with five parts, and each one answers a question an auditor actually asks.

Source

Verax is an open‑source MCP server (Apache‑2.0) that sits between an agent and its tools.

Source