Engineering and regulatory deep-dives

Day 180 is the six-month floor in Art. 19(1) and 26(6). At 1,000 conversations a day, a default setup then holds 180,000 plain-text transcripts: names, CPR numbers, diagnoses, whatever users typed.Fair note. LangSmith and Helicone offer masking, self-hosting and EU regions. Teams must configure them; the default logs raw text. Based on public documentation, October 2026.

§What each law asks

§The precise claim

Storing prompts is not unlawful in itself; with a lawful basis and short retention, many teams keep them for debugging. The conflict starts when the AI Act becomes the reason to keep them. And users volunteer Art. 9 health data (“I’m in hospital this week”), so free text cannot be bounded in advance. Only what you keep can.

A compliant log proves what happened. It does not need to hold what was said.

§Keyed HMAC: prove it, keep nothing said

Same text and key, same digest. So a disputed transcript is verified by recomputing, without the log ever holding it. The key matters: a plain SHA-256 of a CPR number is enumerable in seconds; without your key, the HMAC is not.Key custody. Keep the key in a KMS apart from the logs, rotate it, and record key_version.

// Captured on every request, kept for the store's retention period
tracer.log({
  user_id: session.userId,
  prompt: messages.at(-1).content,
  completion: result.text,
  tools: result.toolCalls,
});

import { createHmac } from "node:crypto";

const seal = (s: string) =>
  createHmac("sha256", process.env.SPURVIK_HMAC_KEY!)
    .update(s.normalize("NFC"))
    .digest("hex"); // 64 hex characters

events.write({
  schema: "spurvik.art12.event.v1",
  system_id: "support-assistant@4.2.0",
  input_digest: seal(prompt),
  output_digest: seal(result.text),
  router_action: decision.enforcedAction,
  art50_notice_shown: true,
  occurred_at: new Date().toISOString(),
});

One precision a DPO will ask for: a keyed-HMAC digest is pseudonymised data under GDPR Art. 4(5), not anonymous, while the key exists. Treat the store as personal data. What shrinks is what you hold, digests instead of transcripts. That is all “zero-PII” means here: no raw personal data persisted.Erasure. Destroying a key version makes its digests unlinkable, and unverifiable. Align key lifetimes with retention.

§What the record holds

SDK v1.0 writes these sealed events today, into a store you choose in the EU. Hosted fra1 retention: planned

§Timing

Regulation (EU) 2026/1744 set that date. Choosing a record format now costs less than deleting six months of transcripts later.

§Questions for engineering

• Which systems write prompt text to logs, where, and for how long?
• Where “AI Act compliance” justifies retention, does that article need the text?
• Who holds the HMAC key, and how is it rotated?
• Can you verify a disputed transcript without storing it?

§Try the router

Pick send_payment and flip shadow and active: the enforced action stays ask_human. Pick No signals: proceed wins with only about 55%, because four 0.2 logits still share the mass.Receipt key. The figure uses a public demo key. In production the key is yours and never leaves your infrastructure.

§Two failures a log cannot undo

Art. 14(4)(d) and (e) require that a person can override the output or halt the system. Both presuppose the decision point comes before the irreversible act.Scope. Art. 14 binds high-risk systems; for Annex III it applies from 2 December 2027. Many teams gate every side-effecting agent anyway.

§Why deterministic

The name borrows Kahneman’s System 1: the reflex that fires before the model deliberates. Internally, Jev.Status. Ships in SDK v1.0: npm i @spurvik/sdk.

§The exact code

export const SIDE_EFFECT_VERBS =
  /(?:^|[^a-zA-Z0-9])(send|dispatch|email(?!_redacted)|publish|post|pay|payment|transfer|charge|delete|drop|purge|destroy|wire|execute_payment|outbound)(?:$|[^a-zA-Z0-9])/i;

const combined = `${state.goal} ${state.task_type} ${state.last_error}`.toLowerCase();
const isSideEffect = SIDE_EFFECT_VERBS.test(combined);
const hasError = state.last_error && !/^none|ok|null$/i.test(state.last_error.trim());
const hasCache = /\b(cached|artifact_exists|fresh_cache)\b/i.test(combined);
const isCapped = /\b(sources?[=:\s]+[5-9]|research_capped|enough_sources)\b/i.test(combined);

const logits: Record<SystemOneAction, number> = {
  proceed: 1.8,
  reuse_cache: hasCache && !hasError ? 3.8 : 0.2,
  stop_retry: hasError && state.repeats >= 2 ? 4.4 : 0.2,
  research_capped: isCapped ? 3.7 : 0.2,
  ask_human: isSideEffect ? 4.8 : 0.2,
};

// softmax over the logits; argmax becomes `choice`

if (isSideEffect) choice = "ask_human";

const enforcedAction: SystemOneAction =
  choice === "ask_human" ? "ask_human" : mode === "active" ? choice : "proceed";

The override runs after the argmax, so no mix of other signals can outvote ask_human, and the enforced action checks for it before it reads the mode.

§Shadow first, then active

Shadow mode records every counterfactual, each with an HMAC-SHA256 receipt. That record is your evidence for switching to active.

const hmacReceipt = createHmac("sha256", key)
  .update(`${timestamp}|${state.goal}|${state.task_type}|${choice}|${bestP}`)
  .digest("hex");

§Limits, stated plainly

• Lexical. send_payment matches; remit_funds does not. Test tool names when you register them.
• No content judgement. It decides whether to pause; the reviewer judges the content.
• Determinism is not correctness. Shadow mode measures how often the rules disagree with a careful person.

§Six stages, A to F

A to C live inside one company: where does AI run, were people told, could a person stop it? D and E turn those answers into evidence that survives time. F carries it across a company boundary.

§Why a chain, not a table

Each entry’s HMAC covers the previous entry’s HMAC, so removing or editing one breaks verification from that point on. Entries hold digests and structural fields only, kept at least six months (Art. 19(1), 26(6)).Where it runs. SDK v1.0 seals and verifies chains today. Hosted retention in Frankfurt (fra1) is planned.

export function verifyArt12HmacChain(chain, hmacKey) {
  let prev = "GENESIS";
  for (const entry of chain) {
    if (entry.previousHmac !== prev) return false;
    const expected = createHmac("sha256", hmacKey)
      .update(`${entry.eventId}|${entry.timestamp}|${entry.payloadHash}|${entry.previousHmac}`)
      .digest("hex");
    if (expected !== entry.entryHmac) return false;
    prev = entry.entryHmac;
  }
  return true;
}

§Signed mandates, decaying authority

A mandate states which tools an agent may call, what it may spend and how far it may delegate. It is canonicalised RFC 8785-style, signed with Ed25519 and identified by did:key, so counterparties verify it offline. Each hop multiplies the caps by authorityDecayFactor; beyond maxDepth 3, delegation is rejected.Field names. v1.0 keeps the Usd suffix on cap fields; currency sets the unit.

§The machine courtroom

Checks run in a fixed order and stop at the first failure. Integrity first: a verdict on a tampered log is worthless. Bounds before oversight: a reviewer’s click cannot approve a counterparty the mandate never allowed. The liable entity is always the mandate issuer, and the verdict itself is signed.

§What this is not

• Not a court. It reads a mandate both parties relied on; disputes still go where the contract sends them.
• Not a conformity assessment. Nothing here certifies an AI system. prEN 18286 is a draft not yet cited in the Official Journal, so it gives no presumption of conformity.
• Not finished. A to C ship in SDK v1.0; hosted D is planned; E is a Scale-tier export; F is protocol v1.0.

“Planetary” means scope: the jurisdiction field (EU-DK, US-DE, UK-LLOYDS, GLOBAL) lets agents under different regimes verify each other. We start with Denmark.