What AffectLog proves and what it does not.
AffectLog records evidence state. It does not act as a regulator, a notified body, a legal adviser or an automatic deployment authority. It produces the record an accountable person in your organisation decides on - and can be held to afterwards.
Scope of authority
What AL360° Oceans is - and is not.
What it is
- A border-control layer for AI: scan, passport, visa
- An evidence scan that opens the file on an AI system (Currents)
- An evidence passport that records what is demonstrated about it (Ripples)
- A context visa that records the decision to clear it for ONE deployment, until it expires (Droplets)
- A record of each check and its result - the finding, not the data
- An evidence record built from what you supply - raw records are never requested
- A register (Atlas) that holds every system, clearance, and open gap
- A review workspace where a named human takes a decision they can defend
What it is not
- Not a notified body, and not a conformity assessment body
- Not a certification scheme under the EU AI Act or any other regulation
- Not a CE marking, and not a presumption of conformity
- Not a legal adviser or a legal interpretation engine
- Not a substitute for the DPO, the CISO, or the notified reviewer
- Not a generic governance dashboard or LLM observability tool
- Not a guarantee that a system is safe, fair, or lawful
- Not permanent - every passport and every visa expires
Evidence boundaries
What AffectLog records, and what it never asks for.
What AffectLog records
Findings. An Evidence Record carries the check, the method and its version, the parameters, the score, the result, and when it was recorded. Signal Receipts also carry an integrity hash computed by AffectLog. None of it is personal data, a clinical record, a prompt, a document, or a model weight.
What AffectLog never asks for
Raw special-category data under GDPR Art. 9, children's data under Art. 8, financial records, prompts, completions, retrieval corpora, training sets, and model weights. Raw export is disabled by default and cannot be enabled from the browser.
Why the evidence is not the data
Because for the three contexts we lead with - health AI, financial AI, minor-facing AI - the data cannot lawfully or practically be centralised, not even for a compliance check. So AffectLog does not ask for it. What is recorded is the evidence about the system: documents, summaries, and results.
What an Evidence Record proves, and what it does not
It shows that a named check, at a named version, produced a named result, recorded at a named time, and who recorded it. It does not prove that the check was the right one to run, or that the result is sufficient. A human decides that - on the record.
Why every clearance expires
Because the evidence does. Distribution shift erodes accuracy claims from the day they are made. A silent vendor model swap invalidates every fairness figure attached to the endpoint. A passport that never expires is a claim that the world stopped moving.
The disclaimer that travels on every export
AffectLog provides technical and operational evidence to support AI access, supplier-risk, security, privacy, and governance review. AffectLog does not provide legal advice, certification, notified-body conformity assessment, or regulatory approval. That sentence is on every Wake, and it is not a formality.
Carried on every Wake, every export, every passport
“AffectLog provides technical and operational evidence to support AI access, supplier-risk, security, privacy, and governance review. AffectLog does not provide legal advice, certification, notified-body conformity assessment, or regulatory approval.”