The provenance
standard.
An open RFC for AI decision provenance, designed to map to EU AI Act Annex III, SEC guidance, and BCRA principles. We built it because the industry needs it; we publish it because we want it standardized. Walk its eight sections on the right.
{ "manifest_version": "1.0", "query_id": "q_8c4d2a1f", "timestamp": "2026-05-29T14:32:18Z", "platform": "[email protected]", "forecast": { "distribution": [0.62, 0.28, 0.10], "confidence": 0.87 }, "node_versions": [{ "id": "act:84a2", "v": 142 }, …], "agents_invoked": [{ "name": "a2a:profiler", "v": "3.1" }, …], "llm_attribution": { "sister_0": "anthropic/claude", … }, "reproducibility": { "seed": 42, "deterministic": true }, "signature": "0x7a3f…e21b", "signed_by": "customer-key:k_42f", "hash_algorithm": "SHA-256" }
Every ontology node accessed, version-pinned. Reproducibility requires this exact set, byte for byte.
Live RFC · hover a section to see which manifest fields it governs, and why.
The industry has no standard for AI provenance.
Every vendor documents decisions differently — or not at all. Some ship “citations,” some “explainability scores,” most just a model name and a timestamp. When Annex III enforces, that won’t be sufficient.
Regulators will ask: what versioned data did the model consult, which agents were involved, which LLM produced what part, and can you reproduce this exactly? The manifest answers all four — and DEINO publishes the format as an open standard, independent of any commercial product.
Mapped to every major framework.
The same manifest satisfies clauses across jurisdictions. This cross-walk is maintained as regulations evolve.
| Framework | Requirement | Manifest field |
|---|---|---|
| EU AI Act | Annex III §1.b — provenance of training data & decisions | node_versions, llm_attribution |
| EU AI Act | Annex III §3 — human oversight evidence | agents_invoked, signed_by |
| SEC AI Guidance | Reproducibility of AI-influenced decisions | reproducibility, full manifest |
| BCRA Principles | Trazabilidad of AI outputs | query_id, timestamp, signature |
| FINRA RN 24-09 | Audit trail for AI-recommended trades | full manifest export |
| SOX §404 | Controls over AI-derived financial reporting | full manifest + sign-off chain |
Frequently asked questions.
What the manifest is, which regulations it maps to, and how open the standard is.
What is the DEINO Audit Manifest?
The Audit Manifest is an open RFC (v1.0) proposing a standard for AI decision provenance. Every forecast ships with a manifest that records what versioned data the model consulted, which agents were involved, which LLM produced what part, and whether the output can be reproduced exactly — the four things a regulator will ask for.
Which regulations does the manifest map to?
The same manifest is cross-walked to clauses across multiple frameworks, including EU AI Act Annex III, SEC AI guidance, BCRA principles, FINRA Regulatory Notice 24-09, and SOX §404. The cross-walk is maintained as the regulations evolve.
Is the manifest format open, and is there a reference implementation?
Yes. The RFC is public and the reference implementation is Apache 2.0. DEINO publishes the format as an open standard, independent of any commercial product, and invites other vendors to adopt it and regulators to reference it.
What does it mean when DEINO certifies provenance instead of certifying truth?
The manifest attests how an output was produced — the exact input-data versions, model, and agent configuration, sealed in a hash-chained ledger and replayable bit-for-bit (BR-842). It does not attest that the output’s claim is factually true. Certified provenance ≠ certified truth: reproducibility is proven; accuracy is a separate, measured calibration loop (Brier / log-loss against a disclosed baseline) that is explicitly in progress, not a promise.
How is certified provenance different from verified truth in an AI system?
Verified truth is a claim that a statement about the world is correct. Certified provenance is a claim that a computation is reproducible: this output came from this input + model + agent config, and anyone can re-run it and get the same bytes. DEINO certifies the second, never the first — which is exactly what a regulator, auditor, or board needs to defend an AI-driven decision, independent of whether the forecast later proves right or wrong.
Open standard. Open invitation.
The RFC is public, the reference implementation is Apache 2.0. We invite other vendors to adopt the format and regulators to reference it. Email the standards working group to participate.