What does Verified Digital Agents do?

You write what your AI agents are allowed to do in plain business language. VDA enforces those rules on every decision, seals each decision to a tamper-evident audit trail, and generates audit-ready EU AI Act and GDPR documentation from the actual run.

Is the compliance documentation automatic?

The EU AI Act conformance report and DPIA are generated automatically from the real run, but they are produced as audit-ready drafts for your compliance officer to review and sign off — they follow a DEMO DATA to DRAFT to ATTESTED lifecycle and are not a finished regulatory filing until attested.

Does it work with agents from other providers?

Yes. Governance lives in plain-English Markdown rather than vendor-specific code, so VDA can govern best-of-breed agents from any provider or framework under the same rules.

Governance for AI agents that you can prove.

The rules your agents follow — versioned and reviewed like code — and every governed decision sealed to a tamper-evident record, so you can show what governed a decision after the fact. Verified Digital Agents (VDA) is a composable set of governance blocks: each is useful on its own, they are stronger composed, and you can start with one. Governance lives in plain Markdown and git, so VDA governs best-of-breed agents from any provider or framework.

The model

Git holds the rules. Witness holds the events. Everything else sits between them. See the full governance cycle, block by block.

The blocks (honest status)

Witness (live) — seals decisions to a tamper-evident, hash-chained record; the Anchored tier commits the trail to external transparency logs (Sigstore Rekor + RFC-3161 TSAs), provable even against VDA. Surface: signed A2A card + live MCP server.
C2MD (live) — turns compliance standards into governance your agents can follow, and generates audit-ready documentation. Surface: signed A2A card + A2A skills (no MCP surface).
ACP — Agent Control Plane (live; federated approval identity staged, not yet live) — governance in git, authored with a Compliance Guard, adversarially tested, and signed before agents get it. Surface: signed A2A card + REST (MCP planned, not live).
Onboarding (live; deeper evaluation rolling out) — admits agents into a governed environment and issues verifiable credentials. Surface: signed A2A card + A2A skills; admission tools exposed over the Witness MCP.
HITL — Human in the loop (live) — surfaces what exceeds an agent's limits for a person; the decision is sealed to Witness under customer-managed custody. Domain-blind by construction: an item is a decision, some evidence, and an authority requirement. Live standalone at hitl.getvda.ai and in production via the hospitality flagship. Surface: signed A2A card + MCP/REST (9 skills), authenticated with a Witness Bearer. ACP composes with it — a governance change needing ratification is raised to HITL, resolved by an authorised human, sealed, and ACP's activation gate is fed by that sealed resolution.

Get going (MCP / agent-first)

Witness runs a live MCP server — https://witness.getvda.ai/api/witness/mcp. Add it to your agent and ask in plain language; discovering tools, verifying a record, and minting a free key need no setup. Free Sealed tier: 5,000 seals/month, Ed25519-signed and independently verifiable offline (the Anchored tier is externally committed, from EUR 50/mo).

Reporting

VDA turns the sealed trail into audit-ready EU AI Act Article 12 evidence reports and DPIA packs under GDPR Article 35, built from a real run. Examples (demo data): EU AI Act conformance summary, GDPR Art. 35 DPIA. VDA produces the evidence and controls that support compliance; it does not itself deliver legal compliance.

What C2MD does — with generated examples

Each page explains one capability and links a worked example on synthetic data (Northwind Bank, a fictional bank running a credit-decision agent). All examples are labelled DEMO DATA.

Assess agent risk — EU AI Act and GDPR in one pass: Annex III classification, provider-vs-deployer role, lawful basis, special-category inference flags, DPIA/FRIA triggers. See an example
Translate a compliance control — a NIST SP 800-53, ISO 42001, EU AI Act or GDPR reference becomes agent-actionable MUST / MUST NOT / MAY rules, each keeping its citation. See an example
Generate a governance bundle — AGENTS.md, SOP.md and SKILL.md in plain Markdown, versioned by git and evaluated by the agent at runtime. See an example
Generate a DPIA / FRIA scaffold — GDPR Article 35 and EU AI Act Article 27, structured for Compliance-Officer review. See an example
EU AI Act Evidence & Readiness Report — article-by-article COVERED / PARTIALLY COVERED / CUSTOMER ACTION, with Article 12 evidenced from a real sealed trail. See an example
Extract governance inputs (genesis-from-card) — derive data categories, autonomy level and industry from an agent's own card; reviewable by a human, never self-applying. See an example

The suite — signed service cards

Witness · C2MD · ACP · Onboarding · HITL · llms.txt · this site's card

Watch a governed run · Try your own governance · Book a governance demo · Hospitality flagship console (live Apaleo)

This page is an interactive application — enable JavaScript for the live demo and to contact us.