Compliance evidence catalog

Regulators no longer ask only “was a human involved?” They ask you to prove that your AI made the right decision — and to reconstruct why, on demand, months later. That obligation applies most heavily to the decisions a human never touched. Inviolet is the evidence layer for that obligation. Every intent decision it makes — allow, deny, redact, route-to-approval, escalate — is recorded as a structured, signed, version-attributed event. This page is the catalog: what we collect, and which regulation each field satisfies.

What Inviolet records for every decision

Each decision produces one immutable intent_events record carrying:

Evidence	What it captures
Outcome	allow / deny / pending-approval / clarify / shadow — the decision itself.
Inputs	the classified intent, data elements in scope, data source, confidence score, anomaly score, and any secrets detected in the prompt.
Rationale	the human-readable “why” — the policy verdict or the reason a request was blocked or escalated.
Policy version	a frozen snapshot of the exact rules that fired, so a later policy edit can never rewrite history.
Model version	the classifier / model version that produced the decision — answering “which model made this call?”
Actor	whether a human was in the loop, and explicitly marks autonomous decisions as system-made.
Timestamp	when the decision was made, to the millisecond.
Signature	a cryptographic RS256 signature over the record, verifiable against Inviolet’s public keys — tamper-evident by construction.
Chain position	each record is linked to the prior one per organization, so deletion or reordering is detectable.

Beyond the individual record, Inviolet continuously measures whether its autonomous decisions stay correct over time — accuracy against human corrections, override rate, and shadow-vs-enforced divergence — the post-market monitoring regulators increasingly expect.

EU AI Act

Obligation	Evidence Inviolet provides
Art. 12 — automatic event logging over the system lifetime	Every decision is logged automatically, machine-generated, with full input/outcome fidelity.
Art. 26(6) — retain logs ≥ 6 months	Decision records retained per plan; indefinite retention on the Ultraviolet tier (see retention).
Art. 14 — human oversight	The actor field records whether a human intervened — and proves when one did not.
Annex IV / Art. 11 — system logic documentation	Policy-version snapshots + model-version provenance document the decision logic as it operated.
Art. 72 — post-market monitoring	Continuous accuracy / override / divergence metrics show the system performs as intended over time.

Obligation	Evidence Inviolet provides
Explanation of a specific automated decision (Recital 71)	The rationale + inputs + policy/model version reconstruct any decision after the fact.
Safeguards: human intervention, express a view, contest (Art. 22(3))	Approval and clarification workflows are recorded, including who intervened and how.
Accountability (Art. 5(2))	Signed, chained records let you demonstrate the safeguards operated — not just assert it.

SEC — recordkeeping for regulated firms

Obligation	Evidence Inviolet provides
Advisers Act Rule 204-2 — books & records	AI-driven decisions and their context are captured and retained.
Exchange Act Rule 17a-4 — tamper-evident records	Per-record signatures + the hash chain provide tamper-evidence for the decision log.
Anti-fraud / “AI-washing”	Model-version + rationale provenance substantiate claims about what the AI actually did.

California — CCPA ADMT regulations

Obligation	Evidence Inviolet provides
Access right — disclose the logic, output, and how it was used	Per-decision rationale, inputs, outcome, and model/policy version are reconstructable on request.
Risk assessments (retain 5 years; triggered by using or training automated decision technology)	Risk-assessment records tie decision logic and training-data provenance to reviewers and an executive attestation.
Pre-use notice	The evidence catalog documents purpose, logic, and outputs for the required notice.

California’s other 2026 AI laws (SB 53 frontier-model transparency, SB 942 content watermarking, SB 243 companion chatbots, AB 325 algorithmic pricing) generally apply to different actors — frontier developers, consumer content generators, chatbot operators. Where a customer is subject to them, Inviolet’s decision and incident logs supply supporting evidence, but they do not impose direct obligations on the gateway itself.

Retention

Log-retention floors under the EU AI Act (6 months) and SEC rules (multi-year) are met on the Ultraviolet tier, which retains decision records indefinitely. Lower tiers retain records for shorter windows; organizations subject to EU or SEC retention duties should deploy on Ultraviolet.

Continuous streaming to your GRC platform

Because every decision emits an event the moment it happens, Inviolet streams evidence continuously into your governance-risk-compliance platform (Hyperproof, and other GRC systems) — each artifact mapped to the specific control it satisfies. Evidence collection is real time, not a quarterly scramble.

Get started

Core concepts

Tier comparison

Compliance

Compliance evidence catalog

What Inviolet records for every decision

EU AI Act

SEC — recordkeeping for regulated firms

California — CCPA ADMT regulations

Retention

Continuous streaming to your GRC platform

Read next

​What Inviolet records for every decision

​EU AI Act

​GDPR Article 22 — automated decisions

​SEC — recordkeeping for regulated firms

​California — CCPA ADMT regulations

​Retention

​Continuous streaming to your GRC platform

​Read next

What Inviolet records for every decision

EU AI Act

GDPR Article 22 — automated decisions

SEC — recordkeeping for regulated firms

California — CCPA ADMT regulations

Retention

Continuous streaming to your GRC platform

Read next