Regulated AI Recordkeeping
A signed audit trail makes AI records attributable and tamper-evident: every inference call is anchored to a chain signed with post-quantum cryptography (ML-DSA), so any after-the-fact change breaks the chain and becomes detectable. In regulated work under 21 CFR Part 11 and GxP, that is the difference between a record you can defend and a log you can only hope no one edited. And you verify it on your own hardware — evidence, not our word.
When an AI system participates in a regulated decision — flagging a claim in pharmaceutical promotional review, drafting a rationale, surfacing a citation — the output becomes part of the record. Regulators do not ask whether the answer felt right. They ask two questions about the record: can you attribute it (who and what produced this, and when), and can you prove it hasn't been altered since.
An ordinary application log answers neither. Logs can be edited, rewritten, or quietly regenerated, and nothing about the file tells you whether that happened. For a validated GxP workflow, an unattributable, silently-editable log is not evidence. It is a liability that assumes good faith you cannot demonstrate to an auditor.
A signed audit trail closes that gap by construction. Attribution is bound cryptographically into each entry. Integrity is enforced by chaining, so tampering is not merely discouraged — it is detectable.
In Hyfstele, every inference call the model makes is anchored to a tamper-evident audit chain, and each entry is signed with a post-quantum signature scheme, ML-DSA. Two mechanisms work together:
The result: a record of what the AI system did, in what order, that is attributable to a specific deployment and resistant to silent alteration.
Tamper-evidence is not the same as tamper-proofing. Nobody can promise a file will never be touched. What a signed chain gives you is certainty about touching: if a single character in any past entry changes, or an entry is dropped or spliced in, the signatures and the chain no longer verify. The alteration cannot hide.
The practical test
Hand the audit trail to an auditor. They run the verification against the public key and the chain structure. It either verifies cleanly end to end, or it points to exactly where the record diverged from what was signed. There is no "trust the dashboard" step in between.
21 CFR Part 11 and the broader GxP framework set concrete expectations for electronic records. A signed audit trail speaks directly to the recordkeeping side of them for the AI portion of a workflow:
| Part 11 / GxP expectation | What the signed audit trail provides |
|---|---|
| Attributable records | Each inference entry is signed and bound to the deployment that produced it. |
| Secure, computer-generated, time-stamped audit trails | Entries are generated by the system, chained in order, and signed — not hand-authored logs. |
| Detect alterations to records | Chaining plus ML-DSA signatures make any change, deletion, or insertion break verification. |
| Records remain retrievable and defensible over the retention period | Post-quantum ML-DSA is chosen so verification holds up as cryptographic attack capability advances. |
| Data residency and provenance | The trail is produced and verified inside your own perimeter, air-gapped, on model weights proven byte-identical to the public artifact. |
This is the AI recordkeeping control. It sits inside your validated process; it does not replace your validation, SOPs, or human sign-off. In the MLR use case, the doctrine is "It flags. You decide." — Flag → Judge → Prove, with no LLM inside the flag decision plane. The signed trail is the "Prove."
The point of evidence is that you don't have to take anyone's word for it. The audit chain and its ML-DSA signatures are verifiable on the customer's own hardware, inside the customer's perimeter. You are not verifying a vendor's claim about the record; you are checking the record yourself against a public key and a chain that either holds or doesn't.
This is one of four independently verifiable controls in a Hyfstele deployment. Each is something you can check on your hardware — not something we assert:
What this does and does not claim
A signed audit trail secures the record of what the system did. It makes that record attributable and tamper-evident. It does not mean the model is clean, safe, or free of hidden behavior — and we do not claim that it is.
We do not tell you "we scanned the model" or "the model is backdoor-free." Nobody honest can. What we do instead is make four controls verifiable on your own hardware, so your compliance and security teams reach their own conclusions from evidence. The signed trail is a recordkeeping control, not a safety guarantee about the model's internals.
It is a record where every AI inference call is anchored to a tamper-evident chain and cryptographically signed. Each entry commits to the one before it, so any later alteration, insertion, or deletion breaks the chain and becomes detectable. Hyfstele signs each entry with post-quantum cryptography (ML-DSA), which makes the record attributable to a specific system and durable against future cryptographic attacks.
21 CFR Part 11 expects electronic records to be attributable, accurate, and protected so that alterations are detectable, backed by secure, computer-generated, time-stamped audit trails. A signed, chained record binds each inference to what produced it and makes any after-the-fact change visible. This addresses the recordkeeping and audit-trail expectations of Part 11 and GxP for the AI portion of a validated workflow — it complements, and does not replace, your own validation and procedures.
Yes. The audit chain and its ML-DSA signatures can be verified on the customer's own hardware, inside their perimeter. Verification does not depend on trusting a vendor dashboard or assertion — it is evidence you check yourself against the public verification key and the chain structure.
No. We do not claim the model is clean, safe, or free of hidden behavior. A signed audit trail secures the record of what the system did — it makes that record attributable and tamper-evident. That is a recordkeeping control, not a statement about the model's internal behavior.
Regulated records must stay defensible for years. ML-DSA is a post-quantum signature scheme, chosen so the integrity and attributability of the audit trail hold up even as cryptographic attack capability advances. A record produced today stays verifiable and tamper-evident into the future.
Hyfstele runs open-weight models inside your own perimeter, air-gapped, with four independently verifiable controls. See the signed audit trail in the pharmaceutical MLR promotional-review assist.
Try the live MLR demo → or email blake@hibiscus.buzz