EU AI Act · Articles 12 + 14 · high-risk obligations apply 2 December 2027
Paraph is the independent, tamper-evident system of record and human-oversight layer for AI agents — across every framework. The record your agents, and the tools that build them, can’t write for themselves.
A live decision, supervised
EU AI Act · Article 12 + 14 · live decision record
Why it holds up
Observability tools were built to help engineers debug. A compliance team needs evidence it can hand over and defend — independently verifiable, not vendor-attested — and that an agent framework, by its nature, cannot provide about itself.
LangGraph, CrewAI, the OpenAI Agents SDK, your own code — one neutral record over all of it. A framework vendor can only ever instrument its own agents.
Paraph sits outside the stack that makes the decisions — and exported evidence is anchored to an independent RFC 3161 timestamp authority, so the proof doesn’t rest on trusting the agent, the framework, or us.
Every event is cryptographically linked. Alter a recorded decision and the chain breaks — detectably. You just watched it happen above.
A reviewer queue for live sign-off and a one-click evidence export — for the risk & compliance function, not only the engineers who shipped the agent.
Observability tells you what your agent did. Paraph proves the record of it hasn’t been altered since — and lets a third party check that claim without trusting us. That is the difference between telemetry and evidence.
Mapped to the letter of the Act
Article numbering per Regulation (EU) 2024/1689, as amended by the 2026 Digital Omnibus.
Why now
“High-risk AI systems shall technically allow for the automatic recording of events (‘logs’) over the lifetime of the system.”
EU AI Act, Article 12(1) · applies to Annex III high-risk systems from 2 December 2027
How it works
Instrument an agent with the SDK (TypeScript or Python), or point your existing OpenTelemetry exporter at Paraph. Nothing about your stack has to change.
Messages, tool calls, model calls, decisions — appended to a tamper-evident record in Postgres.
q.gate() pauses the agent until a human signs off. Live, in the control room.
One click exports a verifiable evidence package — the record, the sign-offs, and an integrity proof anchored outside Paraph — built to support Article 12 and 14 reviews.
const q = paraph({ apiKey, run: "loan-4821", agent: "underwriter" }); q.modelCall("underwriter", "recommend approval, pending sign-off"); // pauses here until a human resolves it const decision = await q.gate({ action: "Approve €40,000 loan", policy: "block" });
Questions compliance teams ask
High-risk AI systems must technically allow the automatic recording of events — logs — over the system's lifetime, so decisions are traceable after the fact. The Act doesn't enumerate what an 'event' is for an agent; Paraph's reading is that a defensible record captures every message, tool call, model call and decision, kept queryable and tamper-evident so it can be examined years later.
Annex III high-risk obligations — including credit decisioning and insurance underwriting — apply from 2 December 2027, postponed from August 2026 by the Digital Omnibus (adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026; AI embedded in Annex I regulated products: August 2028). The duty didn't move, and records can't be created retroactively: decisions your agents make now are provable later only if they're on the record now.
Observability is telemetry for the engineers who built the agent — made for debugging and optimising, and it does that well. Paraph is made for a different reader: an independent, vendor-neutral record where every event is hash-chained, human sign-offs are first-class, and exports carry an RFC 3161 timestamp from an independent authority — so a third party can verify the record without trusting Paraph, the framework, or the agent.
Yes, by design. Drop-in TypeScript and Python SDKs, a one-line LangChain / LangGraph callback, and OTLP ingestion that accepts any OpenTelemetry exporter with its default settings — so LangGraph, CrewAI, the OpenAI Agents SDK and hand-rolled agents all land on one neutral record.
Every event's hash covers the previous event's hash and the event's canonical content, so altering, dropping or reordering anything after the fact breaks the chain — detectably, at the exact event. Evidence exports additionally anchor the record's digest with an RFC 3161 timestamp authority, so the proof doesn't rest on trusting our database. You can watch the chain break in the demo above.
Yes — that's the point. Download the sample audit pack: a genuine anchored export with offline verifiers you run yourself (node for the hash chain and digest, openssl for the independent timestamp). Or drop any export on the /verify page — verification runs in your browser and the file never leaves your machine. The technical whitepaper walks through the whole construction.
A pilot maps Paraph to one high-risk workflow — instrumented, supervised, and on the record — in weeks.
Book a pilot →Due diligence first? Sample audit pack ↓ · Whitepaper: Evidence, not telemetry (PDF)