Attestly turns AI agent traces into EU AI Act Annex IV documentation

A new tool called Attestly wants to make EU AI Act paperwork less painful by turning the traces that AI agents already generate into the technical documentation required under the regulation's Annex IV. According to a post on dev.to, the tool reads operational data from sources such as OpenTelemetry, LangSmith, AgentOps and MCP logs, and maps it into structured documentation and accompanying evidence trails.

The idea: your logs are the evidence

The core observation behind Attestly is that much of what Annex IV documentation asks for is already being recorded somewhere. Tool calls, human interventions, errors, model invocations and deployment changes — the raw events of an agent running in production — are exactly the kind of operational history a compliance dossier needs. Attestly's pitch is to stop treating documentation as a separate, manual writing exercise and instead derive it from telemetry that many teams are collecting anyway.

Provenance labels and mandatory review

Automatically generated compliance documents are only useful if you can tell what is in them and where it came from. Attestly handles this by marking every section as one of three states: AI-generated, user-provided, or missing. Export is gated behind human review and approval, so the output is a reviewed draft rather than a finished document nobody has read.

The missing label matters as much as the other two. It shows teams where their traces do not yet cover a requirement, which turns gaps in the documentation into a visible to-do list rather than a silent omission that surfaces during an audit.

Who it is for

The dev.to post positions Attestly at startups and small teams shipping AI agents into the EU market, and says a free tier is available. The announcement does not go into pricing beyond that, nor into which Annex IV sections the tool covers most completely.

Why it matters

Annex IV of the EU AI Act sets out the technical documentation expected for high-risk AI systems, covering areas such as the system description, risk management, data practices, logging and human oversight. As the Act's obligations phase in, assembling that dossier is one of the heavier compliance lifts, and for teams without a dedicated compliance function it can be a genuine bottleneck to shipping.

Attestly points at a broader shift in compliance tooling: treating observability data as a first-class input. If agent traces can serve as evidence, documentation stops being a purely retroactive chore and becomes partly a by-product of running the system — at least for the parts telemetry can actually speak to.

There are honest limits. Telemetry says a lot about what a system did, but far less about why design decisions were made, how risks were assessed, or how training data was governed, all of which Annex IV also touches. Those sections will presumably surface as user-provided or missing, which is exactly where the mandatory human review earns its keep. It is also worth noting that everything here comes from a single announcement post, so questions about coverage, accuracy and cost will only be answered as teams put the tool to work.

Even so, the pattern — generate the draft from real operational data, label the provenance of every section, and force a human to approve before export — is a sensible template for AI-assisted compliance tooling in general. For teams already running LangSmith or OpenTelemetry against their agents, the marginal cost of trying it looks low.