A supervisor opens a file
BaFin, AFM, BfDI, the Autoriteit Persoonsgegevens, ACM or another national authority asks for evidence about one of your AI deployments, on a short clock. The clock starts before you finish reading the letter.
Incident response · for general counsel
When the letter arrives, the record is already written.
Defense is not a product line, it is a phone number. One incident decides the quarter, and what decides the incident is whether you can put a dated, reproducible record of the governed interaction in front of the person asking. We reconstruct that record from the evidence chain and hand it to your counsel in the form counsel expects.
Engagements are scoped in writing before any work begins. Audact Defense does not give legal advice. Your own counsel stays in charge of the case.
Built for
General counsel in regulated companies.
Banking, insurance, healthcare, legal services, telecom. Sectors where a single conversation can become a file, and where the difference between a bad week and a bad year is whether the evidence pack exists before it is asked for.
What triggers it
Four moments that turn a compliance question into an incident.
Each of the four arrives with a clock attached, and in each of the four the first question is the same: what exactly did the system say, and to whom.
A public incident
A journalist, a watchdog or a competitor publishes a claim about a conversation that ran on your platform. Counsel needs the record before the next news cycle, not after it.
A customer dispute escalates
A consumer states they were misled, mis-sold, or that the disclosure never came. Moving from complaint letter to litigation threat requires a call-level reconstruction that survives scrutiny.
A data question
Personal data surfaced where it should not have, or a sub-processor incident forces you to establish which conversations were affected and what was disclosed in each.
What you get
Three artefacts. None of them is a slide deck.
Everything below is produced by the people who built the platform, working directly with your counsel.
Reconstruction
The Merkle root is published at api.audact.ai/v1/metachain and is checked with the inclusion proof from the call's Article 50 report. What the reconstruction rests on: the receipt chain for governed interactions — the hashes of what went in and out, the decision, and the policy version recorded on the receipt. It is not a transcript and not a record of whether the promised outcome was met.
A report prepared for review
Written in the shape counsel expects: executive summary, finding, evidence appendix. Exportable for your external lawyer, your DPO, or the authority that asked. It states what the records establish and what they do not.
A briefing for your counsel
Audact engineering on the call with your external lawyer, walking through the mechanism until they can explain it themselves. Hours are set inside the agreed budget for the incident.
How to engage
Scoped per incident.
Each engagement is scoped per incident and costs nothing until something happens.
Per incident
Scope, jurisdictions and budget are fixed in writing before work begins.
Coverage
What the reconstruction rests on.
Defense reconstructs governed conversations that ran inside an active Audact policy pack. That is where the receipts are, and a receipt is what makes a reconstruction reproducible rather than narrated. For a call that ran outside that pack, or against a policy version that has since been retired, the work is investigative rather than reproducible. Merkle inclusion is checked against the published root with the inclusion proof from the call's Article 50 report; the roots are published at api.audact.ai/v1/metachain.
Which of the two you are in is established on day one and put in writing before the scope is locked. Audact Defense does not provide legal advice; your external counsel remains responsible for the case and for the filing.
Questions
Asked before the first engagement.
- What can a reviewer check for themselves?
- Three things per receipt, without a key and without an account: the hash of the input, the hash of the output, and the link to the previous receipt. A fourth, inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report; the roots are published at api.audact.ai/v1/metachain. The receipt also carries an authentication code under a key issued to your tenant.
- Do you appear in proceedings?
- No. We produce the reconstruction and the written report, and we brief your counsel until they can carry the technical argument themselves. The case stays with your lawyers.
- What does an engagement cost?
- It is scoped per incident, in writing, before the meter starts.
- How fast can you start?
- Scope, jurisdictions and budget are fixed in writing before work begins.
Write once.
Tell us what arrived and when it has to be answered. We reply with a scope, a timeline and a budget — before anyone starts working.
Engagements are scoped in writing before any work begins. Audact Defense does not give legal advice. Your own counsel stays in charge of the case.