EU AI Act crosswalk

kya certify evaluates the open Agent Trust Baseline (30 requirements across Data and Privacy, Security, Safety, Reliability, Accountability, Society) against local evidence and writes a gap report (JSON + Markdown + HTML) under .kya/certify/.

kya certify            # gap report; exit 1 when gaps exist (CI-friendly)
kya certify --sign     # also emit an ed25519-signed evidence-bundle.json

• Every requirement maps to EU AI Act articles 9 to 15, 26, and 72 in docs/certify-eu-ai-act.md and src/certify/eu-ai-act-map.json.
• Machine checks never pass on an empty trail; they report insufficient_evidence.
• What a machine cannot check is covered by explicit local attestations, labeled as unverified operator statements.
• Certify is evidence-only: it never ALLOWs, DENYs, or blocks. The sole policy enforcement point stays the gate.

Bundles from kya certify --sign are self-signed. They prove bundle integrity and key continuity, not identity. They show a grey self-signed badge on the public verify endpoint (POST /api/v1/kya/evidence/verify) and badge. The green Shield Verified badge is only for bundles signed with the key of an active hosted workspace. A green badge needs a bundle that was downloaded on Pro or Scale and is not older than 7 days. It ties the badge to a hosted account, not to a checked legal identity of the company or the agent. It is not a third-party audit.

Hosted certify

The hosted console evaluates the same 30 requirements against your hosted trail: /app/kya/certify shows the live requirement table with evidence and recommended actions, and attestations can be recorded in the page. GET /api/v1/kya/certify/report returns the gap report on every plan; POST /api/v1/kya/certify/bundle downloads an ed25519-signed evidence bundle on Pro and Scale. Hosted bundles use the OSS bundle format byte-for-byte, so the public verify endpoint validates both without changes.