The EU AI Act is creating a generation of evidence engineers

GDPR created a generation of privacy engineers. The EU AI Act is creating a generation of evidence engineers.

GDPR wasn’t just fines — it opened a job market. Privacy by design, data lineage, records of processing became engineering disciplines. The AI Act looks like it will do the same, and for banks the calendar is already set.

Annex III high-risk obligations start 2 December 2027 (Art. 113(c)), including 5(b), which lands squarely in banking: AI that evaluates the creditworthiness of natural persons.

Two articles that read like architecture specs

I spent the evening reading how the Act impacts banking decision systems. Two articles read less like law, more like architecture specs:

• Art. 12 (Record-Keeping): high-risk systems must automatically record events over their lifetime — traceability of functioning, substantial modifications, post-market monitoring (Art. 72), deployer monitoring (Art. 26(5)).
• Art. 14 (Human Oversight): oversight persons must be able to understand the system’s limits, monitor it, stay aware of automation bias, correctly interpret the output with proper tools, and disregard, override or reverse it.

Where teams get stuck

Much of “human in the loop” is implemented on paper — an attestation that someone reviewed the AI output. But if the record of what the machine decided lives in a database anyone with the right role can modify, you can’t show what was actually reviewed. The attestation and the record never connect.

The usual answers don’t hold: insert-only DB roles (admins can still change state) or blockchain as the record store (overkill, we agree). The problem underneath: a database cannot testify about itself. Whatever produces the evidence shouldn’t hold the keys to it.

A shape that works: tamper-evidence, not immutability

The shape that keeps working for me is unglamorous — basically the same trick we already use for signed documents, applied to decisions:

1. Decision events emitted inside the same transaction as the business change. No decision without a record.
2. Each event linked to the previous one by a hash — any later edit breaks the chain and shows where.
3. Periodically, fingerprint the window of events and seal it with an external timestamp service (RFC 3161, as in document signing), kept where admins can’t rewrite it.
4. Human reviews recorded in the same chain: who checked, the fingerprint of the state they saw, accepted or overrode.
5. A read-only verifier recomputes everything from exports — no access to the live system.

The database stays mutable — it’s the operational store — but silently rewriting it breaks the chain. The property we’re buying is not immutability. It’s tamper-evidence.

Between now and December 2027

Between now and December 2027 someone has to build this: record architectures that satisfy Art. 12, oversight tooling that makes Art. 14 checkable, evidence bundles that survive an audit. If you’re reading these articles too, let’s compare notes — especially curious how other teams plan to evidence human oversight. Happy to share ideas.

#EUAIACT #AIGovernance #Banking #Compliance #EvidenceEngineering