From 2 August 2026 the EU AI Act is being enforced, and from 9 December a customer
harmed by an AI decision no longer has to prove you were careless — you have to prove you were.
That proof is a record you can produce, dated, and show has not been edited since.
This page walks you through what that looks like — in plain language first, with the exact article,
deadline and artefact one click down. Everything on it is live. Nothing you do here is sent anywhere.
Most boards still file the AI Act under "2027 problem". Two of its obligations are already being enforced, and the one with the sharpest teeth is not the AI Act at all — it is the product-liability regime that arrives in December.
A single scenario at an invented Central European bank, start to finish. Read the plain-language version, and open "What the law actually says" on any step when you want the article, the deadline and the artefact.
Below is a real signed chain: a bias finding, and the technical file that answers it. Edit any value in place, or run one of the four attacks. The verdict above updates as you type — and tells you which record gave you away.
Nothing here is exotic. It is SHA-256 and Ed25519, arranged so that hiding one edit requires rewriting everything after it — and so that even a perfect rewrite is caught by a number you wrote down earlier.
Every record's hash is derived from its own content, over a canonical JSON encoding with keys sorted, so the same facts always hash the same regardless of formatting. We do not compare against a second copy that an attacker could also reach — we re-derive the hash from what is in front of us.
Each entry stores link = SHA-256(previous link ‖ own hash). Repair one record and the break simply moves downstream. To hide a single edit you must rewrite every record that follows it — which is exactly what the next two checks are for.
Ed25519 signs domain ‖ seq ‖ prevHash ‖ recordHash, not the bare link. So a valid signature cannot be lifted to another position or another chain. And a missing signature is a failure, never a skip — otherwise deleting signatures would be an attack.
An attacker holding the signing key can rebuild a flawless chain. So verification also checks the head commitment {seq, link, count} published earlier. Truncation and wholesale rewrites both fail against it — which is why an auditor keeps that one line.
Governance tools tend to assert coverage. This is the actual ruleset our engine classifies with —
served from api.riveract.ai/v1/obligations/ruleset, unauthenticated, so what
you read here cannot drift from what the product does. Pick a role and a risk tier and you get
exactly the obligations that land on it, what each one demands, what we produce for it, and where
that artefact lives.
Four surfaces. Two of them need nothing from you at all.
| Surface | Access | What it shows |
|---|---|---|
| demo.riveract.ai this page |
public | The evidence chain, verified in your browser against our production key — and the full obligation ruleset above. Nothing transmitted, no account. |
| api.riveract.ai/readiness | public | A 15-minute self-assessment returning a scored obligation map for one system, with dated deadlines and the gaps ranked. Stateless — no login, stores nothing. |
| app.riveract.ai the console |
login | The six planes against your own tenant: inventory and shadow AI, classification, findings, policy decisions and oversight, incident clocks, the evidence vault, generated Annex IV / FRIA / model cards, and the Art. 22 mandate book. |
| Danubia Group the demo tenant |
synthetic | An invented Central European bank and insurer. Every row created by a script calling the same public API you could call — no screenshots, no fixtures. It exists so a demo can show a populated console honestly. |
If you hold an exported RiverAct evidence chain — from an audit pack, a due-diligence request, or a dispute — paste it here. Verification runs in this tab. Nothing is transmitted. You can also read this page's source, or do the same job in fifty lines of your own code.
curl -s https://api.riveract.ai/v1/evidence/pubkey
curl -s https://api.riveract.ai/v1/evidence/sample
# and the RFC-3161 timestamp over an anchor's Merkle root:
openssl ts -reply -in resp.tsr -text
openssl ts -verify -digest <root> -in resp.tsr -CAfile cacert.pem -untrusted tsa.crt
Everything above is RiverAct. Two sister products cover the parts of the problem RiverAct deliberately does not, and they are at very different stages — so this section says which is which rather than implying three finished products.
node, no install and no network.
What it still does not have: an API, a database, or any decision about what a record contains. That is deliberate — the product specification is the owner's to write, and inventing it now would be work thrown away. Dossier and Score are not started.