air-blackbox

AIR Blackbox is an open-source system for proving that AI agents comply with the EU AI Act. It describes itself as a flight recorder for autonomous AI agents and focuses on recordkeeping, replay, enforcement, and audit around AI-assisted decisions.

Its features center on audit evidence and control. AIR Blackbox creates tamper-evident records for AI calls, with HMAC-SHA256 records signed by default with Ed25519 and optionally with ML-DSA-65 post-quantum signatures. It captures the logic path behind AI-assisted decisions, scans a codebase on every commit to detect policy drift, and produces an auditor-ready gap report in ten seconds. The page also says it can detect when AI output needs human judgment, create cryptographic proof that a human reviewed, approved, and signed off on AI-assisted output, filter personal data and prompt injection attempts before they reach the model, and preserve the boundary between draft and final content. A separate Tombstone feature blocks destructive actions such as delete, drop, and overwrite before they run, then writes a tamper-evident receipt. It also supports crypto-shredded erasure by destroying the data key while keeping the log intact.

Delivery is shown as a gateway: the application points its base URL at localhost:8080 instead of the provider, the gateway authenticates the request, proxies it to the upstream provider, and writes a .air.json record in the background. The record includes the request, response, model, tokens, timestamp, and run ID, while API keys and auth headers are encrypted separately. The page mentions GitHub and PyPI, and shows a pip install air-blackbox command and an air-blackbox comply --scan . -v command line example.

AIR Blackbox is aimed at teams using AI agents that need compliance reports, audit trails, human oversight records, and policy drift checks. It is presented as open source.