Note / 005
Paper Trail / Product note
Runtime evidence
AI needs
receipts.
Paper Trail is runtime evidence for AI systems. It leaves a checkable record behind after the model has moved on.
The problem
AI is good at moving on. A model answers. An agent acts. A workflow continues. Three months later somebody asks a very different question: what exactly happened?
Maybe it is a customer complaint. Maybe it is an internal review. Maybe security wants the sequence. Maybe legal wants the record. Maybe you simply want to know whether the artifact in front of you is the same one your system saw earlier.
Thesis / 01
A screenshot is a story.
A receipt is evidence.
What Paper Trail is
Paper Trail sits beside an AI workflow and records bounded evidence when supported activity happens. It is not another model judging the first model. The evidence path is deterministic where it matters.
At capture time, Paper Trail normalizes the artifact in a defined way and computes cryptographic fingerprints. The evidence store keeps those fingerprints and bounded context. The evidence design does not require the ledger to become a warehouse of raw AI output.
The model can do the work. The model does not get to certify the evidence about its own work.
The four-step version
The AI does something.
A model returns text, an agent produces an artifact, or an AI-enabled workflow reaches a supported capture point.
Paper Trail fingerprints it.
The runtime computes deterministic cryptographic hashes. Think of them as one-way fingerprints, not copies of the artifact.
Paper Trail records the event.
The evidence record keeps bounded facts such as the system, time, capture point, hash scheme and evidence state.
The record survives the moment.
Later review has a bounded evidence record to inspect instead of asking the model to remember, explain or certify its own past work.
System / Fingerprint
Bounded evidence / Not raw-content warehousing
Keep the proof.
Not the whole thing.
A cryptographic fingerprint is useful for comparison, but it is not meant to let you reconstruct the original document. Change the artifact and the fingerprint changes.
↓
defined normalization
↓
cryptographic fingerprints
↓
bounded evidence record
What it can answer
What evidence was recorded?
The retained record can show bounded identifiers, timing, capture context and deterministic commitments without asking the model to narrate the event later.
Which system was involved?
The evidence record is tied to a system identifier rather than relying on somebody remembering which workflow produced it.
When was it recorded?
The record carries the relevant event time and evidence-state timing instead of reconstructing the story from a chat transcript.
What kind of capture was it?
The record distinguishes supported capture points such as runtime egress or publication.
What it refuses to say
Evidence.
Not a verdict.
“A person made this.”
No match is not proof of human authorship. The content may have been made by another AI, another system, or never recorded in this ledger.
“This company is compliant.”
Evidence can support a compliance process. Paper Trail does not classify your system, interpret the whole law, or issue a compliance certificate.
“A regulator approved this.”
Paper Trail does not represent regulatory approval, a legal conclusion, or an enforcement outcome.
“One receipt proves the whole system behaved correctly.”
No. A bounded evidence record supports a bounded claim. It does not prove every event, every control, or every legal obligation around the wider system.
Important: absence of evidence in this ledger is not evidence that content is human-generated.
Why the EU AI Act matters
The EU AI Act is risk-based. Different systems and different actors can have different duties. Evidence infrastructure can be relevant to traceability and transparency work.
That does not make Paper Trail “the AI Act in a box.” Runtime evidence is one possible component inside a larger governance, documentation, risk-management, human-oversight, security and legal program.
Use the product for the evidence problem. Use the law to decide the legal problem.
Plain-English explanation only. Not legal advice.
Read the law without drowning
Four short guides. Official sources included.
The EU AI Act, plain English
Start with the map: risk levels, dates, roles and the questions a normal company should ask.
Read ->02Who owns what?
Understand provider, deployer, importer and distributor before you copy obligations from somebody else’s checklist.
Read ->03Logs, records and evidence
Understand the high-risk logging concepts and why a normal debug log is not automatically useful evidence.
Read ->04Transparency and marking
Separate visible disclosure, machine-readable marking and runtime evidence.
Read ->Paper Trail
Available now / From CAD $49 monthly
Give the machine a paper trail.
Paper Trail is a private preview. The public promise stays narrower than the roadmap: only capabilities that a customer can actually use are presented as available.
Notes / Subscribe
Get the next note.
No schedule. No content calendar. A note goes out only when there is something worth understanding.