EU AI Act · Technical Documentation
Attestly reads the traces your agents already produce and turns them into EU AI Act technical documentation, risk-management records, and audit-ready evidence — continuously, not as a quarterly scramble.
Free plan: 1 AI system, 10 lifetime documentation generations.How it works
Your agents run
OpenTelemetry, LangSmith, AgentOps, or MCP logs — whatever you already emit.
Attestly structures it
Tool calls, model calls, human interventions, and errors, normalized and mapped to Annex IV.
A person signs off
Every generated section is reviewed, edited, or rejected before it counts as final.
What it generates
Annex IV technical documentation
General description, design specification, and monitoring measures — drafted from what your system actually did.
Risk-management summaries
Identified risks, mitigations, and residual risk, traced back to the events that surfaced them.
Conformity-assessment checklists
A running view of what's covered, what's missing, and what still needs a human decision.
Audit-ready evidence trails
Every generated sentence links to the specific trace event that justified it, and every approval is cryptographically hashed — tamper-evident, not just asserted.
Who it's for
AI startups
Deploying an autonomous agent to EU customers and need Annex IV documentation before launch, without a dedicated compliance hire.
Enterprise AI teams
Running internal or customer-facing agents across multiple systems that all need ongoing, not one-time, documentation as behavior changes.
Compliance and risk teams
Currently reconstructing what an AI system did by hand from logs and interviews, and need a structured, evidence-linked starting point instead.
AI governance consultancies
Producing Annex IV documentation for multiple clients and need a tool that turns each client's traces into a first draft, rather than starting from a blank template every time.
Background
The EU AI Act requires providers of high-risk AI systems to maintain technical documentation under Annex IV before the system is placed on the market, and to keep it current as the system changes. Annex IV specifies several required elements: a general description of the system and its intended purpose, details of its design and development process, information on how it's monitored and controlled once deployed, performance and validation metrics, risk-management measures, and a record of significant changes made across the system's lifecycle.
In practice, most of the underlying evidence for these sections already exists inside the system's own operational traces — which tool calls it made, when a human intervened, what errors occurred, what changed between deployments. Attestly's role is to read that evidence directly from your traces and map it against each Annex IV requirement, rather than have someone manually reconstruct it after the fact from logs, tickets, and memory.
Why not a generic GRC platform
Broad AI-governance platforms are built around policy management, system inventories, and monitoring dashboards — useful for tracking that an AI system exists and has an owner, but they don't ingest an agent's actual execution traces and turn them into drafted Annex IV documentation with evidence links back to specific events. That gap — live agent behavior into structured, evidence-backed compliance documentation — is the specific problem Attestly is built to solve, not a broader governance dashboard.
Attestly isn't a replacement for legal review, a GRC platform, or an AI firewall. It's the tool that turns operational trace data into a documentation draft a compliance professional can review in minutes instead of building from scratch.
Why runtime traces, not code scans
Scanning source code can tell you which SDKs and model calls are wired up. It cannot tell you what happened at runtime: which tools an agent actually invoked, when a human stepped in to override a decision, which calls errored out, or how the system's behavior changed between one deployment and the next. Annex IV specifically asks for that operational evidence — and it only exists in execution traces, not in a repository.
| Attestly (runtime traces) | Code-scanning tools | |
|---|---|---|
| Sees actual agent behavior | ✓ | — |
| Captures human interventions | ✓ | — |
| Evidence link per generated sentence | ✓ | — |
| Works with agents you didn't build (MCP, third-party tools) | ✓ | — |
| Updates as behavior changes | ✓ | — |
Read the full breakdown of why Annex IV needs runtime evidence →
Supported trace sources
Live example
A simplified, illustrative walkthrough of how a handful of normalized trace events map to a single drafted documentation sentence — with a link back to the exact event that justified it.
[
{ "event": "tool_call", "tool": "refund_api", "id": "a91f02c1", "status": "success" },
{ "event": "human_intervention", "actor": "reviewer@acme.eu", "id": "a91f02c2", "action": "approved" },
{ "event": "error", "id": "a91f02c3", "message": "timeout on retry 2" },
{ "event": "deployment_change", "id": "a91f02c4", "from": "v1.4", "to": "v1.5" }
]Drafted Annex IV section — Monitoring measures
“The system autonomously invoked the refund API, which a human reviewer subsequently approved after an initial retry timeout; the system was updated from v1.4 to v1.5 shortly after.” [evidence: trace #a91f02c1]
Free tool
Not sure if your AI system is high-risk?
Answer a few questions and get a directional EU AI Act risk classification.
Frequently asked
Does Attestly provide legal advice or guarantee compliance?
No. Attestly does not provide legal advice and does not guarantee regulatory compliance. Every generated section is reviewed, edited, and approved by a human before it counts as final.
What trace sources does Attestly support?
Attestly ingests OpenTelemetry traces, LangSmith runs, AgentOps sessions, and generic pre-normalized JSON.
Who is Attestly for?
AI startups shipping agents to EU customers, enterprise AI teams running multiple systems, compliance and risk teams, and AI governance consultancies producing documentation for clients.
How is Attestly different from a generic AI governance platform?
Broad AI-governance tools focus on policy management, system inventories, and monitoring dashboards. Attestly specifically ingests an agent's operational traces and turns them into drafted Annex IV documentation with evidence links back to the exact events that justify each section — a narrower, deeper problem than a general governance dashboard covers.
Is there a free plan?
Yes. The free tier includes one AI system and ten lifetime documentation generations, enough to fully draft one system's Annex IV documentation and see the product work before subscribing.
How does Attestly know what to write in each documentation section?
Each EU AI Act Annex IV requirement is mapped against the specific trace events (tool calls, model calls, human interventions, errors, system events) relevant to it. Drafting is grounded only in that linked evidence — the system is instructed to flag gaps explicitly rather than invent plausible-sounding text where evidence is missing.
What happens to my trace data?
Trace data is stored per-organization with row-level database access controls, so one organization can never see another's data. Only the specific events linked as evidence for a documentation section are sent to the AI model used for drafting that section.
What format is the exported documentation in?
Attestly exports a Word (.docx) document containing every requirement, its current review status, whether it's AI-generated or human-edited, and a list of the exact trace events used as supporting evidence.
How is Attestly different from attestly.dev?
attestly.dev performs static analysis of your source code to produce generic SaaS privacy/compliance documentation. Attestly reads your AI agents' runtime traces (OpenTelemetry, LangSmith, AgentOps, MCP logs) and drafts EU AI Act Annex IV documentation with evidence links back to specific trace events. A code scan can tell you an SDK is imported; it can't tell you what the agent actually did — which tool calls it made, when a human intervened, what errors occurred, or how behavior changed between deployments. That's a different product for a different requirement.
Can I use Attestly alongside a GRC platform?
Yes. A GRC platform tracks which AI systems exist, who owns them, and their overall policy status. Attestly produces the underlying Annex IV documentation draft for a specific system, grounded in that system's actual runtime evidence. Most customers use both: GRC for inventory and ownership, Attestly for the evidence-backed documentation itself.
What if my agent framework isn't listed?
Attestly accepts generic pre-normalized JSON in addition to OpenTelemetry, LangSmith, AgentOps, and MCP logs, so any framework that can export its trace events as JSON can be ingested even without native support.