Standards — receipts on request

The receipts room

Alignment can be claimed. We hand over receipts.

The rules for AI logging are being written now — and the Ledger was built against the full texts, not the blog posts. For each standard below, we obtained the licensed full text and reviewed the Ledger against it clause by clause: the requirement areas, how the Ledger meets them, and the date and version reviewed. Reviewed against and aligned, never certified — no auditor or regulator has endorsed these findings, and the complete reviews are available to your counsel under NDA.

ISO/IEC 24970 — AI system logging

Scope: the Sannvit Ledger as a runtime AI-logging component.

Requirement area	How the Ledger meets it	Status
Log content & required information (Cl. 5.4, 8.1)	Timestamp, source, action type, and payloads on every entry; inputs and outputs stored by reference plus a cryptographic content hash — the standard's own "reference in place of payload" pattern, with a binding it does not require.	Exceeds
Traceability & ordering (Cl. 5.6–5.7, 6.2)	Session, trace, and parent lineage on every event; entry order made cryptographically unforgeable by a hash-chained sequence, where the standard asks only that order "correspond."	Exceeds
Integrity & anomaly monitoring (Cl. 5.5, 6.4)	Continuous chain verification across a two-plane, externally time-anchored design, with alerting on integrity and capacity conditions.	Met
Event selection & human oversight (Cl. 6.1, 7.2–7.4)	Every consequential AI action captured; human-oversight events sealed with the controller's identity, not kept as editable notes.	Met
Storage, retention & access (Cl. 5.7.1, 9.1–9.4)	Persistent storage with a write-once plane, a retention floor with lawful-destruction proof, and role-scoped access enforced in the database.	Met

Reviewed 2026-07-08 against the licensed full text (ISO/IEC DIS 24970:2025). A Draft International Standard — clause numbering may change on publication, so we re-review against the published edition.

The complete clause-by-clause review is available to your counsel under NDA.

prEN 18229-1 — logging, transparency & human oversight

Scope: the Sannvit Ledger against the deployer-relevant logging clauses.

Requirement area	How the Ledger meets it	Status
Automatic lifecycle recording (Cl. 5.1–5.2)	Automatic capture of every consequential action across the system life cycle — the product's core function.	Met
Traceability levels & retention (Cl. 5.2.2, Table 1)	Every-call capture with payloads, upward-only retention overrides, and a fully queryable plane for the aggregated per-system queries the hazard tiers require.	Met
Log protection & data minimization (Cl. 5.4.3)	Hash-preserved traceability under redaction — data minimization without breaking the chain.	Exceeds
Record-based-inspection archives (Cl. 5.6)	Pointer + SHA-256 + timestamp input archives, and operator + decision + timestamp review records — the shapes the clause prescribes, field for field.	Met
AI Act correspondence (Annex ZA → Arts. 11–12)	The clauses Annex ZA maps to AI Act Articles 11–12 are the ones the Ledger implements.	Aligned

Reviewed 2026-07-08 against the licensed complete CEN Enquiry draft (EN 18229-1:2026). An Enquiry-stage draft, not yet cited in the EU Official Journal — so no presumption of conformity is claimed; we re-review at the published edition.

The complete clause-by-clause review is available to your counsel under NDA.

NIST SP 800-53 & AI RMF — audit and integrity controls

Scope: the Ledger's audit-and-integrity design against NIST SP 800-53 Rev. 5 controls and the NIST AI RMF. Alignment, not certification.

Requirement area	How the Ledger meets it	Status
Audit-record protection & separation (AU-9(2))	Audit records kept on a write-once plane, separate from the agent system they audit.	Aligned
Chain of custody (AU-10(3))	Human-review, oversight, and disposition events sealed with the reviewer's identity.	Aligned
Audit-record retention (AU-11)	A retention floor that ratchets one way, with object-lock retention on the write-once plane.	Aligned
Integrity verification (SI-7(1)/(6))	Continuous cryptographic verification (SHA-256, FIPS 180-4); integrity findings are themselves sealed into the record.	Aligned
AI RMF oversight & provenance	Human-oversight and content-provenance actions sealed into the same record, per the AI RMF's map and measure functions.	Aligned

Control-level crosswalk maintained as of 2026-08-21 (NIST SP 800-53 Rel. 5.2.0; AI RMF 1.0 and its Generative AI Profile). Hardware write-once media (AU-9(1)) is consistent with our intent but is not claimed as satisfied.

The complete clause-by-clause review is available to your counsel under NDA.

On the way in

Conformance is about the record the Ledger produces. Intake is standards-native too: it ingests the OpenTelemetry gen_ai.* semantic conventions your stack already emits, trace identities preserved — the Ledger joins your observability, it doesn't fork it.

What the rules ask. What the Ledger answers.

The obligation	What it requires	How the Ledger answers
EU AI Act Art. 12 (applies Dec 2, 2027 for high-risk AI)	Automatic recording of events over the system lifetime; ≥6-month retention	Automatic sealed capture; retention defaults measured in years, with lawful destruction that leaves proof
EU AI Act Art. 14 (human oversight)	Evidence of effective human oversight	Reviews sealed as chained records — approver, sections cited, reason — not editable notes
SEC exam focus (17a-4 / 204-2 class)	Attributable, tamper-evident records; multi-year retention	Two-plane tamper-resistant ledger, externally time-anchored; export built for examiners
Fannie Mae LL-2026-04	Disclose on request what AI is used, for what, with what safeguards	The chain of custody is the disclosure: what ran, what it relied on, who oversaw it
GDPR erasure vs. evidence duty	Destroy personal data and keep defensible records	Delete the data, keep the proof — fingerprint custody with tombstoned destruction

This table is a summary, not legal advice. The underlying documents — both conformance reviews, the wire contract, failure semantics, and the technical documentation pack — are written for exactly the person your counsel will send. Request the conformance reviews.