The checker
Answer for the record your agents actually keep today, not the one you plan to keep. Not sure counts as a gap, because an auditor counts it as one. Everything runs in this page; your answers are sent nowhere.
The same checker ships in the free zambo-delivery package, for answers that should not go near a web page: pip install zambo-delivery, then zambo-delivery evidence --answers yyyynnuuyyyy --pack sample-pack.html (or answer interactively with no flags). The npm package runs the same checks: npx zambo-delivery evidence --answers yyyynnuuyyyy.
The Article 12 clock, stated correctly
Pages selling audit urgency often still say the Article 12 high-risk logging duties took effect in August 2026. That is no longer the law. Regulation (EU) 2026/1744 moved the Chapter III duties, Article 12 record-keeping among them, to 2 December 2027 for Annex III systems (2 August 2028 for Annex I), and deployers keep logs for at least 6 months under Article 26(6). We state it correctly because a proof product that gets its own deadline wrong has told you what its evidence is worth.
The honest reading of the runway: it is not a reprieve. A record cannot be backfilled. Every month of agent work run without automatic logging, identity binding, and digest-committed results is a month an auditor in 2028 will sample and find empty. Building the record now, while the volume is small and the tooling change is cheap, is the whole play. The checker above tells you which parts of it you already have.
What a real evidence pack carries
The sample pack this page builds is generated from a fictional job and says so on its face. A real pack, from a real job record, carries the same shape with live contents: the job record with the caller identity recorded at execution time; the ordered steps, each with its saved result; a verifiable AER-1 receipt per step, resolving at a stable public link; the approval record, because the receiver's pickup and sign-off are events on the record, not messages in a chat; and the retention note. Anyone holding the pack can recompute each receipt's digest and compare it with what was saved. A receipt proves the saved result was not changed after it was saved; it never proves the work was correct. The approver's recorded check is where judgment lives, and the pack keeps the two separate instead of blurring them.
That separation is what most agent record-keeping gets wrong. A log the keeper can edit, verify only with the keeper's login, and export only as screenshots is a claim about the work. A record with digest commitments, a public check, and an approval event is evidence about it. Auditors know the difference even when the dashboard looks the same.
Questions, answered
What does EU AI Act Article 12 require for record-keeping?
For high-risk AI systems, automatic recording of events over the system's lifetime: logs that allow tracing of what happened, when, and under whose control, kept by deployers for at least 6 months (Article 26(6)). The checker asks whether your agent record has the properties those duties presume: automatic logging, per-event fields, identity traceability, and retention.
When do the Article 12 record-keeping duties apply?
2 December 2027 for Annex III high-risk systems, under Regulation (EU) 2026/1744, which moved the date from August 2026. A runway, not a reprieve: a record can only be kept from the day the logging exists, and earlier gaps cannot be backfilled. Start while it is cheap.
What evidence does SOC 2 CC7.2 expect for system operations?
Evidence that operations are controlled and reviewable: who approved an action, what changed in configuration, and a complete record an outsider can inspect. For agent work the weak points are approvals that happen in chat and vanish, silent configuration changes, and a record that cannot be exported as one pack.
Does a good score mean we are compliant?
No. The checker scores your answers about your process; it cannot inspect your systems, and no score is a certification, an audit opinion, or a compliance determination. What it gives you is the gap map: the places your record would fail to answer an auditor's questions, named while you can still fix them, each with what closes it.
What is a sample evidence pack?
A single file in the shape an auditor receives for one job: the job record, its steps with the saved result of each, a verifiable receipt per step, the approval record, and the retention note. The pack this page builds comes from a fictional job and is labeled SAMPLE in the title, the header, and the footer; it demonstrates the format and is not evidence about any real job. On a real Zambo job the same pack carries live receipt links anyone can recompute.
What does it cost to work this way?
Checking is free, here and in the zambo-delivery package. Running the work on Zambo, where the record closes most of these gaps by construction, starts on the free tier: 20 calls + 1 wrap-up free every day, and picking up a job in another AI is always free. A Day Pass is $0.99 one time and covers 24 hours. The Zambo Pass is $29 for 30 days, and $19 for 30 days for $ZAMBO holders. A Lifetime Pass is $250, one payment. Full pricing: https://zambo.dev/pricing