> ## Documentation Index > Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt > Use this file to discover all available pages before exploring further. # Compliance evidence catalog > Exactly what Inviolet records for every AI decision — automated or human — and how each field maps to the EU AI Act, GDPR Article 22, SEC recordkeeping, and California's CCPA ADMT rules. Regulators no longer ask only *"was a human involved?"* They ask you to prove that your AI made the **right** decision — and to reconstruct **why**, on demand, months later. That obligation applies most heavily to the decisions a human never touched. Inviolet is the evidence layer for that obligation. Every intent decision it makes — allow, deny, redact, route-to-approval, escalate — is recorded as a structured, signed, version-attributed event. This page is the catalog: what we collect, and which regulation each field satisfies. ## What Inviolet records for every decision Each decision produces one immutable `intent_events` record carrying: | Evidence | What it captures | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | | **Outcome** | allow / deny / pending-approval / clarify / shadow — the decision itself. | | **Inputs** | the classified intent, data elements in scope, data source, confidence score, anomaly score, and any secrets detected in the prompt. | | **Rationale** | the human-readable "why" — the policy verdict or the reason a request was blocked or escalated. | | **Policy version** | a frozen snapshot of the exact rules that fired, so a later policy edit can never rewrite history. | | **Model version** | the classifier / model version that produced the decision — answering "which model made this call?" | | **Actor** | whether a human was in the loop, and explicitly marks autonomous decisions as system-made. | | **Timestamp** | when the decision was made, to the millisecond. | | **Signature** | a cryptographic RS256 signature over the record, verifiable against Inviolet's public keys — tamper-evident by construction. | | **Chain position** | each record is linked to the prior one per organization, so deletion or reordering is detectable. | Beyond the individual record, Inviolet continuously measures whether its **autonomous** decisions stay correct over time — accuracy against human corrections, override rate, and shadow-vs-enforced divergence — the post-market monitoring regulators increasingly expect. ## EU AI Act | Obligation | Evidence Inviolet provides | | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | | **Art. 12 — automatic event logging** over the system lifetime | Every decision is logged automatically, machine-generated, with full input/outcome fidelity. | | **Art. 26(6) — retain logs ≥ 6 months** | Decision records retained per plan; indefinite retention on the Ultraviolet tier (see [retention](#retention)). | | **Art. 14 — human oversight** | The actor field records whether a human intervened — and proves when one did not. | | **Annex IV / Art. 11 — system logic documentation** | Policy-version snapshots + model-version provenance document the decision logic as it operated. | | **Art. 72 — post-market monitoring** | Continuous accuracy / override / divergence metrics show the system performs as intended over time. | ## GDPR Article 22 — automated decisions | Obligation | Evidence Inviolet provides | | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- | | **Explanation of a specific automated decision** (Recital 71) | The rationale + inputs + policy/model version reconstruct any decision after the fact. | | **Safeguards: human intervention, express a view, contest** (Art. 22(3)) | Approval and clarification workflows are recorded, including who intervened and how. | | **Accountability** (Art. 5(2)) | Signed, chained records let you *demonstrate* the safeguards operated — not just assert it. | ## SEC — recordkeeping for regulated firms | Obligation | Evidence Inviolet provides | | ---------------------------------------------------- | ---------------------------------------------------------------------------------------- | | **Advisers Act Rule 204-2 — books & records** | AI-driven decisions and their context are captured and retained. | | **Exchange Act Rule 17a-4 — tamper-evident records** | Per-record signatures + the hash chain provide tamper-evidence for the decision log. | | **Anti-fraud / "AI-washing"** | Model-version + rationale provenance substantiate claims about what the AI actually did. | ## California — CCPA ADMT regulations | Obligation | Evidence Inviolet provides | | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | **Access right — disclose the logic, output, and how it was used** | Per-decision rationale, inputs, outcome, and model/policy version are reconstructable on request. | | **Risk assessments** (retain 5 years; triggered by using or training automated decision technology) | Risk-assessment records tie decision logic and training-data provenance to reviewers and an executive attestation. | | **Pre-use notice** | The evidence catalog documents purpose, logic, and outputs for the required notice. | California's other 2026 AI laws (SB 53 frontier-model transparency, SB 942 content watermarking, SB 243 companion chatbots, AB 325 algorithmic pricing) generally apply to different actors — frontier developers, consumer content generators, chatbot operators. Where a customer is subject to them, Inviolet's decision and incident logs supply supporting evidence, but they do not impose direct obligations on the gateway itself. ## Retention Log-retention floors under the EU AI Act (6 months) and SEC rules (multi-year) are met on the **Ultraviolet** tier, which retains decision records **indefinitely**. Lower tiers retain records for shorter windows; organizations subject to EU or SEC retention duties should deploy on Ultraviolet. ## Continuous streaming to your GRC platform Because every decision emits an event the moment it happens, Inviolet streams evidence **continuously** into your governance-risk-compliance platform (Hyperproof, and other GRC systems) — each artifact mapped to the specific control it satisfies. Evidence collection is real time, not a quarterly scramble. ## Read next * [Six enforcement layers](/concepts/six-enforcement-layers) — where in the pipeline decisions are made. * [Decision feed](/concepts/decision-feed) — the in-product view of the evidence described here. * [Tier comparison](/tiers/overview) — retention and compliance capabilities by tier.