Common Good Industries

Attest

A jurisdiction-agnostic rules engine for AI compliance. It classifies an AI system by risk, derives the obligations that attach to it, flags the gaps against your declared controls, and records every assessment in a tamper-evident audit trail.

Regimes are data, not code

Most compliance tools hard-code one law and break when it changes. Attest treats a regime as a ruleset file — a new jurisdiction is new data, never a new release. Two very different regimes ship today:

EU AI Act

Art. 5 prohibited practices, Annex III high-risk, Art. 50 transparency

Colorado AI Act

SB 24-205 consequential decisions and deployer duties

Risk tiers

unacceptableprohibited — do not deploy

highfull obligations before and during deployment

limitedtransparency duties

minimalnothing triggered

Try the engine

/evaluate is open and stateless — it classifies a system and returns the impact statement without storing anything.

curl -s https://attest.forthecommongood.ai/evaluate \
  -H 'content-type: application/json' -d '{
    "jurisdiction": "eu_ai_act",
    "system": {
      "name": "Applicant Screening Model",
      "attributes": { "domain": "employment", "deployed_in_eu": true },
      "declared_controls": ["human_oversight"]
    }
  }'

Returns the risk tier, the rules that triggered it, every obligation, the open gaps, and a filed-ready Algorithmic Impact Statement.

Endpoints

GET /jurisdictionsavailable regimes

GET /rulesets/{id}the regime, as data

POST /evaluateclassify, stateless

POST /systemsregister a system · key

POST /assessassess + record · key

GET /audit/verifyprove the chain is intact

Why the audit trail matters

Every entry is hash-chained to the one before it. Quietly editing a past assessment breaks the chain from that point on, and /audit/verify reports exactly where. Regulators don't just want your current answer — they want evidence the history wasn't rewritten.