Every deployer with an EU AI Act documentation duty eventually gets asked the same question: how do you know the update did not break anything? You swapped the model, moved to a new inference build, changed quantization or batching — and your Annex IV documentation still describes the system as it was before.
Model behaviour is not frozen at deployment. A serving-stack upgrade alone can change output: in our reference series, the same endpoint was bit-exact 45/45 under sequential dispatch, and produced nine distinct outputs for the same request under concurrent serving — with nothing in the logs flagging the difference. “We upgraded the runtime, the model name is the same” is not a change-control story an auditor can work with.
The Evidence Canvas — the visual mapping of all 14 Annex IV elements — has been completely rebuilt. The previous version was a prototype with limited backend integration. The new implementation connects directly to the evidence API, supports multiple evidence types, and introduces a verification tracking system.
Key Features
Verification Workflow
Every piece of evidence now has a verifiable status:
Pending: Evidence has been uploaded or submitted but not yet reviewed
Verified: Evidence has been reviewed and confirmed as compliant
Rejected: Evidence does not meet requirements and needs revision
This three-state system gives Compliance Admins clear visibility into what’s been validated and what still needs attention. Auditors see the full verification chain with timestamps.
The Nomyo Router integration has matured from a basic discovery endpoint to a full-featured compliance agent. This release adds production-grade features including API key authentication, health monitoring, blacklist management, and automatic payload deduplication.
New Features
API Key Authentication
Each tenant receives a dedicated AISSURANCE_KEY for the discovery channel. This key is separate from Nomyo Router’s own authentication, providing defense-in-depth. Keys can be revoked independently, and all discovery payloads are verified with HMAC-SHA256 signatures.
