Software becomes a product
The new EU Product Liability Directive explicitly covers software, AI included. It applies to products placed on the market after 9 December 2026.
Directive (EU) 2024/2853, Art. 4(1), Art. 2
Proof of Agent Work turns every run of an AI agent into a record that is signed, stamped by an independent time authority, and checkable by your own people in seconds. Change one step afterwards, and the proof breaks.
After a loss, the agent's log is the only witness. Today that witness lives in a database the insured controls — and nobody can prove it was not rewritten.
The new EU Product Liability Directive explicitly covers software, AI included. It applies to products placed on the market after 9 December 2026.
Courts can order a defendant to disclose relevant evidence. If it is not disclosed, the product can be presumed defective. Whoever holds a credible record holds the case.
High-risk AI systems must log events automatically, and deployers must keep those logs for at least six months. The law asks for logs. It does not ask whether anyone can trust them.
Instead of a questionnaire answer like “a human approves every payment”, you see signed runs that show whether the approval step was actually there.
You get the exact sequence of steps the agent took: what it received, what it estimated, who approved it. And you can be certain it is the record written at the time.
The operator signs the record with its own key, and an independent authority dates it. Neither the vendor nor the insured can later claim the log was something else.
The demo above runs these checks in your browser. Your engineers can repeat them with Python and standard OpenSSL, without a single line of our code. We ran exactly that on 21 October 2026.
Each step is fingerprinted with SHA-256 into one Merkle root. Change, remove or reorder any step, and the root no longer matches.
The root is signed with ML-DSA-65, the NIST post-quantum signature standard (FIPS 204). The public key is published on the signer's own domain.
An independent RFC 3161 time-stamping authority (here: DigiCert) stamps the signature. Nobody can backdate the record afterwards, us included.
A typical pilot covers one agent workflow, either yours or one of an insured's, and takes two to four weeks.
We connect one agent workflow, for example claims intake. Every step gets recorded, signed and timestamped as it runs.
Your team receives the records, the open verifier and the commands needed to check them without our software.
Your security and claims people try to forge, backdate or edit a record. The decision then rests on that result, not on a slide.
DESTILL licenses Proof of Agent Work to insurers and reinsurers. Talk to the inventor directly.