2 · Verify it.

You can't independently verify it, or prove it afterwards.

NeuralRing checks each layer against registries, probes and captured documents — not vendor pages — and creates a verifiable attestation for every inference request.

  • Continuous assessment of every provider, infrastructure and model against company registries, location probes, live certification registries and captured binding documents.
  • A per-request attestation: a signed, hash-chained, content-free record of what each inference depended on.
  • An evidence ledger whose chain heads are witnessed by independent European time-stamping authorities.
  • An assurance level on every fact — self-attested, verified, certified — never rounded up.
Sample — a fictional organisation with illustrative values. Nothing here is a real record.
The AI Supply-Chain Certificate · crt_SAMPLE0000…

Example Ltd

Issued 2026-09-14 09:05 UTC·ed25519:SAMPLE·valid until 2026-09-21
Coverage
86.2 % · attested 6,388 of metered 7,410 · 1 declared · unobserved
policy
jurisdiction EU/EEA · min_tier 1 · min_assurance verified · exclude parent US · max_retention 30 d · custody customer/eu_operator · transfer none_needed_eu · no training use
Lines
7 · 4 pass · 1 fail · 1 n/e
SEAL
—
Gaps
DORA 2 · GDPR-transfers 1 · AI Act 0 · ISO 42001 2
Verify it without NeuralRing
neuralring.eu/certificate/crt_SAMPLE00000000000000000000
Facts, not a compliance determination. What NeuralRing verified, at what assurance, against the policy you stated, over the coverage shown. records in the coverage period are bracketed by external anchors #211 → #212; 46 records after head 48991 have no upper bound yet.
Issues over a FRESH manifest evaluation now. Validity = the claim-watch interval; a re-evaluation is a new certificate, never an extension.

A certificate is revoked automatically when the claim-watch cascade moves any layer of a line it covers; the next issue carries the diff.

The steps inside
2.1 Set your policy · 10 min
You
State once where your AI may run, who may own the provider, how long data may be kept and whether training use is excluded.
NeuralRing
Applies it with the same filter that routes your requests; keys may only tighten it, never loosen it.
You get
One policy, applied to every line and every request.

The policy is a short form: jurisdictions, the minimum tier, the minimum assurance, excluded parent jurisdictions, the maximum retention, the accepted key custody and transfer mechanisms, and whether training use is excluded. Anything unknown fails closed. The same rules that decide which endpoint may serve a request decide whether a manifest line passes — there is never a second, softer check for the certificate.

2.2 Keep the ledger · continuous
You
Keep routing or witnessing; export your records whenever you want.
NeuralRing
Chains every record, signs it, and has independent EU witnesses time-stamp the chain heads.
You get
Continuity, coverage over time and external anchors — a history not even we can rewrite.

Every request produces a content-free record: which endpoint served it, under which policy, with what result — never the prompt. Records are hash-chained and signed; several times a day the chain head is time-stamped by independent European authorities and published to a public log, so a record's existence is bounded in time by parties that are not us. The ledger shows your coverage over time, the retention floor, the signed continuity statement and the anchor history. The full export is yours at any time.

In detail