Vision

Who answers when the AI gets it wrong?

Truveil exists because nobody currently does.

These are happening now.

AI agents are making consequential decisions across regulated industries. Some of these decisions are correct. Some are not. When they are not, the question of who answers is genuinely unclear.

The candidate who was rejected.

A senior software engineer applies to a Fortune 500 company. An AI hiring agent screens the application, scores it against an internal rubric, and rejects without a human review. The candidate later learns that the agent flagged "career gap" as a negative signal. The gap was for parental leave. Who is accountable for the discriminatory outcome? The hiring team that deployed the agent? The vendor that built it? The model provider whose foundation model powers it? In which jurisdiction does the candidate seek remedy?

The loan that should not have been approved.

A small business loan application is processed by an AI underwriting agent. The agent approves the loan at favorable terms. Within six months, the borrower defaults. Investigation reveals the agent missed standard fraud signals because the input data was incomplete. The bank's compliance team is asked to demonstrate how the decision was made, what evidence supported the approval, and what controls were in place. Their answer: we have the agent's output, but we have no record of the reasoning that produced it.

The patient who was denied.

A hospital triage AI evaluates an emergency room intake. Based on symptom patterns, the agent classifies the patient as low-priority. The patient deteriorates while waiting. A subsequent review finds the agent's training data underrepresented the demographic the patient belonged to. The hospital's medical director, the AI vendor, the foundation model provider, and the regulatory body each have different answers to the question of accountability.

Three scenarios. Three industries. One unanswered question.

The pattern beneath these scenarios.

AI agents are deployed faster than the accountability architecture surrounding them. The agents make decisions in seconds. The accountability infrastructure to defend those decisions takes weeks to assemble, if it can be assembled at all.

Regulators and standards bodies have noticed. The EU AI Act, India DPDP Rules 2025, DIFC Regulation 10, the NIST AI Risk Management Framework, ISO/IEC 42001, and Singapore's Model AI Governance Framework all converge on a similar requirement: AI agents that affect people's lives must be auditable. Not someday. Now.

The hardest part is not building the agent. The hardest part is producing the evidence trail that proves the agent was used responsibly. Most teams cannot produce this evidence because no tool exists that captures it at the speed the agent operates. The audit becomes a manual archaeology project, performed weeks after the decision was made, by people who were not there.

The cost of this gap is asymmetric. The agent that decided correctly gets no credit for it. The agent that decided wrongly creates legal, reputational, and human cost that the operator cannot defend against.

The gap is not a product gap. It is an architecture gap.

Where regulation actually stands.

The regulations that govern AI accountability are real. They are also moving. The Digital Omnibus deferred the EU AI Act's high-risk obligations to December 2027 for Annex III systems and August 2028 for Annex I products. Article 50 transparency obligations were not deferred and have been binding since 2 August 2026. One narrow transition applies: under Article 111(4), the machine-readable marking duty in Article 50(2) runs to 2 December 2026, and only for systems placed on the market before 2 August 2026. Two further Article 5 prohibitions bind from 2 December 2026. The AI Office has held market-surveillance powers over systems built on general-purpose models since 27 July 2026. India's DPDP operational obligations bind from 13 May 2027. UAE Federal PDPL Executive Regulations remain pending. DIFC Regulation 10 is in force. Singapore MGF and AI Verify are advisory but operationally normative.

The deferrals create a window. They do not create an exemption. The audit trail you produce today is the one regulators will ask for tomorrow. Procurement teams and enterprise clients are already asking for it. Building accountability now is cheaper than retrofitting it after the deadline arrives.

Truveil is built for this window. Calibrated against primary regulatory text across six frameworks. Updated as regulations evolve. Honest about what is binding and what is advisory. Customers do not need to interpret the regulatory landscape themselves. Truveil does that work, and surfaces what matters in the customer's specific context.

Why Truveil is built the way it is.

Architecture 01

Accountability cannot be retrofitted.

Manual audit preparation produces manual audit results. They are slow, expensive, partial, and not reproducible. Truveil captures evidence at the point of decision, in real time, in a structured form that the audit engine reads directly. The audit report does not require human reconstruction because the decision record was complete when the decision was made.

Architecture 02

Regulators read primary text, not vendor interpretations.

AI compliance tools that summarize regulations using LLMs produce summaries that drift from the source. Truveil's scoring engine is calibrated against primary regulatory text retrieved from authoritative sources. Truveil's analytical layer sits on top of structured primary text. When the regulation changes, the source updates and Truveil follows. Customers see the same regulation regulators see.

Architecture 03

Accountability lives where the work is.

AI agents are built and operated inside Claude, ChatGPT, Cursor, n8n, Make, Zapier, and other AI-native tools. Truveil meets them there. The advisory layer is available in any MCP-compatible client. The audit layer instruments agents through the SDK, the MCP, or the dedicated n8n community node, n8n-nodes-truveil. No separate dashboard to learn. No new workflow to adopt. Accountability is woven into the existing work, not bolted on after.

What Truveil commits to.

A vendor's commitments matter more than its features. These are specific enough to be tested, and binding on Truveil's development priorities.

Scoring is proprietary. Grounding is transparent.

Truveil's scoring engine is proprietary. The regulations Truveil's scoring is grounded in are not. Every audit report cites the specific articles, rules, and provisions that produced each finding. Customers can verify Truveil's reasoning against primary regulatory text directly. Nothing hides behind "trust us, we are the experts."

Reports speak the customer's language.

Audit reports are written in natural language. The purpose is to make customers understand the gap, not just report it. A compliance officer reading a Truveil report should be able to defend it in front of a regulator, a board, or a procurement committee without needing Truveil to translate. Plain language is not a feature. It is the point.

Truveil surfaces solutions, not just problems.

Every audit finding includes the remediation Truveil recommends. Implement the fix, re-run the agent, and the improvement appears in the next audit immediately. Compare runs side-by-side to see the delta. Accountability is not a one-time test. It is a continuous improvement loop.

Audit logs are tamper-evident.

Truveil's logs are cryptographically chained. The record is built at the moment of the decision, not reconstructed afterwards — what a regulator reads is the log the agent wrote, not a later account of it. A modified entry surfaces on verification, at the point the chain stops matching. Cryptographic integrity is structural to the platform, not a configuration option.

Truveil exists because the AI accountability gap is real, the regulatory architecture is converging, and the customers shipping AI agents into regulated spaces deserve a tool that does this work honestly. We are building it because no one else is, at the level of rigor the problem requires.

Responsible Autonomy.

The industry has settled on one question about AI agents: who is this agent, and what is it allowed to do? Identity, permissions, scope. Necessary, and not enough. Permissions describe the agent you intended to build. They say nothing about the one you actually shipped.

The questions that matter arrive after deployment. Which decisions does it take alone that deserve a human? Which of its actions cannot be undone? When it is wrong about someone, can they push back? These are not compliance questions wearing a disguise. They are the exact places an agent can do damage without asking first.

Truveil scores every run against those questions and names the gaps, with what to do about each. Closing them does not make an agent cleverer. It makes it safer to run: fewer mistakes that matter, caught earlier, correctable when they happen. We call the practice Conduct Assurance, and it starts as something you owe yourself, not a regulator.

The scoring is grounded in six regulatory frameworks because those are the best catalogues anyone has written of how AI systems fail people. Governments will enforce them in time, and when they do, your evidence already exists. But that is the byproduct. The product is an agent you can trust with more, because you can see what it did with what it already had. That is Responsible Autonomy: scope earned through visibility.

From the Founder

For most of my career, I have worked at the intersection of law, technology, and accountability. As a patent attorney, I spent over a decade asking one question that most people overlook: not what an invention does, but how it does it. That distinction is the entire foundation of patent law, and it became the lens through which I see everything.

When AI agents started taking over real work, my first instinct was the same as everyone else's. I wanted to build one. The capability was genuinely remarkable. It still is.

But then the professional muscle memory kicked in.

How was this decision made? I never gave that instruction. How did it decide what to keep and what to discard? How did it arrive at that conclusion? I kept asking, and there were no answers, not because the answers were hidden, but because nobody had built the infrastructure to capture them in the first place.

What unsettled me was not the AI. It was watching organisations deploy agents at scale, with real consequences, while the decision trail simply did not exist. No audit log. No accountability chain. No way to defend, or challenge, what the system had done.

In patent law, an invention without a clear record of how it works is indefensible. An AI agent without one is a liability waiting to surface.

That discomfort became a conviction. That conviction became Truveil.

Karan Sharma

Patent Attorney and Founder, Truveil

Start auditing your agents today.

Start free See how it works