What did the agent do?
Runfile’s answerEvery prompt, tool call and approval, captured as it happens.
Different regulators, different deadlines, one demand: show what your agent did, and prove the record hasn’t changed. Find the rules that apply to you in under a minute.
Strip away the legal language and every framework below wants the same things from your AI agents. Answer these five and you’re most of the way there.
Runfile’s answerEvery prompt, tool call and approval, captured as it happens.
Runfile’s answerEach event is sealed to the one before it, so any edit shows.
Runfile’s answerThe approver, time and reason, signed into the record.
Runfile’s answerReplay any run step by step, with the exact inputs it saw.
Runfile’s answerRetention set per rule, from six months to seven years.
| Framework | Record every step | Prove it’s unchanged | Show who approved | Rebuild any decision | Keep it for years |
|---|---|---|---|---|---|
| EU AI ActEU | |||||
| DORAEU financial services | |||||
| US model-risk guidanceUS banking | |||||
| GDPREU · UK | |||||
| SOX §404US public companies | |||||
| HIPAAUS healthcare |
Simplified for orientation, based on public guidance current to May 2026. Not legal advice.
Answer three quick questions. We’ll show which major rules likely apply, and when they bite.
Pick all that apply.
rules likely apply to youA starting point, not legal advice.
These six carry concrete, dateable demands for records of what an AI system did. Open any one to see what you’ll need to show, and how Runfile covers it.
A monthly Article 12 log-integrity report, produced with a single command.
High-risk AI systems must “technically allow for the automatic recording of events over the lifetime of the system,” and deployers must retain those logs for at least six months, a floor rather than a target. Article 17 adds a Quality Management System; Annex IV adds technical documentation.
The Act does not explicitly require cryptographic logs, but it does require completeness, integrity and reconstruction. A mutable log fails all three.
The May 2026 Digital Omnibus moved standalone high-risk obligations to 2 Dec 2027 and embedded high-risk to 2 Aug 2028, both now fixed calendar dates. Tier 1 penalties (prohibited practices) run to €35M / 7%; Tier 3 (incorrect information) to €7.5M / 1%.
Incident packets generated straight from the captured events, with hashes that hold up across the reporting timeline.
Live across EU financial services since 17 Jan 2025: ICT risk management, an ICT third-party register, incident reporting and audit trails. Mid-2025 BaFin guidance pulled AI explicitly into DORA scope; the UK CTP regime adopted parallel rules from 1 Jan 2025.
An annual model-documentation pack and a continuous monitoring report, mapped to those three pillars.
On 17 April 2026 the Fed, FDIC and OCC rescinded SR 11-7, SR 21-8, OCC 2011-12, the OCC MRM Handbook booklet and OCC Bulletins 1997-24 and 2021-19, replacing them with risk-tiered, principles-based, technology-neutral interagency guidance. The agencies signalled a forthcoming AI-specific RFI; dedicated agentic-AI guidance is still pending. SR 11-7’s three pillars remain the template AI systems will be measured against.
Captures the human approval, with identity, timestamp and signed justification, that takes a decision out of “solely automated”.
Article 22 governs automated decisions with legal or similarly significant effect on a person; Article 30 mandates records of processing. When an agent denies credit, declines a claim or routes a hire, both articles fire.
Seven-year retention, continuous integrity proofs and point-in-time queries on any control event.
When an agent triggers or affects a financial control, such as revenue recognition, journal entries or period close, the agent action becomes SOX-relevant. Internal Audit teams already worry about this; few have the records to answer.
BAA-capable from day one, with healthcare data residency on request.
When an agent is the actor touching PHI, the covered entity needs an identifiable agent principal, the action, the PHI fields touched and any human approval.
Dates reflect public guidance current to May 2026, including the Digital Omnibus. Confirm with your regulatory counsel.
Principles-based regimes that matter to your auditor. We cover them, but we won’t pretend they come with deadlines.
Govern, Map, Measure, Manage: a voluntary US vocabulary.
Runfile: Event-graph mapping to MEASURE and MANAGE outcomes; CSA Agentic Profile companion.
SupportedA certifiable AI management system. Procurement pull is real.
Runfile: The evidence repository feeds your 42001 audit out of the box.
Supported · own cert Q2 2027Technology-neutral: SS1/23 model-risk principles, Consumer Duty, SMCR.
Runfile: UK residency, an SS1/23 documentation pack, Live Testing compatible.
SupportedExisting rules apply to AI-assisted communications and supervision.
Runfile: Communication-side agent capture with supervisor approval trails.
SupportedA risk-management programme for high-risk AI, plus consumer notice.
Runfile: Risk-management programme template and audit-ready evidence.
Supported · confirm date with counselResponsible AI governance with documented controls.
Runfile: The same evidence pack, retitled for state filings.
Supported · confirm with counselTrust services criteria with AICPA AI add-ons.
Runfile: Runfile is SOC 2 Type II, and helps your own AI engagement too.
Both directionsPredetermined change control with full change logs.
Runfile: Captured natively, with a PCCP-mode export.
On requestWe’ll send the actual evidence-package PDF for the framework most relevant to your remit — redacted reference data, real cryptographic structure.
Dates above reflect public guidance current to May 2026, including the Digital Omnibus. For programme decisions, confirm with your regulatory counsel.