EU AI Act · EUSAiR

Accountable AI needs a system of evidence.

That’s where Aqua comes in.
Every action, whether an approval, a change, or a signature, is recorded with evidence of who did what and when. Like a receipt, this evidence travels with the data itself, allowing auditors, regulators, and partners to independently verify what happened without access to the system that produced it.

Example: a payment executed by an AI agent.

Chapters

  1. 0:00 The agent produces the evidence package
  2. 4:56 The audit portal consumes the evidence package
  3. 5:54 The forensic viewer consumes the evidence package

Recorded on our test system with sample payroll data.

Short on time?
Explore the demo in slides.

The demo shows the onboarding of Darlene as a contractor. Her client asks an AI agent to pay her for 40 hours. Here is what Aqua records at each step, and what happens when something goes wrong.

One payment, step by step: what Aqua records at each step.

Before the agent acts
Before payment
After: proof
1
Your request comes in
"Pay Darlene for 40 hours, week of 22 Sep."
What Aqua does
Checks your signed mandate: are you authorised to give this instruction?
Why it mattersInstructions without authority are flagged right away.
2
The agent calculates
40 h × $40 = $1,600
Limit: 80 h ✓
What Aqua does
Checks the amount against the agent's limits and records how it was calculated.
Why it mattersAmounts above the agreed limits are flagged before the payment is prepared.
3
The agent fills in the form
Name, hours, account, date ✓
What Aqua does
Checks every field against the agreed payment form and reports errors to the agent.
Why it mattersFailed checks are flagged before payroll.
4
You approve
Pay $1,600 to Darlene? Confirm.
What Aqua does
Checks for a signed approval from a person. Your system pays only once it is there.
Why it mattersA person, not the AI, authorises the payment.
5
The payroll system pays
"Payment accepted, ID 4821"
What Aqua does
Records the request and the confirmation, each signed by its sender.
Why it mattersIn a dispute, both sides can show what was sent and confirmed.
6
The agent reports back
"Done. Darlene has been paid $1,600."
What Aqua does
Seals all steps into one evidence package. Any change or missing step shows.
Why it mattersEvery step can be verified later by anyone you share it with.
Steps 1–4: Aqua checks the payment against your rules and confirms the signed approval, so your system only pays what passes. Steps 5–6: Aqua records what was sent and received, and seals everything into one evidence package your team, partners or auditors can verify independently, without access to your systems.

Steps 1 to 4: Aqua checks the payment and confirms a person’s signed approval, so your system only pays what passes. Steps 5 and 6: Aqua records what was sent and received, and seals it into one evidence package.

When the agent gets it wrong,
your rules stop the payment before money moves.

What happens
What Aqua does
Result
The agent leaves out Darlene's bank account
Account: missing
Checks the entry against the agreed payment form and sends it back: "Bank account missing."
The agent fixes it and tries again. The incomplete payment is not passed on to payroll.
The agent wants to pay 400 hours instead of 40
400 h × $40 = $16,000
Checks it against the signed mandate (max. 80 hours) and flags it in red as outside the rules.
Your system doesn't execute it. The flagged attempt stays on record.
A person approves a wrong amount anyway
Approved: $16,000 by J. Miller
Records who approved exactly what, and when, signed by that person.
The error can be traced quickly. Responsibility is clear.
Aqua can't stop a person from approving a wrong payment. It checks every action against your rules, shows why one fails, and records who approved what.

When the agent gets it wrong, your rules stop the payment before money moves.

The evidence layer

What Aqua adds every time data passes from one system to another.

AI agent
Payment: Darlene · 40 h · $1,600
Payroll system
Each step of the turn gets its own tag. All tags together form one package that travels with the data.
Step 1Step 2Step 3… One evidence package
The evidence tag on this handover
What exactly · fingerprint
A unique code of the exact content. Change one digit and it no longer matches.
Who · signature
Made with the sender's own digital key: person, company or agent.
When · timestamp
Confirmed by an independent time service, not only by the sender's clock.
Under which rules · template
The agreed form the data must fit, such as "contractor payment".
What belongs together · seal
Links every step of the turn, so none can be removed unnoticed.

The evidence tag on each handover: what, who, when, under which rules, what belongs together.

The evidence layer

Your systems already exchange data.
Aqua seals the evidence at each handover.

Aqua doesn't replace these systems.
It connects to them and adds evidence to the data they exchange, and that evidence travels on with it.

Each orange point: Aqua attaches signed evidence of what was sent, by whom and when.
AI agents
Documents
Business apps
Banks
Cloud storage
Anyone you share it with can check it themselves:Your teamClientsPartnersAuditorsRegulatorsInsurers

Your systems already exchange data. Aqua seals the evidence at each handover.

How Aqua differs

The proof is built into the data,
not kept by someone you have to trust.

1
Evidence stays with the data
The evidence is embedded in the data and travels with it between organisations. It does not depend on a vendor platform, public blockchain or central audit log remaining available.
2
Independent verification
Auditors and partners can verify the evidence themselves, without relying on the sender, inblock.io, a central authority or a global ledger.
3
One approach across different types of evidence
Aqua provides a consistent way to verify documents, data and AI actions, bringing signatures, data history, AI audit trails and identity into a common evidence framework.
4
Open protocol, independent of the provider
Aqua uses an open protocol and an open-licensed verifier. Evidence remains verifiable even if an organisation stops using inblock.io.
No central authority. No global ledger. No coin. Just evidence, bound to the record.

The proof is built into the data, not kept by someone you have to trust.

Private verification

Auditors need proof, but the record contains sensitive data.

With Aqua, only the fields the other side needs are revealed. Sensitive data, such as personal, medical or commercial details, stays hidden, and the signature still checks out.

Your full record
RecipientDarlene
Hours40
ApprovedJ. Miller, 22 Sep
Bank accountDE89 3704 …
Hourly rate$40
You choose which fields to reveal
What the auditor seesSignature valid
RecipientDarlene
Hours40
ApprovedJ. Miller, 22 Sep
Bank accounthidden
Hourly ratehidden
Why it still checks out
Each field is sealed on its own. Hidden fields stay hidden, but can't be swapped unnoticed.
Useful for
audits, data sharing between companies, personal and commercial data
Prove a record's authenticity to a partner or auditor without handing over the data itself.

An auditor sees only the fields they need, and the signature still checks out.

Reading the evidence

Aqua doesn't stop at creating evidence.
It also gives everyone a way to read it.

One evidence package, two ways to examine it: experts inspect every step in detail, everyone else gets a clear verification result.

Option 1 · For experts
Inspect every step
The Aqua State Viewer visualises the whole session, showing the records within each turn, who signed what, what was produced, and how the records are connected.
Aqua State Viewer: six turns of the payment session on a timeline
Turn 1Turn 2Turn 3Turn 4Turn 5Turn 6
Used by: Auditors, analysts, technical teams
Evidence package
Darlene's payment.
All six steps in one file.
Option 2 · For everyone
Get a clear answer
A free reader, like a PDF reader: no account, no expertise.
Evidence Readerpayment-darlene.aqua
SummaryStepsSigners
Verified All checks passed
Request receivedJ. Miller
Payment calculatedPayroll agent
Form checkedPayroll agent
ApprovedJ. Miller
Payment confirmedPayroll system
Package sealed22 Sep, 14:03
JMAIPS3 signersUnchanged since 22 Sep, 14:03
Used by: Clients, investors, courts, Darlene herself
Both tools verify the underlying signatures and fingerprints independently, rather than relying on information provided by the sender.

Two ways to read the evidence: every step in detail for experts, a clear result for everyone else.

Integration

Aqua fits into the systems you already run.
Your team adds it in three steps.

1
Add the SDK
A software kit for your developers, added where data is created or agents act.
Rust and JavaScript
2
Choose or write templates
Templates define your business objects. About 60 come ready-made: invoices, approvals, identity claims, AI audit steps.
Or write your own
3
Decide where evidence is kept
In your own storage. When you share the data, the evidence goes with it.
AquaNodeOptional
Our store for your data and its evidence, with built-in access control.
What stays the same
Your systems and workflows
Your storage and your data
Your keys
Your signature and identity providers
Your team needs: Developers who can integrate a software kit. No cryptography or blockchain expertise.
Start small: Pilot one high-risk workflow and create an evidence package your team and partners can verify independently.

Aqua fits into the systems you already run, in three steps.

Promises don't travel between organisations.
Proof does.

You don't have to trust your AI agent.
You trust the rules and the approval, and the evidence shows they were kept.

Pilot Aqua in one of your AI agent workflows. QR code for inblock.io/eusair

Promises don’t travel between organisations. Proof does. Scan the code to come back to this page.

Drag to move around the slide. Turn your phone for a wider view.

What does Aqua capture in an Evidence Bundle?

In our payment demo, Aqua captures each step of the workflow, from the initial request and the AI agent’s actions to human approval and the final payment. These records are brought together in an Evidence Bundle.

The bundle contains the data and evidence needed to trace the workflow step by step, including what happened, who signed or approved it, and when. It travels with the data, allowing anyone who receives it to independently verify the recorded steps without access to the original system.

How each step is documented.

  • What exactly Fingerprint A unique code representing the exact content. Change even one digit, and the fingerprint no longer matches.
  • Who Signature Created with the sender’s own key, whether it’s a person, company, or AI agent.
  • When Timestamp Confirmed by an independent time service, not just the sender’s own clock.
  • Under which rules Template Defines the agreed structure and requirements the data must meet, such as those for a contractor payment.
  • What belongs together Seal Cryptographically links the records together, making any removal or alteration detectable.

Two ways to read it.

The audit report One possible view over the bundle: a clear result for everyone who needs the outcome rather than every step. See the example audit report ↗ PDF, 1.4 MB
The forensic viewer showing the demo’s payment session turn by turn on a timeline
The forensic viewer A detailed view of the Evidence Bundle for those who want to look deeper. Explore each turn on a timeline or graph, see who signed what, and how the records connect. The viewer independently verifies the signatures rather than relying on the sender. Ask us for access to explore it yourself. ↗

Practical steps towards EU AI Act compliance with Aqua Protocol.

The EU AI Act sets requirements for accountability, transparency, and human oversight. Aqua helps put them into practice by checking actions against agreed controls as AI workflows run. Each step is documented, with verifiable evidence of actions, approvals, and decisions that stays with the data.

Auditors and regulators can independently verify what happened without access to the original systems.

For stand-alone high-risk AI systems, these duties apply from 2 December 2027.

  • Art. 9 Risk management Identify the risks of a system and control them over its lifetime. What Aqua adds: Each step is checked against its agreed form, a person approves the critical ones, and a refused step stays on record with its reason.
  • Art. 12 Record-keeping Record events automatically over the system’s lifetime. What Aqua adds: Every event is a signed entry linked to the one before, so a changed or missing entry shows.
  • Art. 13 Information for deployers Let deployers collect, store and interpret the logs. What Aqua adds: Built so deployers can check the logs themselves, in the browser or offline, without asking the provider.
  • Art. 14 Human oversight Let people decide not to use, override or reverse what the AI does. What Aqua adds: Each approval or rejection is signed by the person who made it, with what they were shown and when.
  • Art. 19, 26 Keeping the logs Providers and deployers keep the logs for at least six months. What Aqua adds: The evidence travels with the data, so it stays checkable wherever it is kept.

Pilot Aqua in one of your AI agent workflows.

Start small:
One high-risk workflow.
One evidence package your team, partners and auditors can check themselves.

Book a meeting →