How a mid-size EU insurer satisfied Article 12 tamper-evident logging with infrastructure-level enforcement

The company

Alpine Insurance GmbH is a mid-size insurer based in Munich, writing €400M in annual premiums across life, health, and property lines. In early 2026, they deployed an AI underwriting agent to handle standard-risk policy applications — reducing manual review from 45 minutes to under 90 seconds per application.

The AI agent reviews applicant data, checks against underwriting guidelines, calculates a premium, and issues a policy — or escalates to a human underwriter. It processes roughly 23,000 applications per month.

Under Annex III of the EU AI Act, AI systems used for "pricing and underwriting of life and health insurance" are classified as high-risk.

The problem

Article 12 requires tamper-evident logs. Theirs weren’t.

Alpine’s compliance team had mapped their obligations. Articles 11, 12, and 14 were the hard ones:

• Article 11 requires technical documentation “drawn up before the system is placed on the market” and kept up to date. Their existing documentation was an internal wiki page last updated in December 2025.
• Article 12 requires logs that are “automatically recorded” during system operation. Their logs were generated by the AI agent itself — the same system whose behaviour they were supposed to be auditing.
• Article 14 requires “effective human oversight.” Their oversight mechanism was a quarterly review meeting where someone opened a dashboard and checked whether error rates looked normal. No one could confirm whether a specific application had followed the correct sequence.

Their CTO summarised it: “We have logs. The problem is our AI agent writes them. If it skipped a validation step, the log would still say everything is fine. An auditor isn’t going to accept that.”

What they tried first

The engineering team investigated three approaches before finding AgenticRail:

• Application-layer logging: Add structured logging to the agent’s code. Rejected: the agent could still bypass its own logging by skipping steps or hallucinating completions.
• Database audit tables: Write enforcement decisions to a separate database table. Rejected: the agent writes to the same database — there’s no architectural separation between the thing being controlled and the thing doing the controlling.
• Human-in-the-loop: Have a human approve every AI underwriting decision. Rejected: this eliminated the efficiency gain — the whole point of the AI agent was to reduce manual review.

All three shared the same flaw: the enforcement lived at the same layer as the agent. The agent could bypass it.

How AgenticRail solved it

Integration: one POST call before each underwriting step

The AI underwriting agent’s workflow had five stages: intake applicant data → validate completeness → assess risk → calculate premium → issue or escalate. Alpine mapped these to five enforcement steps and added one API call before each stage:

The attestation object is signed into the R2 receipt alongside the gate decision. Every risk score, AML result, and approval is cryptographically bound to the step that produced it — before execution runs.

The integration took two days — one day to map the workflow steps, one day to add the API calls. No infrastructure changes. No database migration. No new dependencies beyond the HTTP client already in their stack.

What the gate does during each call

• Authenticate: API key validated. Alpine’s key is a production key with a 3,000 req/min rate limit.
• Validate the step: The gate checks that assess_risk is the correct next step. If the agent tried to jump ahead or replay a previous step, it would be denied.
• Write a receipt: Every ALLOW decision produces an HMAC-signed cryptographic receipt in R2 immutable storage. The receipt includes the step name, decision, timestamp, and a hash of the previous receipt — creating a chain.

The underwriting workflow — enforced

What changed for Alpine

Article 11 — technical documentation that survives audit

Instead of a wiki page, Alpine’s technical documentation now references their receipt chains. Every system version, every policy decision, every enforcement outcome is recorded at the infrastructure level. The report generator produces a verification report in 30 seconds — HMAC signature check, chain linkage proof, and an AI-generated compliance narrative suitable for attaching to an Article 11 filing.

Article 12 — tamper-evident logging

The receipts are cryptographic, not procedural. Each receipt’s pack_id is a SHA-256 hash of the enforcement decision. Each receipt embeds the previous receipt’s pack_id. An auditor can verify the entire chain independently — no access to Alpine’s systems required. The report generator does it in a browser.

Article 12 also requires logs sufficient to identify the “persons involved in the verification.” Alpine passes an attestation object with each gate call — risk scores, AML results, approver IDs — which is signed into the receipt at the moment of ALLOW. When a regulator asks who approved a specific underwriting decision and what evidence justified it, Alpine hands them a report URL. The answer is cryptographically provable.

Article 14 — effective human oversight

The gate is the oversight mechanism. If a step doesn’t pass, the agent cannot proceed. No human needs to watch every decision — the infrastructure enforces the sequence. The receipts prove it did. Alpine’s compliance officer runs a verification report before every quarterly audit committee meeting.

Key numbers