Common Good Intelligence

Attest

A jurisdiction-agnostic rules engine for AI compliance. It classifies an AI system by risk, derives the obligations that attach to it, flags the gaps against your declared controls, and records every assessment in a tamper-evident audit trail.

The compliance workspace

Register systems, assign every duty, attach source evidence, route reviews, and export a signed audit pack.

Open Attest workspace →

Regimes are data, not code

Most compliance tools hard-code one law and break when it changes. Attest treats a regime as a ruleset file — a new jurisdiction is new data, never a new release, and every rule carries the date it commences.

EU AI Act

Art. 5 prohibitions (in force), Art. 50 transparency (in force 2 Aug 2026), Annex III high-risk (deferred to 2 Dec 2027).

Colorado

SB 26-189 — commences 1 Jan 2027. The signed act is encoded as a counsel-review draft; assessments stay disabled until approval.

A law's commencement date is part of the law

“The EU AI Act is in force” is true and nearly useless. Most regimes commence in stages over years, and a tool that flattens that into one list will tell you you're non-compliant with something that hasn't started — or, worse, keep asserting duties after they're repealed. Attest dates every rule and splits the answer.

Obligationsin force today — these are real gaps
Not yet in forcematched, dated, scheduled — work to plan, not a finding
Supersededreadable for audit history, but refused for new assessments

Colorado is the worked example. SB 24-205 was substantially replaced by SB 26-189 before it ever commenced. Attest will not assess against the repealed text, and it will not assess against the replacement until the signed-act encoding is reviewed by counsel. /jurisdictions keeps both visible with assessable: false; /assess refuses them with a typed 409 instead of returning an empty result that could read like a clean bill of health.

Risk tiers

unacceptableprohibited — do not deploy
highfull obligations before and during deployment
limitedtransparency duties
minimalnothing triggered

Try the engine

/evaluate is open and stateless — it classifies a system and returns the impact statement without storing anything.

$ curl -s https://attest.forthecommongood.ai/evaluate \
  -H 'content-type: application/json' -d '{
    "jurisdiction": "eu_ai_act",
    "system": {
      "name": "Applicant Screening Model",
      "attributes": { "domain": "employment", "deployed_in_eu": true },
      "declared_controls": ["human_oversight"]
    }
  }'

Returns the risk tier, the rules that triggered it, every obligation, the open gaps, what is merely scheduled, and a filed-ready Algorithmic Impact Statement.

Endpoints

GET /jurisdictionsregimes + status + dates
GET /rulesets/{id}the regime, as data
POST /evaluateclassify, stateless
POST /systemsregister a system · key
POST /assessassess + record · key
POST /reportgenerate + record · key
GET /audit/verifyprove the chain is intact · key

Why the audit trail matters

Every entry is hash-chained to the one before it. Quietly editing a past assessment breaks the chain from that point on, and /audit/verify reports exactly where. Regulators don't just want your current answer — they want evidence the history wasn't rewritten.