EU AI Act Article 50, enforced 2 August 2026
Heartbeat signs every output of one AI deployment. When the AI behaves correctly, the pulse is steady. When it drifts, the pulse changes, the receipts show it, the ledger keeps the record. The proof is yours, and it never pings out.
Any auditor checks the chain themselves, with an open script.
Heartbeat is that, for AI. Every governed output is a beat: a signed receipt.
The beats hash-chain into a ledger any auditor can verify with an open-source script, without ever contacting you. Steady pulse, the AI is behaving. Changed pulse, it drifted, and the ledger shows the moment it happened. The evidence is the byproduct of running the AI, not a report assembled afterward.
Article 50 carries penalties up to a set share of global annual turnover, per violation; confirm the figure for your case with counsel. Logs on a server you administer cannot prove they are contemporaneous, which is the one thing a regulator asks.
Heartbeat is twelve months of continuously signed, hash-chained evidence any auditor can verify. Against the exposure, the license is a rounding error.
The license buys the evidence, not a verdict on the fine.
The world has already ruled on AI without proof.
A federal court held privilege can be waived when client data passes through third-party AI servers, and the firm could not prove the AI use was scoped or contained.
A signed receipt is that proof, produced locally, with nothing pinging out.
The complaint cites the absence of a verifiable artifact for each AI-assisted denial, and the difficulty of reconstructing what the system did at the moment of each one.
A per-decision receipt gives every denial an audit artifact reviewers verify themselves.
Italy's regulator banned the service after finding it failed to protect minors. No verifiable evidence of age-adaptive governance existed at the time of review.
The signed stream is evidence a regulator inspects directly, without taking the operator's word.
The architecture does not care what the AI is doing. It cares that every governed output leaves a beat. The buyer and the regulation change with the surface, the license shape does not.
It does not certify your compliance. It makes the evidence you bring to it. Evidence, not certification.
You produce signed evidence. You and your auditor interpret it. You and your regulator settle it. No certifier sits in your chain, so there is no opinion to challenge in court. We hold nothing of yours. You hold the keys. You hold the evidence. We hold the filings; the USPTO allowed the first claims in July 2026. The verifier is public for anyone to check, never a lever we can pull on you.
Where it sits.
Heartbeat is the pulse of one AI surface: every output a signed beat. The Witness is the whole estate's memory: every moment across every tool, with the human decision sealed beside it. The beat proves the machine ran clean. The memory answers for everything it ran.
One pulse. Five surfaces. The same signed receipt.
How the proof works
Govern at the moment of output. It deploys inside your environment, bound to your license. Every AI output passes through it, and the decision to allow, refuse, hold, or escalate is made on local computation alone. The capability is local or it does not run.
Issue the receipt as a byproduct. Each governed event produces a signed receipt, chained to the one before it. Tamper-evident, append-only, signed on your machine. Nothing pings out, and nothing leaves.
Hand the proof to whoever asks. Export the bundle, and your auditor, counsel, or regulator runs the public verifier against your key. The chain matches or it does not. You never call us, and we never see your data.
Proof you can hold, made where the data lives, sent nowhere.
Clean answers.
One stable AI deployment with one identifier: a legal-AI deployment, a productivity-suite AI tenant, an enterprise model endpoint, an internal RAG, a customer-facing chatbot, a drug-discovery assistant. Heartbeat binds to that one deployment and signs every governance event from it. Three surfaces need three licenses. One surface serving a million queries needs one.
No. It produces verifiable evidence for one bound AI deployment, which is what an auditor or regulator needs to check governance of that deployment. Compliance is a posture across your whole estate. This is one strong piece of evidence in that picture.
No, and that distinction protects you. We are infrastructure. You generate the signed evidence, you and your auditor interpret it, you and your regulator settle it. No certifier sits in your chain whose opinion can be challenged in court. You hold the keys. You hold the evidence, and the verifier is public for anyone to check.
The signed record shows it, contemporaneously. The product does not decide what drift means. Your team, your auditor, your counsel, or your regulator interpret it. The point is that the evidence is there, signed and verifiable, before anyone asks.
The software, the documentation, the install guide, the audit-defense playbook, and the open-source verifier, delivered at purchase. It self-installs. Support contracts, SLAs, and consulting are separate engagements.
Those sell policy dashboards and checklist tooling to prepare for certifications. None produces a verifiable evidence stream a regulator can check independently. Heartbeat is the substrate underneath that question. We compete with the absence of evidence, not with dashboards.
Install it and point your AI pipeline at a single endpoint. About one engineer-day for a team that already runs containers. The public verifier confirms the integration is correct before you ever show evidence to a regulator.
No. It runs entirely on your infrastructure. The signing key is generated on your machine and never leaves it. No telemetry, no analytics, no remote update. Block all outbound traffic at your firewall and it still works.
It keeps running. New outputs stop being covered by the Heartbeat Attested mark, but every receipt signed before expiry stays valid and verifiable forever. A lapse creates a gap going forward, never backward.
The same evidence stream is responsive to NIST AI RMF, FDA and EMA principles, EU GMP Annex 11, ISO 42001, and the US state AI acts. The infrastructure you buy for one cliff defends you under the next.
Regulayer, Inc. Patents pending; the estate is held by the inventor with counsel of record.
Heartbeat covers one bound AI deployment. Regulayer covers the whole estate, adding fleet aggregation, drift monitoring, and the broader claim set. Start with Heartbeat on one surface, add more over time.
Steady when it behaves. Provable when it drifts.
Heartbeat produces tamper-evident evidence for a named regulation. It is evidence input, not a compliance certification, attestation, or legal determination, and not a SOC 2 report, ISO certification, or audit opinion. Confirm deadlines and citations with counsel for your jurisdiction.
