EU AI Act readiness

Article 12 of the EU AI Act enforces on 2 August 2026. Providers of high-risk AI systems must keep automatic event logs over the lifetime of the system, with a 6-month minimum retention, that cannot be retroactively altered. Penalties run up to €15M / 3% of worldwide turnover for general violations and €35M / 7% for prohibited-practice violations.

Ujex's hash-chained audit ledger maps directly to Article 12 requirements. This page documents that mapping, lists what's automatic vs. what you must configure, and provides the export tooling that hands a regulator a verifiable bundle.

What Article 12 requires

Article 12 requirement	Ujex primitive
"Automatic event logging over the lifetime of the system"	audit/{seq} collection appended on every privileged action
"Logs cannot be retroactively altered"	sha256 hash chain: hash = sha256(prevHash ‖ payloadHash ‖ timestamp ‖ seq); Firestore Security Rules deny client writes; hourly audit.verifyChain
"Retention period appropriate to the intended use; at least 6 months"	Ujex default = 12 months (matches IETF AAT § 7); TTL-bypass guard prevents misconfigured deletion
"Logs identify the natural or legal persons concerned"	payload.actorKind + payload.actorId (human uid) + payload.agentId (NHI)
"Period of each use of the system"	aat.session_id correlates rows within a session; timestamp (unix ms) is hashed into every entry
"Reference database against which the system was checked"	aat.parent_record_id chains every action to the approval / policy decision that authorised it
"Logs of input data"	Inbox stores messages/{msgId} with dkim/spf/dmarc verdicts and pi_score; ingest path emits inbound_email audit row

What's automatic

Out of the box, every auditAppend call writes a row with these AAT fields filled in:

• record_id (32-hex Ujex-minted UUID)
• agent_id, agent_version (when supplied by SDK)
• session_id, parent_record_id (when supplied)
• action_type (inferred from the action string; explicit override available)
• outcome (success / denied / error / pending)
• trust_level (high / medium / low / unknown)
• prev_hash, payload_hash, hash

Subsystems that already emit AAT rows: Inbox (ingest / send / bounce), Approvals (request / approve / deny), Memory (write / append / delete), Tools (invoke), Budgets (block / debit), Identity (key rotate / delegate / secret store), Admin (every privileged callable).

What you must configure

1. Stamp agent_version on every event. Pass agentVersion when constructing UjexComplianceClient (or agent_version on each audit.append call). Without this, exports show "unspecified" — auditable but weaker.
2. Pass session_id per conversation / task. Optional but recommended; lets auditors reconstruct multi-step workflows.
3. Set trust_level on tool-call rows. Use low when tool calls touched untrusted external input (web pages, inbound mail with PI score > 0.5).
4. Hold retention at ≥ 12 months. Ujex defaults already meet this; do not lower without legal sign-off.
5. Use Approvals on every "high-risk" verb that the operator decides for the deployment. Pair with Phase-3 approvals.policy so Article 14 (human oversight) evidence ships chained.

Export an audit bundle

Open app.ujex.dev, go to Evidence, choose the Article 12 audit window, and export the signed AAT bundle.

The zip contains:

• records.jsonl — one AAT record per line
• manifest.json — producer, range, head hash, bundle sha256
• trust-bundle.txt — offline verifier instructions

To verify the bundle offline — no Ujex deployment, stdlib-only Python:

pip install ujex-audit-chain
python -m ujex_audit_chain verify ./bundle-2026-w32.zip

ISO/IEC 42005:2025 evidence pack

Auditors who need an ISO 42005-formatted impact-assessment pack can call:

const pack = await fns.httpsCallable('auditExportISO42005')({
  from: '2026-04-01T00:00:00Z',
  to:   '2026-07-01T00:00:00Z',
});

The pack maps each ISO 42005 control reference to the Ujex primitive that satisfies it. See iso-42005.md.

Non-EU providers

Article 22 may require non-EU providers of high-risk systems to designate an authorised representative in the EU. Ujex's deployment guidance is to register the representative before deploying to EU end users; the audit bundle export already carries the producer identifier the regulator expects.

Disclaimer

Ujex ships the technical controls Article 12 names. Compliance also requires policy, governance, and DPO sign-off. This page is engineering documentation, not legal advice.