The EU AI Act's prohibitions have applied since February 2025 and its transparency duties since
2 August 2026; the high-risk regime follows on 2 December 2027. The nearer deadline is
9 December 2026, when a customer harmed by an AI decision no longer has to prove you were careless
— you have to prove you were. That proof is a record you can produce, dated, and show has not been
edited since.
This page walks you through what that looks like — in plain language first, with the exact article,
deadline and artefact one click down. Everything on it is live. Nothing you do here is sent anywhere.
Most boards still file the AI Act under "2027 problem". Two of its obligations are already being enforced, and the one with the sharpest teeth is not the AI Act at all — it is the product-liability regime that arrives in December.
A single scenario at an invented Central European bank, start to finish. Read the plain-language version, and open "What the law actually says" on any step when you want the article, the deadline and the artefact.
Below is a real signed chain: a bias finding, and the technical file that answers it. Edit any value in place, or run one of the four attacks. The verdict above updates as you type — and tells you which record gave you away.
Nothing here is exotic. It is SHA-256 and Ed25519, arranged so that hiding one edit requires rewriting everything after it — and so that even a perfect rewrite is caught by a number you wrote down earlier.
Every record's hash is derived from its own content, over a canonical JSON encoding with keys sorted, so the same facts always hash the same regardless of formatting. We do not compare against a second copy that an attacker could also reach — we re-derive the hash from what is in front of us.
Each entry stores link = SHA-256(previous link ‖ own hash). Repair one record and the break simply moves downstream. To hide a single edit you must rewrite every record that follows it — which is exactly what the next two checks are for.
Ed25519 signs domain ‖ seq ‖ prevHash ‖ recordHash, not the bare link. So a valid signature cannot be lifted to another position or another chain. And a missing signature is a failure, never a skip — otherwise deleting signatures would be an attack.
An attacker holding the signing key can rebuild a flawless chain. So verification also checks the head commitment {seq, link, count} published earlier. Truncation and wholesale rewrites both fail against it — which is why an auditor keeps that one line.
The four questions a careful buyer asks about an evidence layer. Each answer says what is running now and what is committed, with a date. When a date moves, this page moves with it.
openssl ts -verify against roots
you choose. A verifier that also vouches for its own trust anchors is asking to be
trusted twice, which is the failure this whole page exists to avoid.
Governance tools tend to assert coverage. This is the actual ruleset our engine classifies with —
served from api.riveract.ai/v1/obligations/ruleset, unauthenticated, so what
you read here cannot drift from what the product does. Pick a role and a risk tier and you get
exactly the obligations that land on it, what each one demands, what we produce for it, and where
that artefact lives.
Four surfaces. Two of them need nothing from you at all.
| Surface | Access | What it shows |
|---|---|---|
| demo.riveract.ai this page |
public | The evidence chain, verified in your browser against our production key — and the full obligation ruleset above. Nothing transmitted, no account. |
| api.riveract.ai/readiness | public | A 15-minute self-assessment returning a scored obligation map for one system, with dated deadlines and the gaps ranked. Stateless — no login, stores nothing. |
| app.riveract.ai the console |
login | The six planes against your own tenant: inventory and shadow AI, classification, findings, policy decisions and oversight, incident clocks, the evidence vault, generated Annex IV / FRIA / model cards, and the Art. 22 mandate book. |
| Danubia Group the demo tenant |
synthetic | An invented Central European bank and insurer. Every row created by a script calling the same public API you could call — no screenshots, no fixtures. It exists so a demo can show a populated console honestly. |
If you hold an exported RiverAct evidence chain — from an audit pack, a due-diligence request, or a dispute — paste it here. Verification runs in this tab. Nothing is transmitted. You can also read this page's source, or do the same job in fifty lines of your own code.
curl -s https://api.riveract.ai/v1/evidence/pubkey
curl -s https://api.riveract.ai/v1/evidence/sample
# the record hash is the SHA-256 of the canonical payload — sorted keys, no whitespace:
node -e 'const c=o=>JSON.stringify(o,Object.keys(o).sort());…' | sha256sum
Once third-party timestamping is switched on for a tenant, the
token over an anchor's Merkle root is checked the same way — with stock OpenSSL, against roots you
choose, with no code of ours in the loop:
# not enabled on this demo — see the roadmap above
openssl ts -verify -digest <root> -in resp.tsr -CAfile cacert.pem -untrusted tsa.crt
Everything above is RiverAct. Two sister products cover the parts of the problem RiverAct deliberately does not, and they are at very different stages — so this section says which is which rather than implying three finished products.
node, no install and no network.
What it still does not have: an API, a database, or any decision about what a record contains. That is deliberate — the product specification is the owner's to write, and inventing it now would be work thrown away. Dossier and Score are not started.