[HN Gopher] Show HN: Open-Source Article 12 Logging Infrastructu...
       ___________________________________________________________________
        
       Show HN: Open-Source Article 12 Logging Infrastructure for the EU
       AI Act
        
       EU legislation (which affects UK and US companies in many cases)
       requires being able to truly reconstruct agentic events.  I've
       worked in a number of regulated industries off & on for years, and
       recently hit this gap.  We already had strong observability, but if
       someone asked me to prove exactly what happened for a specific AI
       decision X months ago (and demonstrate that the log trail had not
       been altered), I could not.  The EU AI Act has already entered
       force, and its Article 12 kicks-in in August this year, requiring
       automatic event recording and six-month retention for high-risk
       systems, which many legal commentators have suggested reads more
       like an append-only ledger requirement than standard application
       logging.  With this in mind, we built a small free, open-source
       TypeScript library for Node apps using the Vercel AI SDK that
       captures inference as an append-only log.  It wraps the model in
       middleware, automatically logs every inference call to structured
       JSONL in your own S3 bucket, chains entries with SHA-256 hashes for
       tamper detection, enforces a 180-day retention floor, and provides
       a CLI to reconstruct a decision and verify integrity. There is also
       a coverage command that flags likely gaps (in practice omissions
       are a bigger risk than edits).  The library is deliberately simple:
       TS, targeting Vercel AI SDK middleware, S3 or local fs, linear hash
       chaining. It also works with Mastra (agentic framework), and I am
       happy to expand its integrations via PRs.  Blog post with link to
       repo: https://systima.ai/blog/open-source-article-12-audit-logging
       I'd value feedback, thoughts, and any critique.
        
       Author : systima
       Score  : 33 points
       Date   : 2026-03-03 10:11 UTC (12 hours ago)
        
       | kanzure wrote:
       | Anyone can generate an alternative chain of sha256 hashes.
       | perhaps you should consider timestamping, e.g.
       | https://opentimestamps.org/ As for what the regulation says, I
       | haven't looked but perhaps it doesn't require the system to be
       | actually tamper-proof.
        
         | systima wrote:
         | Thanks for the thoughts and feedback.
         | 
         | Fair point on the reconstruction attack.
         | 
         | The library is deliberately scoped as tamper-evident, not
         | tamper-proof; it detects modification but does not prevent
         | wholesale chain reconstruction by someone with storage access.
         | The design assumes defence-in-depth: S3 Object Lock (Compliance
         | mode) at the infrastructure layer, hash chain verification at
         | the application layer.
         | 
         | External timestamping (OpenTimestamps, RFC 3161) would
         | definitely add independent temporal anchoring and is worth
         | considering as an optional feature. From what I can see,
         | Article 12 does not currently prescribe specific cryptographic
         | mechanisms (but of course the assurance level would increase
         | with it).
         | 
         | On the regulatory question: Article 12 requires "automatic
         | recording" that enables monitoring and reconstruction and
         | current regulatory guidance does not require tamper-proof
         | storage (only trustworthy, auditable records). The hash chain
         | plus immutable storage is designed to meet that bar, but what
         | you raise here is good and thoughtful.
        
       ___________________________________________________________________
       (page generated 2026-03-03 23:01 UTC)