Post-Quantum AI Compliance Infrastructure
for a regulated world.

AI systems make decisions.
Nobody can prove what they decided.

The EU AI Act Article 12 requires high-risk AI systems to maintain automatic logging of autonomous decisions — tamper-evident, retained for at least six months, available to regulators on demand. Enforcement begins August 2026.

Existing approaches fail in one of three ways: application-level logs are mutable and unverifiable; third-party audit tools bolt on after the fact and miss real-time decisions; blockchain solutions introduce unacceptable latency for production AI pipelines.

The penalty for non-compliance is up to 3% of global annual turnover — for a $10B institution, that is $300M per year.

One line of code.
Every decision attested.

Rubric embeds at the framework level — not the application level. A single call at startup instruments every LLM call, agent decision, and tool use automatically. No per-decision code. No codebase audit. No latency impact.

Each attestation receives a unique ID, is cryptographically signed with ML-DSA-65 (NIST FIPS 204 post-quantum signature standard), aggregated into a Merkle forest, and anchored to Hedera Consensus Service — a public, immutable, verifiable ledger with Byzantine fault-tolerant consensus.

Built for production scale.
Not a proof of concept.

Rubric uses a three-tier aggregation architecture that achieves 1,000,000:1 compression for HCS writes — enabling billion-scale daily throughput at minimal on-chain cost.

Post-Quantum Cryptography

All signatures use ML-DSA-65 (CRYSTALS-Dilithium), standardized by NIST in FIPS 204 (August 2024). Rubric's implementation uses a native N-API C++ addon via liboqs, delivering 52× faster signing than pure JavaScript implementations. Attestations signed today remain verifiable against quantum adversaries.

Payload Privacy

Decision payloads are encrypted with AES-256-GCM before storage. The customer holds the encryption key — Rubric stores only the ciphertext and a cryptographic commitment. Rubric cannot read your AI decisions. Regulators receive the key from the customer directly for audit purposes.

Beyond decisions.
The full agent accountability stack.

Modern AI systems are not single-shot decision engines — they are autonomous agents that reason across multiple steps, call external tools, maintain state across interactions, and delegate to other agents. Rubric attests the entire stack, not just the final output.

Tool Call Attestation

Every external tool invocation — web search, code execution, API calls, database queries — is attested with hashed input/output pairs, duration, success status, and chain linkage to the prior attestation. This is where AI risk actually lives: not the reasoning, the action.

Agent State Hashing

At every decision point, Rubric captures a SHA3-256 hash of the agent's current memory, context window, and system prompt — capped at 4KB to bound storage impact. Two identical decisions made from different mental states produce different state hashes, making behavioral drift cryptographically detectable. State hash type is recorded as full or truncated for audit transparency.

Chain Linking

Every attestation carries a priorAttestationId reference, forming a tamper-evident chain across the agent's full session. Deleting or reordering any attestation breaks the chain. The complete reasoning sequence — from initial input through every tool call and state transition to final decision — is cryptographically sealed and independently verifiable.

Agent Identity Registry

Each agent is registered with a stable W3C DID anchored to Hedera mainnet and a dedicated ML-DSA-65 (NIST FIPS 204) keypair. Agents are first-class cryptographic principals — auditors can verify which agent acted, not just that an agent acted. Registration records include jurisdiction, permitted uses, model hash, and version.

Global regulatory compliance.
Computed automatically from intent.

Declare your AI system's intended use and jurisdiction. Rubric computes your complete regulatory obligation set automatically — mandatory fields, applicable articles, safe harbor conditions, and a ready-to-paste SDK configuration. No compliance expertise required.

Every assertion in every compliance report is backed by a cryptographic attestation anchored to Hedera HCS Topic 0.0.10416909 — independently verifiable without Rubric's involvement. Regulators, notified bodies, and auditors can verify any evidence entry directly on-chain.

13 frameworks.
Two packages. Zero configuration.

Rubric ships as two distribution packages — one for Python, one for TypeScript/Node — covering 13 major AI frameworks. Installation takes under 60 seconds. Every package includes the full compliance field set and auto-populates timing, latency, and event classification.

Tested at scale.
Zero errors.

Your existing tools.
No custom integration.

Every attestation is exportable in three formats on demand. Pipe directly into your existing GRC or SIEM platform — no custom integration, no professional services engagement.

Each export record includes a verify_url linking to the public audit portal — regulators can independently verify any attestation without access to your internal systems or Rubric infrastructure.

Real-time event push.
Every decision, instantly.

Every attestation can be pushed to your SIEM, GRC platform, or custom endpoint in real time via HMAC-SHA256 signed webhooks. Non-blocking — zero latency impact on the attestation pipeline.

Webhooks auto-disable after 10 consecutive delivery failures — preventing noise while surfacing endpoint issues. Delivery status and failure counts are tracked per endpoint and visible via GET /v1/webhooks.

Start free.
Scale when you do.

Design partner pricing available: 60-day free pilot followed by $2,500/month. Contact Scott@Rubric-Protocol.com to discuss requirements.