What question did this study set out to answer?

The research aims to explore how architecture can serve as evidence for compliance under various regulatory frameworks.

May 20, 2026Open Access

Auditing Agents Under NIS2, DORA, and the EU AI Act: Compliance by construction, when architecture becomes the audit evidence

Key Points

The research aims to explore how architecture can serve as evidence for compliance under various regulatory frameworks.
Analyzed obligations from NIS2, DORA, and the EU AI Act for compliance evidence requirements.
Developed a solution using capability-token, zero knowledge proof, and attenuation-discipline architecture.
A cryptographically chained receipt of authority was generated that withstands partial-chain compromise.
Validation of architectural evidence as sufficient to meet regulatory demands across multiple frameworks.

Abstract

Regulators no longer ask whether an agent action happened. They ask the deploying organization to reconstruct who or what authorized it, scoped to what, valid until when, and how the boundary was held across the delegation chain. Application logs answer the first question. Only architecture-produced evidence answers the second.NIS2 Article 21, DORA Articles 6 / 8 / 17-19, and EU AI Act Annex IV name different obligations under different enforcement regimes but demand the same artifact: a cryptographically chained receipt of authority that survives partial-chain compromise. The capability-token + ZKP + attenuation-discipline architecture from Papers #1-4 of the Non-Human Identity Series produces that artifact by construction.Paper #5 of the Non-Human Identity Series. Series I closure. Bridges to Series II (PQC for AI Agent Systems), opening late June 2026.

Ask AI

Helpful

Bookmark

View Full Paper