Direct answer
How do you prove AI work for compliance?
With evidence, not with logs. A log is a claim your system makes about itself. Evidence is a record a third party can recheck without trusting you. To prove AI work for compliance, run the work so every call saves that kind of record at the moment it runs, then hand the reviewer the records plus a verification result they can rerun on their own.
Updated October 24, 2026.
Log versus evidence, in one table worth keeping
A log is written by the system under review, stored by the operator being reviewed, and read on trust. Edit it after the fact and nothing in the file complains. Export it from a dashboard and the auditor is looking at a picture of data, not data they can test.
Evidence is saved at execution, one record per call, with the saved result committed so a later change shows up when anyone recomputes the check. The reviewer does not need your dashboard, your account, or your permission. They need the record and the public verifier.
Most compliance findings about AI work live in the gap between those two rows. Teams arrive with plenty of logs and nothing an outsider can recheck, and the review stalls on the only question that matters: why should anyone believe this record?
The record all of this runs on, stated exactly: an agent receipt is a record of one ai agent tool call that anyone can check: it keeps the exact saved bytes and their sha-256 digest, and it proves the result was not changed since it was saved, not that it was right.
The five step proof routine
1. Record at execution, not after. Every tool call that touches real work saves its record as it runs: tool, caller, timestamp, inputs, and the result exactly as returned. Reconstruction from chat history afterwards is a summary, not a record.
2. Keep one record per call, in sequence. Per-call records make omissions visible. A missing call is a gap in the sequence, not an invisible absence.
3. Make the record recheckable by a stranger. On Zambo, each call through zambo.dev/mcp returns a verifiable AER-1 receipt, following AER-1, an IETF Internet-Draft (draft-zambo-aer1-26), with a public conformance corpus of 126 vectors and 129 checks in kit v1.5.7. Anyone can paste the receipt ID into zambo.dev/verify and confirm the saved result was not changed since it was saved.
4. Hand over the set, not a screenshot. Give the reviewer the receipt set for the period, the verification output, and your short mapping of which governance control each field answers. Nothing in the packet should require trusting your own tooling.
5. Record the failures too. Rejected calls issue receipts on Zambo as well. A compliance trail that only shows successes is a curated story; a trail that shows the rejected call, and why, is a record.
Live receipts, including a rejected call
Real receipts minted for this page on October 24, 2026. Each URL returned HTTP 200 when checked:
- zambo.dev/run/6b7a7b1b: a successful live price call. Status: success. This is the basic unit: what ran, when, and the result as saved.
- zambo.dev/run/49133b10: a successful capability search across the Zambo tool catalog. Status: success. A different tool, the same record shape, which is what makes a mixed trail reviewable.
- zambo.dev/run/abc62e2d: a deliberately invalid
handover_statuscall, sent without its required handover ID. It was rejected before execution, and the rejection still issued a receipt. Status: error receipt. For compliance, this is the receipt that proves the trail does not only keep the wins.
Where EU AI Act Article 12 fits
Article 12 of Regulation (EU) 2024/1689, titled Record-keeping, is the part of the EU AI Act that asks high-risk AI systems to record events automatically over the lifetime of the system, at a level of traceability appropriate to the intended purpose. For the Annex III point 1(a) systems it names minimum content: the period of each use, the reference database input data was checked against, the input data that led to a match, and the identification of the natural persons involved in verifying the results. The full text is on EUR-Lex, Regulation (EU) 2024/1689, and this hub walks the mapping in depth on its EU AI Act Article 12 logging for AI agents page, with the wider packet view on AI agent compliance evidence and the working list on the AI agent compliance checklist.
The honest mapping is narrow. Article 12 asks for automatic recording and traceability. A per-call receipt trail is one concrete way to produce records with those properties, and AER-1 carries an informative mapping to Article 12. Producing receipts does not by itself make any system compliant, and this page is a record-keeping guide, not legal advice and not a certification.
What an auditor can recheck without an account
None of these checks needs a Zambo account, a login, or Zambo's permission. Each one runs on the public record, and the worked example under the table is live.
| What the auditor rechecks | How, with no account | What it settles |
|---|---|---|
| Open the receipt page | Follow the public receipt link from the work product, for example this live receipt | The exact saved bytes and their sha-256 digest are public, not held back by the vendor |
| Recompute the digest | Run sha-256 over the saved bytes, or run the offline verifiers: aer1-verify for Python, aer-1 for npm | The saved result was not changed since it was saved |
| Run the public verifier | Paste the receipt ID into zambo.dev/verify, free | An endpoint the auditor does not control evaluates the same record and returns the outcome |
| Open the job's chain check | Follow the job's public chain link, for example this session's chain check | The steps sit in the order they were written, with none quietly inserted afterward |
| Check a rejected call | Open the receipt issued for a call that was refused | Receipts issue for rejected calls too, so the trail does not only keep the wins |
Worked example: the three receipts from one real session, a capability search, a live BTC price, and a journal entry, are on the receipt for this conversation page, with the chain check linked from it. An auditor can recheck every row of this table against that session in minutes.
Honest limits
A receipt proves the saved result was not changed since it was saved. It never proves the answer was right. Evidence also only exists for work that ran through a recording path: AI work done entirely outside it leaves no receipt, and the correct compliance answer for that work is that it is unrecorded, not that it probably happened. Finally, retention, access control, and the legal question of whether your system falls under Article 12 at all are yours and your counsel's to settle. Good records make those questions answerable; they do not answer them for you.
Run it on a record instead
Work run through the Zambo MCP endpoint at zambo.dev/mcp (153 tools in total, 35 on the default surface) saves its result at execution and returns a verifiable AER-1 receipt for every call, rejected calls included. Start free: 20 free calls per day, then they upgrade. The Day Pass is $0.99 for 24 hours, the Pass is $29 for 30 days, one payment, and checking any receipt is always free at zambo.dev/verify.
Frequently asked questions
How do you prove AI work for compliance?
Stop handing over logs and start handing over evidence. For each piece of AI work, keep a per-call record that was saved automatically when the work ran, that names the tool, the caller, the time, what went in, and what came back, and that a third party can recheck without your help. On Zambo, every tool call through https://zambo.dev/mcp produces that record as a verifiable AER-1 receipt. Assemble the receipts for the period under review, run them through the public verifier at zambo.dev/verify, and hand the auditor the receipt set plus the verification output. The auditor can rerun the same check alone, which is the point.
What is the difference between a log and evidence?
A log is a claim your system makes about itself. The system under review wrote it, stores it, and can in principle rewrite it, so an auditor reading a log is trusting the party being audited. Evidence is a record a third party can recheck: the saved result is committed at the moment the work runs, and anyone can recompute that commitment later and see whether the record still matches. If one byte changed after the fact, the check fails. Logs describe. Evidence survives distrust.
What does EU AI Act Article 12 require for record-keeping?
Article 12 of Regulation (EU) 2024/1689 covers high-risk AI systems. Paragraph 1 says high-risk AI systems shall technically allow for the automatic recording of events, called logs in the article, over the lifetime of the system. Paragraph 2 says logging capabilities shall enable recording of events relevant for identifying situations that may result in the system presenting a risk, facilitating post-market monitoring, and monitoring the operation of the systems referred to in Article 26(5), at a level of traceability appropriate to the intended purpose. Paragraph 3 adds minimum fields for the Annex III point 1(a) systems: the period of each use with start and end time, the reference database against which input data was checked, the input data for which the search led to a match, and the identification of the natural persons involved in verifying the results. Article 12 is a record-keeping duty, not a certification, and whether a given system is high-risk is a legal determination for your own counsel.
Does a receipt prove the AI work was correct?
No. A receipt proves the saved result was not changed since it was saved. It does not prove the answer was right, the decision was fair, or the policy behind the work was sound. That distinction is what makes the record useful in a compliance review: the evidence layer settles what ran and what it returned, and the governance layer judges whether it should have. Keep the two layers labelled and separate.
What does it cost to start producing compliance grade records?
Checking any receipt is free at zambo.dev/verify. Running work through Zambo starts on the free tier: 20 free calls per day, then they upgrade. A Day Pass is $0.99, one payment, for 24 hours. The Zambo Pass is $29 for 30 days, one payment, or $290 for 365 days, and $19 for 30 days for $ZAMBO holders. Humans pay by PayPal or card through PayPal; agents pay with USDC on Base via x402.
Related
- AI agent audit trail: compliance evidence on zambo.dev
- EU AI Act Article 12 logging for AI agents
- AI agent compliance evidence: proof governance teams check
- AI agent compliance checklist: the evidence you actually need
- AI agent execution log versus receipt
- How do you verify a handover inside an agent swarm?
- The Zambo MCP endpoint
- My client wants me to work for free first to prove myself. Should I do a free trial?
Proof works best when it travels with the work itself. The AER-1 badge kit turns verifiable receipts into an embeddable badge for project pages, docs, and profiles, so anyone who sees the claim can reach the check in one click.