AI Act: what the pipeline provides.
And what remains your responsibility.

Art. 5

Prohibited AI practices — P3, P4

Systems using subliminal techniques or exploiting vulnerabilities to alter human behaviour. CERVEAU's prohibitions P3 (manipulation) and P4 (dependency) target this perimeter: they are designed to apply at every call that goes through the pipeline; their effectiveness will be measured on corpora during the campaign and published afterwards, favourable or not, on /en/mesures (known limits on /en/limites).

Art. 50

AI transparency and identification

Any conversational AI must identify itself as AI. CERVEAU's prohibition P8 applies this in the pipeline; operator configuration cannot disable it (the Guardian rejects a configuration that would weaken it).

Art. 12

Log retention and record-keeping

High-risk AI systems must retain automatic operation logs. A timestamped HMAC-SHA256-signed attestation is produced for responses that go through the brain; your application receives and keeps it. It does not prove that a given response of your application went through it. The log written by the brain at every exchange, kept at least six months, is coming; whether your system is high-risk remains your own assessment.

Art. 13

Transparency and documentation

Deployers must be able to document their compliance. The builder dashboard plans a timestamped log report export; while the brain-side source does not answer, it shows “unavailable”, never fictitious data.

01

Signed attestation for responses that go through the brain

Responses that go through the brain receive a timestamped attestation (interaction identifier, deployed version, build fingerprint, Guardian active) signed HMAC-SHA256 by the brain. Your application receives it in the stream; anyone can verify it at /verify. It does not prove that a given response of your application went through the brain.

02

Per-exchange log: coming

Today the brain writes no log at every exchange: it keeps the danger alerts it issues and the log your application declares to it (90 days). The log written by the brain at every exchange, without conversation content, kept at least six months, is specified for its next version.

03

Retention: on your side today

Keep the attestations and your own logs (at least six months for a high-risk use, Art. 26(6)). The AI Act PDF report in the dashboard gathers, over a period, what the brain returns for your application.

04

Log export (being connected)

The builder dashboard plans a timestamped report over a chosen period — filtered interactions, triggered floors, counters. While the brain-side log source does not answer, it shows “unavailable”, never fictitious data.

ELYSÉA provides technical elements — the logs, traceability, and integrity signature. They do not amount to compliance: regulatory compliance remains your legal responsibility.

ELYSÉA is not an AI Act high-risk certification body. We provide tools exploitable by your internal or external auditors — not the certification itself.

ELYSÉA does not cover obligations that fall under your internal governance (your own GDPR, impact analysis, data policy) — only the technical mechanisms of the pipeline.