[guerython]

We’re seeing both in production, but mostly in regulated orgs where auditability is part of procurement.

Common implementation is append-only event log + periodic Merkle root anchoring (internal TSA or external timestamp service). Not blockchain, just verifiable ordering + immutability proofs during audits.

Agree with your API point. The practical win is prebuilt control mappings (AI Act articles -> concrete checks + evidence fields) so incident response is data retrieval, not policy interpretation under time pressure.

[gibs-dev]

The control mapping point is spot on. We took that approach. Structured JSON with article-level mappings so downstream systems can consume obligations programmatically.

The Merkle root anchoring pattern is interesting. Do you anchor per-session or batch? Curious how you handle the latency tradeoff for the 4-hour DORA window where every minute of audit lag matters.