Quickstart: Pick Your Role
Every buyer approaches TRAI from a different angle. Choose the path that matches your role, and follow the linked guide.
| You are... | Start here |
|---|---|
| CISO evaluating cryptographic compliance You need to know whether TRAI satisfies Article 50 transparency obligations and what infrastructure is required. | CISO overview → |
| Developer integrating the evidence pipeline You need SDKs, REST endpoints, build instructions, and a working notarization in under 10 minutes. | Developer guide → |
| Compliance officer mapping regulations You need to understand how TRAI maps to EU AI Act Art. 50, DORA Art. 19-20, and PLD 2024/2853 Art. 10. | Compliance mapper → |
| Acquisition buyer evaluating the asset You need to know what you receive, what you don't, the transfer process, and known limitations. | Acquisition brief → |
Honesty Rules
TRAI follows a strict honesty-first disclosure model. Every claim in these
docs is independently verifiable against cargo test, git log,
or a live endpoint. Here is the current state:
What is real today
- COSE_Sign1 signing with Ed25519 + ML-DSA-65 hybrid -- 1,375 Rust tests pass
- RFC 3161 timestamps via Actalis Italia eIDAS-qualified TSA (production) and FreeTSA (dev)
- SCITT receipt format (RFC 9943) with RFC 9162 Merkle inclusion proofs
- PDF certificate rendering with embedded QR code and 3-tier disclosure
- 4 SDKs (Python, Python-light, TypeScript, Go) + WASM browser verification bundle
- 37 MCP tools for Claude Code / Cursor / Codex integration
- Python FastAPI control plane with JWT multi-tenant enforcement
- DORA dynamic assessment with 7 compliance checks
- 1,375 Rust + 1,400 Python = 2,775 tests, all passing
What needs work
- ML-DSA-65 production signing requires external HSM/KMS (AWS KMS or Thales Luna)
- SCITT transparency log anchoring is a roadmap item (receipt format is implemented)
- C2PA image provenance integration is a stub
- Art. 50(3) watermarking for images/audio/video is deferred to v1.1.1+
- Multi-tenant DB-level isolation requires v1.2+
What is explicitly excluded
- GRC workflow platform -- TRAI is the evidence layer, not the workflow layer
- Real-time inference monitoring -- TRAI provides post-hoc evidence for audit trails
- AI training process certification -- TRAI certifies AI outputs, not training processes
- DPIA substitution -- use TRAI evidence to demonstrate DPIA compliance, not to substitute it
Dev defaults are not production. Ed25519-only + mock TSA + mock SCITT. Production requires external HSM/KMS + qualified TSP credentials. See Acquisition Brief for what is included and excluded.
TRAI provides technical evidence generation capabilities. It does not constitute legal advice, regulatory certification, or a substitute for independent compliance review. Buyers and users must validate regulatory applicability in their jurisdiction.