Regulatory Enforcement · Evidence Chain · Security Probing

ICOSA InSight Inspector

The investigative platform for EU AI Act enforcement — autonomous evidence collection, deep compliance screening against every applicable article, and a full security probe kit backed by industry-standard tools. Built for notifying bodies, market surveillance authorities, and governing bodies operating under Art. 63–65.

Try a Civilian ScanAuthority Mode

Civilian Mode

Public evidence capture. Respects robots.txt. Anonymous access only. Screens for 5 core disclosure signals. Available to anyone — this is the scan accessible from the demo below and the public API.

Authority Mode

Regulatory enforcement. Requires notifying body authentication. Bypasses robots.txt (legal authority under Art. 63–65 supersedes polite convention). Full EU AI Act article coverage. Security probe kit with 30+ tools. API integrations with Shodan, VirusTotal, SSL Labs, and more.

Civilian Scan — How It Works

1
Submit a target URL

Point it at any public-facing system. Civilian mode operates as an anonymous visitor — no credentials, no internal access.

2
robots.txt-bounded capture

Fetches are limited to what the target's own robots.txt permits. Nothing disallowed is ever touched.

3
Disclosure signal screening

Each captured page is screened for disclosure language a compliant deployment should carry — AI content disclosure, privacy policy, model card, human oversight contact, risk classification.

4
Hash-chained into the Audit Chain

Every capture — URL, HTTP status, content hash, signals found and missing — is sealed as a tamper-evident, Ed25519-signed record in the ICOSA Audit Chain.

5
Council escalation

Any missing signal escalates to the BFT multi-model council for a Sentinel-tier compliance verdict. Nothing is silently suppressed.

Run a Live Civilian Scan

This is the real service, not a mockup — restricted to safe reference domains here. In deployment, targets are submitted directly through the API or institutional dashboard.

Authority Mode

When wielded by a notifying body, market surveillance authority, or governing body under EU AI Act Art. 63–65, InSight Inspector operates with the full investigative power of the law. This is not the civilian version — it carries the authority to enforce, investigate, and discover all violations of the EU AI Act.

Full EU AI Act Article Coverage

Screens against 20+ article-level compliance signals — Art. 6 (risk classification), Art. 9 (risk management), Art. 10 (data governance), Art. 11 (technical documentation), Art. 12 (logging), Art. 13 (transparency), Art. 14 (human oversight), Art. 15 (accuracy/robustness), Art. 16–17 (provider obligations/QMS), Art. 26–27 (deployer obligations/FRIA), Art. 49–50 (registration/synthetic content), Art. 51 (AI literacy), Art. 53/55 (GPAI obligations), Art. 61–62 (post-market monitoring/incident reporting).

Deep Crawl with Link Following

Authority mode bypasses robots.txt (legal authority under Art. 63–65 supersedes polite convention). Probes 35+ standard compliance paths plus follows discovered links — up to 200 pages per investigation.

Security Probe Kit

Dispatches to industry-standard security tools: nmap (port/service scanning), Nuclei (vulnerability detection), nikto (web server analysis), sslyze/testssl/sslscan (TLS analysis), whatweb (technology fingerprinting), wafw00f (WAF detection), gobuster/dirb/feroxbuster (path discovery), dnsrecon/subfinder/amass (DNS reconnaissance), and more.

API Integrations

Connects to Shodan (internet-wide host scanning), VirusTotal (malware/phishing analysis), SecurityTrails (DNS history), Censys (certificate/host search), Mozilla Observatory (security header scoring), and Qualys SSL Labs (TLS grading).

Built-In Java Probes

HTTP security header analysis, CORS policy testing, cookie security audit — no external tool required. Always available on any deployment.

Legally-Defensible Evidence Chains

Every crawl capture and security probe result is hash-chained into the ICOSA Audit Chain with Ed25519 signatures, timestamps, and full chain of custody. Investigation metadata (case reference, investigator ID, authority name) is sealed alongside the evidence.

Security Probe Kit — Full Tool Inventory

30+ industry-standard security assessment tools, dispatched in parallel with strict timeouts. Tool availability is detected at runtime — a missing tool degrades gracefully rather than failing the investigation.

TLS/SSL Analysis

sslyzetestssl.shsslscanopensslQualys SSL Labs API

Port Scanning & Service Detection

nmap (service detection + vuln scripts)masscan (full port range)

Vulnerability Scanning

Nucleiniktowapitiskipfish

Technology Fingerprinting

whatwebwappalyzerwebanalyze

CMS Scanners

wpscanjoomscandroopescan

Path & Directory Discovery

gobusterdirbferoxbusterdirsearch

DNS Reconnaissance

digdnsrecondnsenumfiercesubfinderamass

OSINT & Information Gathering

theHarvesterwhoisShodan APIVirusTotal APISecurityTrails APICensys API

Web Security Analysis

wafw00f (WAF detection)arjun (API parameter discovery)Mozilla Observatory

Built-In Probes (no external tool)

HTTP security header auditCORS policy analysisCookie security audit

API Endpoints

POST/api/v1/insight-inspector/crawl

Civilian evidence capture. Public. Respects robots.txt.

POST/api/v1/insight-inspector/investigate

Full authority investigation. Deep crawl + security probes + council escalation. Requires X-Authority-Token.

POST/api/v1/insight-inspector/probe

Targeted security probe — run specific tools against a target. Authority-only.

GET/api/v1/insight-inspector/tools

Check installed security tools and API integration status. Authority-only.

Built for the regulator's side of the table

InSight Inspector is the only investigative platform purpose-built for EU AI Act enforcement. While compliance platforms help deployers document their governance, this tool gives notifying bodies the power to verify it — with real security probes, full article coverage, and a tamper-evident evidence chain behind every finding.

Request a Notifying-Body Briefing

More on AI governance and enforcement