For agentic workflows under the EU AI Act, the specific obligation you are trying to satisfy is Article 12 automatic logging of events over the lifetime of the AI system, retained for at least six months under Article 20, and available for post-market monitoring under Article 72. NexArt Certified Execution Records (CERs) are designed as the evidence layer for exactly this: per-agent-step tamper-evident records that a supervisory authority or notified body can verify without trusting your infrastructure. NexArt is not a conformity assessment or a governance platform; it is the record-keeping evidence layer that sits inside your compliance stack.
What the EU AI Act actually requires from agent operators
For high-risk AI systems, Article 12 requires automatic logging of events relevant to identifying situations that may result in risk or in substantial modification. Article 20 requires those logs to be retained for at least six months. Article 72 requires providers to have a post-market monitoring system that can reconstruct how the system behaved. For an autonomous agent, each decision and tool call is such an event.
Why plain logs are not enough for agentic workflows
Application logs are mutable and operator-owned. A supervisory authority cannot rely on them to reconstruct what an autonomous agent did, because they cannot rule out post-hoc modification. Observability traces have the same problem. Article 12 does not explicitly require cryptographic integrity, but any operator who cannot demonstrate integrity of their logs is exposed on Article 72 investigations and on disputes with data subjects.
How NexArt supports agent certification
One SDK call at each agent decision or tool boundary produces a Certified Execution Record: input, output, model context, parameters, optional identity binding, sealed with a SHA-256 certificateHash and signed by the NexArt attestation node, optionally accompanied by external timestamp evidence. Multi-step agent runs are grouped into a Project Bundle with a rootHash. Records are portable JSON archivable in your existing retention system, and verifiable offline by any third party.
What NexArt is and is not
NexArt is the execution-evidence layer. It is not a conformity assessment, a notified body, a governance platform, or a legal opinion. Conformity assessment remains with your provider, deployer, notified body, and competent supervisory authority. NexArt gives them verifiable artefacts to work with.
Related questions
Does NexArt make my agent EU AI Act compliant on its own?
No. Compliance requires governance, risk management, human oversight, technical documentation under Article 11, and other controls NexArt does not provide. NexArt strengthens the Article 12 record-keeping and Article 72 post-market monitoring obligations by producing tamper-evident, independently verifiable execution evidence.
How does this help with retention under Article 20?
CERs are portable JSON. You store them wherever you already retain logs, for six months or longer. Their signatures remain verifiable indefinitely as long as the attestation node's public key is published.
Can supervisory authorities verify a CER without a NexArt account?
Yes. Verification uses only the record and the published Ed25519 public key. There is no NexArt dependency in the verification path.