The Verifiable Enterprise

For most of the last decade the artificial intelligence industry ran on an unspoken bargain. Build the capability first, worry about accountability later. It was a reasonable bargain when the systems were toys, recommendation engines nudging us toward another video, spam filters quietly sorting our inboxes. The cost of being wrong was small and the people affected rarely noticed. That world is gone. Today an AI system inside a bank decides whether a small business gets a loan

Article 12 of the EU Artificial Intelligence Act is brief enough to read in a minute and consequential enough to reshape an engineering roadmap. It requires that high-risk AI systems technically allow for the automatic recording of events, the logs, over the lifetime of the system. It specifies that this logging capability must enable the recording of events relevant to identifying situations that may result in the system presenting a risk, to facilitating post-market monitor

When we designed the Open Audit Record we adopted a single discipline that shaped every decision after it. Assume the reader is hostile. Not malicious necessarily, but unwilling to take the enterprise's word for anything, the way a good auditor or an opposing expert witness is professionally unwilling. Design a record for a friendly reader, someone who basically trusts you and just wants the gist, and you will build something convenient and useless under pressure. Design for