An audit trail for AI data, built for the EU AI Act era.
Article 12 of the EU AI Act asks high-risk AI systems for automatic record-keeping across the system lifecycle. Supported Dynamic Feed paths provide signed data records, and selected decision inputs can be witnessed through notarization. Evidence, not a conformity assessment.
The call
Signed data in, witnessed records out. Each step is independently verifiable against the published key — your auditor doesn't have to trust you, or us.
# 1) ground the decision in signed data (every response is Ed25519-signed)
curl -X POST https://dynamicfeed.ai/v1/batch -H "Content-Type: application/json" \
-d '{"calls":[{"tool":"sanctions_screen","args":{"name":"ACME GMBH"}}]}'
# 2) notarize the exact input your AI acted on (hash-only — nothing sensitive leaves)
curl -X POST https://dynamicfeed.ai/v1/notarize -H "X-API-Key: $KEY" \
-d '{"payload_sha256": "", "subject": "acme-claims-bot"}'
# 3) later, for the auditor: inspect the record commitment and chain proof
curl https://dynamicfeed.ai/v1/notary/log/123/proof Sample response
{ "schema": "notary/v1", "mode": "hash_only",
"witnessed_at": "2026-06-12T03:14:09+00:00",
"payload_sha256": "1f4c…", "subject": "acme-claims-bot",
"log": { "idx": 124, "prev_hash": "9b2e…" },
"signature": { "alg": "Ed25519", "key_id": "df-ed25519-…" } }Why live data
When a regulator, auditor or claimant asks what your AI system knew at decision time, a row in your own database may be a weak answer because you administer it. A stronger trail preserves provenance, signs supported records and witnesses the exact consumed bytes or their digest through /v1/notarize. The hash-chained log relationships and canonical record commitment should be recomputed during verification. Independent time evidence, if required, needs a separately requested and fully validated RFC 3161 artifact. This is not legal advice or a conformity assessment.
Use it for
- High-risk AI deployers building Article-12-style record-keeping
- Fintech and insurance AI recording decision inputs for disputes
- AI vendors answering enterprise procurement's 'how would we audit it?'
- Post-incident reconstruction: what did the system know, and when
FAQ
Does using this make my AI system EU AI Act compliant?
No — nobody's API can make you compliant, and you should distrust anyone who claims otherwise. Compliance is a process: risk management, documentation, oversight, conformity assessment. What this provides is one verifiable component — tamper-evident records of the data side — that your compliance process can build on. Talk to your counsel.
Why isn't logging to my own database enough?
Because you administer it. A signed witness record and recomputable hash-chain commitment provide additional integrity evidence. They do not by themselves establish objective truth or independent time.
What exactly gets recorded?
Whatever you choose: in hash-only mode just a sha256 and a timestamp — the content never leaves your infrastructure. The grounded data itself (sanctions screens, market data, weather, any of the 94 tools) is signed and provenance-stamped at the source.
Does this matter outside the EU?
Yes — the same record-keeping pattern answers auditors, insurers and courts anywhere. The EU AI Act is simply the loudest current driver.
What does it cost?
Signed data is keyless to try; notarizations run on any plan's quota, and a dedicated Notary plan is in early access — see /notary.