Your situation
You deploy AI agents on systems that matter: in finance, healthcare, infrastructure, public services, or any setting where an auditor will one day ask what the software did and why. The agents help. The question you cannot yet answer well is the auditor’s: show me the record. Not the agent’s summary of its work. The record.
Three problems
Audit trails are a legal requirement, not a nice-to-have. The EU AI Act requires high-risk AI systems to allow the automatic recording of events over their lifetime, so that their operation can be traced (Article 12), and requires deployers to keep those logs to the extent they are under their control (Article 26) (Regulation (EU) 2024/1689). In our reading, where an agent is part of a high-risk system, its actions fall within those duties.
The log the agent writes is a log the agent can touch. In a 2026 study, most of the agent harnesses tested let the agent delete or rewrite its own traces, and the authors recommend logging outside the agent’s control (Qin et al., 2026). A record that the subject of the audit can edit does not meet the standard an auditor applies to any other system. See tamper-evident log and agent trace.
The timelines are set. Under the AI Omnibus, high-risk obligations apply from 2 December 2027 for standalone systems and from 2 August 2028 for systems embedded in regulated products (Addleshaw Goddard, 2026). In parallel, a market for third-party agent certification and insurance is forming (SiliconANGLE, 2026), so the question “what did the agent do?” will come from insurers and certifiers as well as regulators. Teams that have an answer by then will have built it in 2026 and 2027.
What Inoku offers
- An independent record of what your agents did. Research-stage work on a record of agent actions that is complete, kept outside the agent’s reach, and reviewable by a person or an auditor. Not a product you can buy today. We are looking for teams to work with.
- Audit trails for AI agents under the EU AI Act. Our guide to Article 12, the Omnibus dates, deployers’ duties, and the difference between a log and evidence. Public, sourced and free.
- Inoku Verified™, for teams that also need to know how often the agent’s “done” is true before deploying it.
Status
The independent record is at research stage. Inoku Verified™ is in development, with design partners first. We will describe the record’s method when it is ready to be checked, not before.
If you run agents in a regulated or audited setting and want to shape what the record contains, contact us with the topic “Enterprise”, or become a design partner.
Evidence
Sources
Every factual claim on this page links to one of these. Numbers in brackets refer to this list.