Record fields and EU AI Act and NIST asks

This page maps what a registry record holds to what regulators and frameworks ask organizations to be able to show. It is a reference, not a compliance claim and not legal advice: whether a record meets an obligation depends on the system, its risk class and the jurisdiction. Have counsel review before relying on it.

What a record gives you

• What was made, by which model, from which inputs: a provenance record's artifact, model and inputs, signed with your key.
• When: the appended time, the daily root that includes the record, and that root's RFC 3161 timestamps.
• Unchanged since: the record's SHA-256 digest and its inclusion proof against a published root.
• Who signed: the publisher's registered ES256 or Ed25519 key, listed in the public key directory.
• Corrections: errata append to the record and never replace it.
• Kept and checkable by others: the log is append-only, mirrored in nightly CC0 dumps, and exportable as a bundle an auditor checks offline.

EU AI Act (Regulation (EU) 2024/1689)

• Article 12, record-keeping for high-risk systems: automatic logging of events over the system's lifetime. Registry records can hold the hashes of those logs, so the logs themselves stay private while their existence and integrity at a time are provable.
• Articles 18 and 19, keeping documentation and logs: retention periods are set by the Act. The registry keeps records permanently, which outlasts any retention period.
• Article 50(2), marking synthetic content: providers must mark generated outputs in a machine-readable way. A provenance record is an outside, signed statement about an output; it complements an embedded mark and does not replace one.
• Annex IV, technical documentation: a verification record pins the evaluation method (the judge model and prompt by hash) used at a point in time.

NIST AI Risk Management Framework (AI RMF 1.0) and the Generative AI Profile (NIST AI 600-1)

• Govern and Manage: an append-only, publicly anchored history of what a system produced and how it was checked supports accountability and incident review.
• Measure: verification records keep the evaluation method fixed by hash, so a result can be reproduced or re-checked later.
• Information integrity and content provenance (Generative AI Profile): provenance records and the embed snippet let readers trace AI content to its origin.

What a record does not do

It does not prove the contents are true, and it does not show who authored the underlying work, only who signed the record. It is one piece of evidence, held outside the party with something to prove.