Compliance Infrastructure

AI Governance & Compliance for AI Agents.

Traccia turns agent telemetry into compliance evidence. Built on OpenTelemetry, it records transparency disclosures, risk tiers, integrity-hashed audit trails, and human-review sign-off — with opt-in modules for the EU AI Act and HIPAA, without changing your agent code.

Opt-in Modules

One evidence engine. Two frameworks.

Both modules are disabled by default and never auto-enabled by region. Turn on what you need — they can run together.

EU AI Act

Available

Registry fields, article-mapped exports, transparency hooks, and documentation drafts for teams that deploy or provide AI in the EU. It helps you collect and organize evidence.

  • Art. 50 transparency disclosures via disclosure()
  • Risk-tier stamping on every execution trace
  • Art. 14 human review queue + FRIA draft wizard
  • Article-labeled JSON evidence bundles

HIPAA

Early Access

Registry fields, safeguard checklists, and labeled exports for teams governing healthcare AI agents. It helps you inventory and document — it does not certify HIPAA compliance, and we do not offer a signed BAA yet.

  • PHI flags, categories, and role hints on AI systems
  • Administrative / technical / physical safeguard drafts
  • Track your vendors' BAA status
  • 45 CFR-labeled evidence packs
How It Works

The building blocks of your evidence.

Article 50 Transparency

The EU AI Act mandates that users be informed when interacting with an AI system. Record the evidence automatically.

from traccia import disclosure

disclosure("user_informed", timestamp=...)

Records immutable evidence of when users are told they're interacting with AI.

Risk Tiers & Frameworks

Stamp every execution trace with its designated framework and risk tier to ensure appropriate downstream handling.

init(compliance={
  "frameworks": ["eu_ai_act"],
  "risk_tier": "high"
})

Automatically attaches governance metadata to every span.

Integrity & Audit Trails

Prevent tampering and ensure non-repudiation of your system's execution records.

  • Cryptographic integrity hashes on export
  • Governance metadata immutability
  • Append-only execution history

Human Review & Exports

A dedicated Governance Hub for compliance teams to review and export evidence.

  • Human-in-the-loop sign-offs
  • Incident tagging and resolution workflows
  • JSON evidence bundles for auditors

Governance for healthcare AI agents

What the HIPAA module does — and, just as importantly, what it doesn't.

PHI-aware registry

Declare which AI systems may handle PHI, with categories and role hints. Soft warnings only — Traccia warns, it does not hard-block ingestion.

Safeguards & vendor BAAs

Draft administrative, technical, and physical safeguard notes, and track your vendors' BAA status for model APIs and vector databases.

45 CFR-labeled evidence

Export audit bundles with labels for 164.308, 164.312, 164.502(b), and more — operational evidence to feed your compliance program.

Honest scope. Enabling the HIPAA module does not make your organization HIPAA compliant. Traccia does not certify compliance, file with OCR, perform a full Security Rule risk analysis, or currently offer a signed Business Associate Agreement. Best-effort SDK redaction is regex-based, not medical NER. Use Traccia alongside qualified counsel and your GRC program.

Disclaimer: Traccia provides decision-support tooling and technical infrastructure, not legal advice. It helps you collect and organize evidence — it does not classify your systems, perform conformity assessment, or file with any authority. Please consult qualified legal counsel regarding specific EU AI Act or HIPAA requirements for your systems.