What physical AI must record

The problem

Retention is already an obligation — the EU AI Act puts a six-month floor under it. But nothing says what the record must contain. So after an incident, an assessor gets two accounts and one party produced both: the operator's story, and the machine's log. A log arrives on the authority of the system under investigation.

The answer, in four moves

1. Declare. Before acting, the policy signs its intent: what it will do, and the region its body will stay inside.
2. Adjudicate. An enforcement layer computes its own bound from the robot's kinematics and checks every action against both the declaration and that bound. Promise and verdict are separate records, signed by different parties — when they disagree, the artifact says which was wrong.
3. Chain. Each record is keyed and links to its predecessor. The keys ratchet forward every epoch and each predecessor is erased, so a key compromised today cannot re-sign yesterday.
4. Anchor. At close, each epoch head gets an RFC 3161 timestamp and is published to Rekor's transparency log. Re-issuing the whole history offline is the one attack a chain alone cannot see — the anchors close it.

What it still doesn't do

The prototype

A planar arm with scripted trajectories standing in for a learned policy — the tractable half of the problem.

The keys

Both live in one process in the prototype, so the verifier is also a forger. A real deployment puts the enforcement key in hardware the policy vendor cannot reach.

Tightness

Declarations are only worth what their tightness is worth, and nothing here prices tightness. Declare the whole reachable set every half-second and you never lie, never overclaim, and are never refused.

Layer B

The certifiable half of the record is proprioception, kinematics, declarations, verdicts, the chain. Anything that depends on perception — where the person was, how close the machine came — lands on the uncertifiable side.