How do I keep immutable audit logs on my own infrastructure for the EU AI Act?

You keep immutable audit logs on your own infrastructure by running an append-only, hash-chained log locally, writing each event as a signed entry, and exporting signed receipts that anyone can verify offline. AlgoVoi's Verifiable Audit Log runs on your own box (SQLite or PostgreSQL), is air-gap capable, and never sends your event data anywhere.

Last updated 21 August 2026

What "immutable" means in practice

An immutable audit log is append-only and tamper-evident: you can add events, but you cannot silently change or remove one, because every entry is hash-chained to the one before it and signed. Any edit, deletion, insertion, or reordering breaks the chain and fails verification. That is the property regulators actually care about, and it is stronger than "we set the file to read-only."

Keep it on your own infrastructure, step by step

1. Run the log locally: install the Verifiable Audit Log on your own host with SQLite (five-minute start) or PostgreSQL. Nothing is sent off-box; it is air-gap capable.
2. Append events automatically: each business or model event is recorded inline as a Falcon-1024-signed entry chained to the previous one.
3. Export signed receipts: produce the exported record for a given period as signed receipts plus the log's public key.
4. Verify offline: you, an auditor, or a regulator checks the exported receipts with no network and no trust in the holder.

Embed it in your own service

from algovoi_audit_log import AuditLog, SqliteStore, signing

pk, sk = signing.generate_keypair()
log = AuditLog(secret_key=sk, public_key=pk, store=SqliteStore("audit.db"))

await log.append(event_type="model.decision",
                 event={"case_id": "c_1", "decision": "ALLOW"},
                 actor="did:web:your-system")
assert (await log.verify_chain()).valid   # append-only, offline-checkable

Verify it, the way an auditor would

The whole point is that someone else can check the record. Verification runs offline against the exported receipts and the log's public key, with no call back to AlgoVoi and no trust in whoever holds the log:

from algovoi_audit_log import verify_chain

# `receipts` are the exported, signed log entries; `public_key`
# is the log's Falcon-1024 public key. No network, no vendor.
result = verify_chain(receipts, public_key)
assert result.valid   # fails the moment any entry is altered,
                      # inserted, removed, reordered, or back-dated

A competent authority can run the same check against the same exported receipts and reach the same verdict. That reproducibility is what turns "we kept logs" into evidence.

Self-hosted vs managed logging

Do it with AlgoVoi

The self-hosted Verifiable Audit Log produces the tamper-evident record. It ships standalone and inside the Verifiable Compliance Suite, runs entirely on your own infrastructure, and is air-gap capable (no PyPI). Anyone you hand an exported record to can verify it offline, no licence and no AlgoVoi account needed.

• Get the log: Suite Store (Verifiable Audit Log, or the full Compliance Suite)
• Related answer: EU AI Act Article 12 record-keeping
• Related answer: tamper-evident, timestamped audit logs for AI systems
• Product: Regulatory evidence · Evidence Auditor
• Regulatory mapping: docs EU AI Act record-keeping

Start with the docs: docs.algovoi.co.uk/audit-log