Regulation (EU) 910/2014, as amended by Regulation (EU) 2024/1183
What eIDAS says about timestamps and electronic ledgers, and where Logsiegel stands today
eIDAS obliges nobody to log what an AI does. But it does govern what evidentiary weight a trail carries in court when it is qualified with a time or kept as a qualified electronic ledger. That is the bar Logsiegel aims at, and this page says honestly how far along it is today.
Who this applies to
Anyone who wants to use a trail as evidence, in disputes, toward supervisory authorities or in contractual relationships. Especially operators who want to go beyond the local assurance level for auditors, and trust service providers who offer time stamps or ledgers as a service.
What the regulation requires in terms of records
The relevant provisions in the version after the 2024 amendment:
| Reference | Requirement |
|---|---|
| Art. 41(1) | An electronic time stamp shall not be denied legal effect and admissibility as evidence solely on the grounds that it is in electronic form or that it is not qualified. |
| Art. 41(2) | A qualified electronic time stamp enjoys the presumption that the date and time it indicates are accurate and that the data was intact at that point in time. |
| Art. 42 | Requirements for qualified time stamps: binding to Coordinated Universal Time, issuance by a qualified trust service provider, signature or seal. |
| Art. 45k(1) | Electronic ledgers: legal effect and admissibility as evidence shall not be denied solely on the grounds that the ledger is in electronic form or that it is not qualified. |
| Art. 45k(2) | Data records in a qualified electronic ledger enjoy the presumption of their unique and accurate chronological ordering and of their integrity. |
| Art. 45l | Requirements for qualified electronic ledgers: operation by qualified trust service providers, evidence of the origin of the data records, unique chronological ordering, and recording in such a way that any subsequent change is immediately detectable. |
| Art. 25 | Electronic signatures: legal effect shall not be denied solely because of the electronic form; a qualified signature has the equivalent legal effect of a handwritten signature. |
What Logsiegel contributes today
- The structure of a ledger, without a blockchain. An append-only trail, with hash chaining, Merkle proofs to RFC 6962 and Ed25519-signed checkpoints. Technically that is exactly the unique, chronological ordering with integrity Art. 45l speaks of (origin, ordering, immediate detectability of changes), but not qualified: there is no trust service provider behind it, and times come from the operator.
- Admissible as evidence. Under Art. 41(1) and Art. 45k, a non-qualified time stamp or ledger must not be denied evidentiary standing solely on those grounds. What weight a court gives it is a matter of the free evaluation of evidence; an expert can retrace the verification with the open-source tool.
- Single-entry receipts for third parties.
logsiegel receiptbuilds a file for one single action, made of the entry, an inclusion proof and a signed checkpoint. An auditor, customer or court verifies it offline against your published key, without access to your systems and without seeing the rest of the trail. - Unaltered records, verifiable. Every entry is hash-linked to the one before it; at intervals a Merkle root is formed and signed with Ed25519 (a checkpoint). Any later edit, reorder or truncation makes
logsiegel verifyfail.
What is in progress planned
- Qualified time stamps on checkpoints. Every checkpoint additionally gets a time from a qualified trust service provider. Then the presumption of Art. 41(2) applies to the checkpoint, and with it to everything beneath it. The architecture is designed for that; the integration is a planned stage.
- Independent witness that counter-signs checkpoints and checks their consistency (C2SP format, several witnesses possible).
- An assessment against Art. 45l. Whether and how Logsiegel trails could be kept as part of a qualified electronic ledger by a trust service provider is a research goal of the project, not a feature today.
What Logsiegel does not do
- Not a qualified trust service. Logsiegel is software, not a provider under eIDAS. Neither the signatures nor the time stamps nor the trail are qualified today.
- The presumptions of Art. 41(2) and Art. 45k(2) do not apply today to Logsiegel trails. Anyone who needs them waits for the timestamp integration or plugs in a qualified service themselves.
- Time. Timestamps in the trail are a claim by the operator until they are counter-signed by a witness or by a qualified timestamping service.
- Protection against the operator itself. Whoever holds the signing key could rewrite the trail and sign it again. That comes to light precisely when somebody else holds an earlier checkpoint or receipt. So hand your checkpoints out; counter-signing by an independent witness is the next stage of the project.
- Legal assessment. Whether your system falls under the regulation, which duties apply in detail and whether a receipt is enough in a given case is decided by your legal or compliance review, not by this tool.
How to put it to work
1. Install it and create a trail
The SDK is Python, Apache 2.0, no server and no account. The origin (origin) names the system whose actions are being recorded.
pip install logsiegel
logsiegel init ./trail --origin "acme.example/support-agent"2. Create checkpoints and hand them out
Create checkpoints regularly (via cron, for instance) and put them outside your own infrastructure: with the auditor, with the customer, in someone else's repository. Only a checkpoint you no longer control alone makes the trail hold up against yourself.
logsiegel checkpoint ./trail
logsiegel verify ./trail3. Anchor checkpoints externally already today
Until the qualified integration arrives: file signed checkpoints in places you do not control alone, in someone else's repository, with the customer or with the auditor. Every such place is a witness that the trail looked like this at that moment.
4. Hand out the receipt when someone asks
Instead of database extracts you hand out a single receipt. The other side verifies it in the browser at logsiegel.com/verifier or on the command line, both offline.
logsiegel receipt ./trail --seq 1284 --out receipt.json
logsiegel verify-receipt receipt.json --pubkey logsiegel.pubMore regulations: EU AI Act GDPR DORA NIS2 / critical infrastructure ISO/IEC 27001 ISO/IEC 42001 GoBD Overview
Legal status September 2026. This page is a technical assessment by the project, not legal advice and not a conformity statement. Please check the references against the current text of the law. Corrections welcome via GitHub issue.