Regulatory Enforcement · Evidence Chain

ICOSA InSight Inspector

Autonomous evidence collection for regulators, auditors, and notifying bodies — built to catch what a deployer would rather not disclose, without ever needing access it isn't already given.

InSight Inspector only ever reads what a target has already published for anonymous, unauthenticated access, and only within what its own robots.txt permits. It never authenticates, never bypasses access controls, and never reaches beyond what a plain browser visit could already retrieve.

How It Works

1
Point it at a public-facing system

Submit the target’s own site — no credentials, no internal access, nothing an anonymous visitor couldn’t already reach.

2
robots.txt-bounded capture

Fetches are limited to whatever the target has already told every anonymous crawler is fine to read. Nothing disallowed is ever touched.

3
Disclosure-signal screening

Each captured page is screened for the specific disclosure language a compliant deployment should carry.

4
Hash-chained into the Audit Chain

Every capture — URL, HTTP status, content hash, signals found and missing — is sealed as a tamper-evident, Ed25519-signed record.

5
Escalate or clear

Any missing expected signal escalates the record for human or council review. Nothing is silently suppressed to reduce noise.

Disclosure Signals Screened Today

A starting set, not exhaustive regulatory coverage — InSight Inspector flags absence for a human or council reviewer to confirm; it never renders a compliance verdict on its own.

AI content disclosure

Language identifying AI-generated output as such — the core EU AI Act Art. 50 obligation.

Privacy policy

A published privacy notice covering the system’s data handling.

Model / system card

Published documentation of the system’s capabilities, limitations, and intended use.

Human oversight contact

A stated path to request human review — Art. 14 human oversight, made checkable.

Risk classification

A stated risk tier (high-risk, limited, minimal) under the deployer’s own framework.

Run a Live Capture

This is the real service, not a mockup — restricted to a couple of safe reference domains here so a public page can’t be used to point the crawler at arbitrary targets. In deployment, a customer submits their own case targets directly.

For regulators, auditors, and notifying bodies

Pair InSight Inspector's evidence capture with a Sentinel-tier scan and, for higher-risk cases, escalation to the Baseline council — a full investigative pipeline with a tamper-evident chain of custody behind every finding.

Request a Notifying-Body Briefing
AI Compliance AdvisorICOSA
Welcome! I'm your AI compliance advisor. I can help you determine if your AI system needs EU AI Act compliance and what level of certification you need. Are you here to check your compliance requirements?