EU AI Act · Evidence Layer · White-label for compliance firms

Every other platform records what you tell it. VAL proves it — and proves nothing’s missing.

Provably complete, independently verifiable evidence for your clients’ EU AI Act audit trail — the one thing a compliance PDF can’t fake. VAL turns an AI system’s real activity into a signed, offline-verifiable record, bound to the decision trace. You sell it under your own name.

2 Dec 2027
High-risk AI Act deadline (Annex III) — runway, not a race
€35M / 7%
Max fine — of global turnover
45%
Channel margin, under your brand
Offline
Every record verifies without us
01 — The moment

The deadline moved. The demand for proof didn’t.

The EU’s Digital Omnibus (Regulation 2026/1744, in force since 27 July 2026) moved the high-risk AI Act deadline for stand-alone Annex III systems from 2 August 2026 to 2 December 2027, with product-embedded systems following on 2 August 2028. That’s not a reason to wait — it’s runway to build your clients’ evidence trail properly.

Enterprise buyers and procurement teams already demand provable, verifiable proof of how an AI decides — today, deadline or not. Your clients are already being asked the question a policy binder can’t answer: “When a buyer or a regulator says prove it, what do we hand them?” A binder is a promise. It is not proof.

And plenty of the Act is already live: Article 5 prohibited practices since February 2025, GPAI provider obligations since August 2025, and the Article 50 transparency and Article 4 AI-literacy duties on their original schedule. VAL is how your clients hand over provable proof now — instead of a PDF they’re asking someone to trust.

02 — What VAL is

An evidence layer, not another dashboard.

VAL is a notary, not a scanner. It proves the record you keep is real, complete, and untampered. We say plainly what it does not do — that honesty is what makes it hold up in front of a regulator.

i

A signed, append-only ledger

Every decision your client’s AI takes is recorded and cryptographically signed — the automatic logging the Act requires (Article 12).

ii

Technical documentation, bound to the evidence

Generated, versioned, and tied to the record — Article 11 and Annex IV, not a document that drifts out of date.

iii

An offline-verifiable evidence bundle

One file an auditor or regulator can verify independently — no trust in you, and none in us, required.

iv

Completeness, not just signatures

VAL proves the record is complete against a scope signed in advance — and flags a silently missing step even when every entry present is perfect.

v

Reproducible, not just recorded

Each decision can be re-derived: replay the policy on the recorded inputs and get the exact same outcome. A dashboard stores what you claim happened; VAL lets an auditor reproduce it — a fabricated decision can’t survive the replay.

03 — The difference that closes the deal

Everyone can say their AI is auditable.
Almost no one can prove it’s complete.

Signing proves a single action is genuine. It does not prove the trail is whole. VAL is the only layer that catches a quietly dropped step — the exact failure a hostile operator, or an honest mistake, would otherwise bury under a stack of flawless receipts. That is the line no competitor on your client’s desk can draw.

And you prove all of it
without showing the data.

Selective disclosure: reveal only the steps you choose and seal the rest as a hash — content withheld. The auditor still gets cryptographic proof the record is complete and the disclosed steps are genuine, while your clients’ SSNs, financials and trade secrets never leave the building. The incumbents can’t do this — their whole model is to ingest your data to store it. VAL proves facts about the data while the data stays sealed.

And at the summit:
prove a fact, reveal nothing.

Zero-knowledge compliance proofs. Prove a property of a decision — “a human reviewed it,” “the outcome was compliant,” “no prohibited attribute was used” — while revealing none of the decision, the applicant, or the amount. Not redaction; mathematics: the verifier learns the property is true and learns nothing else. A governance dashboard stores your data to show it; VAL proves the claim without ever exposing it. This is the thing no one else in AI governance has.

04 — Why resell, not build

Your brand on the proof. Your margin on the sale.

You already own the client relationship and the advice. VAL is the deliverable your advice has been missing — and building it yourself is a product team and a permanent regulatory-maintenance burden, not a feature.

01

Entirely your brand

Your name, your logo, your support address, your client’s language — on every screen and every evidence bundle. We stay invisible.

02

Recurring margin

Buy wholesale, sell retail, keep the spread — then layer your own onboarding and advisory on top.

03

EU data residency

Each client gets an isolated signing key and ledger, hosted in-region, backed by a DPA. One client can never read another’s record.

04

No engineering

Provisioning a client is configuration, not code. You’re selling on day one.

05 — The economics

Priced below the incumbents. Built to be sold.

The market’s AI-governance platforms hide their prices and sit between €30k and €150k per year. VAL has a price that is publicly available, credible, and clearly below them — so your customer sees the value and you keep the margin.

Starter
€5,000 /yr
One AI system, one high-risk single use.
  • Signed Article 12 Record
  • Verifiable offline package
  • White label + one language
Most popular
Standard
€15,000 /yr
A few systems within a regulated entity.
  • Everything in Starter
  • Certification of completeness
  • Priority Support
Enterprise
€40,000+ /yr
Many systems, or a group.
  • Everything in Standard
  • Qualified Time Stamps
  • Group Residency & SLAs
Founding Partner Program — closes December 31, 2026

The first partners take on the risk of a new name, so they get the reward. 45% channel margin, raised to 55% for the founding group, plus a first-year price at half the rate for its initial customers — in exchange for a logo and a success story, with its rate protected as the market matures. A limited number of partners. After that, the standard program applies.

06 — How it works

Four steps. All under your name.

1

The AI acts

Your client’s system emits its activity to VAL through a drop-in SDK — Python or TypeScript.

2

VAL signs it

Each entry is signed and appended to that client’s isolated ledger — their key, their data, in-region.

3

The bundle is produced

On demand, a signed evidence bundle — localised, mapped to the Act, ready for an auditor.

4

You deliver it

Your brand, your invoice, your relationship. The client never sees us.

07 — The proof

We don’t ask you to trust us. We ask you to run it.

Before a single slide, a prospective partner runs the evidence themselves — offline, on their own machine. This is that run. A clean record verifies; a silently dropped entry is caught where every other tool would report “all clean.”

$ ./prove.sh VAL — EU AI Act Evidence Layer · Run-It-Yourself Proof Isolated tenant, offline, ES256-signed. [1] The AI system takes 3 actions → VAL records each as a signed receipt Article-12 log: 3 events, chain_ok=True, signatures_ok=True [2] Export the signed evidence bundle and verify it OFFLINE ok=True signature=True receipts=True chain=True completeness=COMPLETE [3] A hostile operator SILENTLY DROPS one receipt — “look, all clean” VAL rejects it: ok=False completeness=INCOMPLETE ↳ Every receipt shown was valid. Other tools say CLEAN. VAL does not. [4] Corrupt one receipt’s bytes — its signature must break VAL rejects tamper: ok=False all_receipts_ok=False [5] White-label: the AI Act disclaimer, localised (EN · DE · FR) rendered under your brand PROVEN. Signed, offline-verifiable, completeness-aware, localised.
08 — The division of labour

You own the client. We own the engine.

VAL provides

The proof machinery

  • The cryptographic engine and offline verifier
  • The EU AI Act mappings, maintained as the Act evolves
  • Per-client isolated keys, ledgers, EU hosting
  • Second-line technical support and the sub-processor DPA
  • Evidence export into the GRC stack they already run — OSCAL and webhook, standards-based
You provide

The relationship

  • The client, the advice, the trust
  • First-line support in your language
  • Your brand on the product and the invoice
  • The judgement of when your client needs it
09 — Who this is for

The firms already trusted to advise.

If your clients already come to you for compliance, VAL is the deliverable that turns your advice into something they can hold. It fits the firms whose word carries weight:

AI-governance consultancies Outsourced DPO & AI Officer services GRC & ISO 42001 practices Data-protection & privacy firms Security & compliance MSSPs RegTech & legal-tech vendors
10 — The honest boundary

A notary, not a scanner. We tell your clients exactly what VAL does — and doesn’t.

VAL proves the actions you instrument and the scope you sign are real, complete, and untampered. It does not claim to discover behaviour a black box was never wired to emit. In a market where an overclaim can void the very defence it was meant to provide, that restraint isn’t a weakness — it’s why the evidence survives a challenge, and why a serious partner can put their name on it.

And we shrink that boundary further than anyone: VAL comprehends your client’s code and proves the wiring itself is complete — every decision point is instrumented to emit, or it’s named and the build fails. Not just “the receipts are a complete set,” but “every place the AI decides produces one.” A governance dashboard can’t audit its own coverage. VAL can.

11 — Straight answers

The questions a serious partner asks.

Why not just build it ourselves?
Because it isn’t a feature — it’s a cryptographic engine, an offline verifier, and a permanent obligation to track the AI Act as it changes. That’s a product team you’d fund forever. Reselling VAL keeps your margin in the advisory, where it belongs, and puts a working product in your catalogue today.
Does this make my client “compliant with the Act”?
No — and we’d never let you say so. VAL proves the record is real and complete; your advisory makes the client compliant. VAL is the evidence under your work, not a substitute for it. That distinction is written into the product and the disclaimer.
What happens to my client’s evidence if VAL disappears?
The ledger is append-only and portable — it’s the client’s data, in their region, exportable and verifiable offline with an open verifier. There’s no hostage-taking and no lock-in on the record itself. Your client keeps their proven history no matter what.
Where does the data live, and who’s liable?
Each client’s key and ledger sit in an EU region, isolated per tenant, backed by a DPA. The chain is clean: your client is the controller, you are the processor, we are the sub-processor. VAL is engineered to touch as little personal data as possible.
Isn’t this just signed logs?
Signed logs prove each entry is genuine. They do not prove the set is whole. VAL proves completeness against a scope signed in advance — it catches a missing step even when every log present is perfect. Run the proof; drop a receipt; watch it fail where a log viewer would pass.
What’s my actual margin?
45% of retail as standard — 55% for founding partners — plus whatever you charge for onboarding and advisory on top. On a Standard tenant that’s a healthy spread before your services, against a product that costs us little to run per client.
12 — Become a partner

Run the proof. Then decide.

Tell us about your firm and we’ll set up a 30-minute session where you run the evidence offline — no deck. If it convinces you, we move to the founding-partner terms. A limited cohort, closing 31 December 2026.

No obligation. We’ll reply personally — nothing is automated, and nothing is shared.