# Auditors and compliance

Rules for AI ask you to show what your systems did and when. A signafAIde record answers both, and your auditor can check it with the open verifier instead of taking your word for it.

Records are evidence, not certification. They attest integrity and timing. They never say whether a decision was right. What each check means is in [Verify](/docs/verify) and [Verification packs](/docs/packs); the printable report is in [Audit packs](/docs/audit-packs).

## What each framework asks for

| Framework | What it asks for | What a record gives you |
|---|---|---|
| **EU AI Act** Record-keeping, Article 12 | High-risk AI systems must record events automatically over their lifetime, so that what the system did can be traced. | Every tool call your agent makes is recorded before it runs and after it returns, in a chain where a missing or edited record shows. |
| **ISO/IEC 42001** AI management system | Documented, retained evidence that your AI systems operate the way your management system says they do. | An export or audit pack for any period, which the auditor verifies record by record with the open verifier. |
| **SOC 2** Trust services criteria | Evidence that controls operated throughout the audit period, not only on the day of the audit. | Public timestamps fix when each record existed, so the whole period can be shown, not asserted. |

## What the auditor sees

A plain statement of what each record proves, with the technical detail one click away. Or a verification pack, checked with one command.

For one record, the console says what happened in one sentence: which agent decided to run which tool, and when. Below it are the agent's signature, the service's signature, the earliest time (a public randomness round), the latest time (an hourly public timestamp), the chain and the hash of the content.

For a period, the auditor downloads the pack with your agent keys and head file and runs `npx signafaide verify pack.json --keys <service>/.well-known/signafaide-keys.json --agent-keys agent-keys.json --head head.json`: one line per check, then `PASS` or `FAIL` with how many of the 12 checks passed, are pending (co-signed, the public timestamp not confirmed yet) or were not checked. You write `agent-keys.json` with `signafaide keys export`; `head.json` is your `.signafaide/head.json`, the newest receipt for each agent, which shows no record was cut from the end. Attach both to the auditor link and all three files come in one download.

## Giving your auditor access

- **Verification pack.** One JSON file per period, with your `agent-keys.json`. The auditor runs `signafaide verify` on their own machine. Verification is never metered.
- **Auditor link.** A read-only view of the records, with a status summary and the exact verify command. Free: 1 active link, expiring within 7 days. Solo: unlimited, expiry up to 90 days. Team and Enterprise: unlimited, any expiry.
- **Verification report.** A printable report for a period: scope, counts, the verification result, chain integrity, the public timestamp status as of the moment it is made and the verify command. On Solo and up.
- **Audit packs.** Evidence mapped to the EU AI Act, ISO/IEC 42001 and SOC 2, on Enterprise.

Next: plans and limits. [Pricing](/pricing)