The Evidence Layer
The record-keeping architecture your legal team needs in order to make the claim — ending with a verifier your auditor can run against an export, with no access to me and no access to you.
The problem it solves
Article 12 says the log must exist. It says nothing about how to stop it being rewritten — and every piece of published guidance restates the obligation and stops, because the standards are still drafts.
Who buys it: Head of Quality, Chief Risk, General Counsel or CTO with a named compliance budget line. Never sold to an engineering manager.
What lands
- The evidence architecture: canonical serialisation, hashing at the trust boundary, domain-separated Merkle commitment, witnessed roots, write-once retention.
- A working verifier a third party can run against an export — without access to me and without access to you.
- One proven deterministic replay: state rebuilt from the log alone, byte-identical.
- The threat model, written down: what the architecture detects, what it prevents, and the difference between those two.
- A conformance checklist mapped to the obligation, mechanism by mechanism.
What this is not
- Architecture supports a conformity case. It never confers conformity — that is a property of your whole quality management system, not of a logging library.
- Not legal advice, and not a substitute for your notified body or your Qualified Person.
- No production implementation beyond the design, the verifier and the proven replay. Implementation is quoted separately once the design is agreed.
- No certification, and no claim that your system is compliant.
Who shouldn't buy it: Anyone who wants a compliance badge. This is the engineering the assessment is performed against, not the assessment.
The guarantee
The verifier runs against your export, on your infrastructure, with no dependency on me. If it cannot, the engagement is rebuilt at my cost before any refund conversation.
Why me
Hashing before processing, Merkle anchoring with domain-separated prefixes, RFC 3161 timestamping and deterministic replay are the primitives I already run. The method is published — you can read the whole argument before you buy.
Questions people actually ask
Does this make us compliant?
No. It builds the record-keeping architecture that a conformity assessment is performed against. Compliance is a property of your organisation, and anyone selling you otherwise is selling you a problem.
When does the obligation actually bite?
For stand-alone high-risk systems, 2 December 2027 — deferred from 2 August 2026 by the Digital Omnibus. Most published guidance still cites the old date. Systems designed now will still be running then.
Why not just use a blockchain?
A blockchain solves agreement on ordering between parties who distrust each other. An audit log has one writer and nobody disputing the order. The useful subset — witnessed publication of a periodic root — is one line of the design.