Use case · EU AI Act logging

EU AI Act event logs, written at the moment of the decision.

Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, requires high-risk AI systems to record their own events by 2 December 2027. Raidu writes a tamper-evident, chained record for every decision as it happens, inside your own cloud.

Runs inside your AWS, GCP or Kubernetes install.

Last reviewed

Book a working session Watch it work

Illustrative. No customer data.

The difference

Their way, and ours.

Their wayRaidu
Reconstruct what happened from application logs the week before the audit.A tamper-evident record written at the moment of every decision.
A framework spreadsheet with 'aligned with' in each cell.Every registered control mapped to a live policy, with a tamper-evident record that proves it ran.
Logs in one tool, policy in another.Control, policy and record, all on one line.

Every registered control mapped to at least one enforced policy. Every control opens onto the evidence behind it.

Source: Tower compliance data: framework definitions and the coverage report

How Raidu handles it

How the log is built.

  1. 01

    Intercept every decision

    Tower sits in front of every call to a model, whether it comes from a person in the console, an agent, a client app or a coding tool. Every prompt, tool call and response passes through the policy layer before the model is called.

  2. 02

    Write the tamper-evident record

    Each decision produces a record: who made the call, which model, which policies ran, what was found, and what the outcome was. Each record is linked to the previous record, write-once, so any change shows. Database triggers refuse updates and deletes. Content can be erased for GDPR while the chain stays verifiable.

  3. 03

    Map to the control

    In the Compliance Center, each registered control links to the policies that enforce it and the records that prove it ran. An auditor opens the EU AI Act framework, picks a control, and sees the live evidence behind it.

Products that do it

Where this lives in Tower.

Compliance Center

Every registered control links to the policy that enforces it and the records that prove it.

Read more ›

Evidence and Audit

Tamper-evident, write-once records for every decision. Database triggers refuse updates and deletes. 10-year retention.

Read more ›

AI Firewall

61 registered guardrail policies across 36 detection services. Every blocked or allowed decision is a tamper-evident record.

Read more ›

The product

See the screens.

Product windows from the films, with sample data. No customer data.

Compliance Center ›

The record

The decision, on the record.

Every event is a tamper-evident, chained record. Any change to the chain shows; content can be erased for GDPR while the hash stays intact.

Entry 1,051 AI Firewall · 15:22:08Z
Framework
EU AI Act (Regulation (EU) 2024/1689, as amended by 2026/1744)
Annex
Annex III · high-risk system
Policies run
61 registered policies across 36 detection services
Verdict
Allowed, logged
Proof
Tamper-evident
sha256 ae5c854c7ffccfbf38ceb0df2ecaaefc…
entry 1,051 of 8,437 · write-once

The clock

The dates that apply.

1 January 2027

Colorado AI Act (SB 26-189) operative. US state-level AI accountability obligations begin.

Colorado SB 26-189

2 December 2027

High-risk AI systems under Annex III must record their own events.

Regulation (EU) 2026/1744, Annex III

Common questions

Answered straight.

Which regulation requires this?
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. Annex III lists the high-risk AI system categories. Systems in those categories must record their own events by 2 December 2027.
How are controls mapped to evidence?
Every registered control is linked to at least one policy Raidu enforces, and to the tamper-evident records that prove it ran. Frameworks covered include the EU AI Act, HIPAA, NIST AI RMF, and others.
How are records protected from tampering?
Database triggers refuse updates and deletes. Each record is linked to the previous record, write-once, so any change shows. Content can be erased for GDPR while the chain stays verifiable.
Can we export evidence for an auditor?
Yes. The Compliance Center produces an export. An auditor can open any framework control and follow it to the policy and the records behind it.
Where do the records live?
Inside your own cloud install. Raidu deploys in your AWS, GCP or Kubernetes environment.

Related

Every decision, on the record. Ready for 2 December 2027.

Book a working session