Case studies · Enterprise, EU customers

A company with EU customers keeps EU AI Act evidence as its AI runs

Policy applied to each AI call, human approval for decisions that need it, and a signed log of each decision, kept ahead of the high-risk obligations.

TowerEvidence and auditEach decision signed with their key
Record #4,812 Record verified
When
6 Nov 2026, 09:14:52 CET
Who
Decision support system, EU operations
Model
Anthropic, through Raidu in their cloud
Rule
HUMAN-REVIEW-03
Decision
Approved by J. Proto after review
Reason
Decisions above the set threshold need a named reviewer before the result is used.
Previous
9f2c…a71e
Hash
9b10…c348

Change one field and the hash stops matching. This demo uses a SHA-256 hash; Raidu signs each record with your own key.

  1. #4,811Email held for approval
  2. #4,812This entry
  3. #4,813Model call allowed
  4. #4,814Tool call checked

Illustrative. No customer data.

Illustrative product view. Sample data, not client data.

The problem

The company uses AI in decisions that affect its EU customers. Its legal team expects the system to fall under the EU AI Act's high-risk rules and wants logs and human-oversight evidence in place before the obligations apply.

  • Each callchecked against the current policy
  • Namedperson on decisions that need one
  • Signedlog of each decision, kept in their cloud

Before Raidu

  • Logs scattered across apps
  • Human review not recorded
  • Policy changes not tied to decisions

With Raidu

  • One signed log for each decision
  • Approvals recorded with who and when
  • The policy version on each record

The challenge

The EU AI Act asks providers and deployers of high-risk AI systems to keep automatically generated logs, to keep them for at least six months, and to make human oversight possible. The company wants that evidence produced as the system runs, not reconstructed for an audit.

How they set it up

Each AI call in the system goes through Raidu, which applies the company’s current policy and records the decision, the rule that applied and the reason. Decisions above a set threshold wait for a named reviewer, and the approval goes on the same record. Records are signed with the company’s own key, chained, and re-verified weekly, with a daily independent timestamp.

A log they can hand to an auditor, showing what the system did, which policy applied and who approved what. Raidu supplies the evidence; meeting the Act’s obligations remains the company’s responsibility.

Rollout

  1. Step 1The system's AI calls routed through Raidu in their cloud
  2. Step 2Approval rule for decisions above a set threshold
  3. ThenLegal reviews the log and approvals each quarter

What they deployed

  • AI Firewall: the company's policy applied before each call
  • Approvals: decisions above a threshold held for a named person
  • Evidence and Audit: each decision signed with their own key, re-verified weekly

Talk to us about your data and AI.

Tell us what you need to prove and to whom. We will show you the record it produces.

Talk to us