Auditing Agents Under NIS2, DORA, and the EU AI Act: Compliance by construction, when architecture becomes the audit evidence
Year: 2026
Type: preprint
Abstract: Regulators no longer ask whether an agent action happened. They ask the deploying organization to reconstruct who or what authorized it, scoped to what, valid until when, and how the boundary was held across the delegation chain. Application logs answer the first question. Only architecture-produced evidence answers the second.NIS2 Article 21, DORA Articles 6 / 8 / 17-19, and EU AI Act Annex IV name different obligations under different enforcement regimes but demand the same artifact: a cryptographically chained receipt of authority that survives partial-chain compromise. The capability-token + ZKP + attenuation-discipline architecture from Papers #1-4 of the Non-Human Identity Series produces that artifact by construction.Paper #5 of the Non-Human Identity Series. Series I closure. Bridges to Series II (PQC for AI Agent Systems), opening late June 2026.
Author: Hasbini, Mohamad Amin
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
Open Access status: green
OpenAlex ID: W7161601836
Cites:
Cited by:
Related to: