AI Tracing Isn’t Proof: EU Regulation Looms

Engineers using OpenTelemetry to trace AI agent activity will find that detailed logs don’t satisfy upcoming EU AI Act requirements for independent verification. While distributed tracing excels at debugging and performance analysis, it relies on self-reported data, which regulators won’t accept as definitive proof of compliance. The EU AI Act Articles 9 and 13 mandate risk management systems and understandable outputs for high-risk AI, but don’t specify logging as sufficient evidence.

The core issue is that the system being audited also creates the audit trail. Common observability tools allow for data modification or are controlled by the vendor being audited, creating structural problems. To address this, teams should implement an independent “witness layer” that cryptographically commits to execution details before responses are returned, offering tamper-evident proof.

The August 2026 enforcement date for the EU AI Act is fast approaching, and many teams currently focused on observability aren’t building the necessary independent proof infrastructure.