llamaIndex - 💡(How to fix) Fix Feature: Document provenance tracking for regulatory compliance (EU AI Act) [1 comments, 1 participants]

Context

The EU AI Act (Regulation 2024/1689) places specific requirements on AI systems regarding transparency (Article 13) and human oversight (Article 14). For RAG-based applications — which LlamaIndex powers extensively — a key compliance question is: which documents influenced a given AI response, and can this be traced after the fact?

Current State

LlamaIndex provides source nodes in query responses, and the SourceNode objects include metadata. However, the current approach is optimized for runtime visibility, not for compliance audit trails. Specifically:

• Source attribution is available at query time but not systematically logged for post-hoc audit
• There's no standardized format for provenance records that a regulator could inspect
• Document lineage (when was it indexed, from what source, what transformations were applied) isn't captured in a structured compliance-ready format
• No built-in mechanism to prove that a specific response was influenced by specific documents at a specific time

Proposal

A provenance tracking module that:

1. Logs retrieval events in a structured format: query hash, retrieved document IDs, similarity scores, timestamps, model version used for embedding/generation
2. Tracks document lineage: ingestion timestamp, source URI, transformation pipeline applied (chunking strategy, embedding model)
3. Supports export to compliance-friendly formats (JSON-LD, or a simple structured JSON schema)
4. Integrates with existing callbacks: extends the current callback system to emit provenance events

Example provenance record:

{
  "query_id": "uuid-...",
  "timestamp": "2026-02-20T10:30:00Z",
  "query_hash": "sha256:abc...",
  "retrieved_sources": [
    {
      "doc_id": "doc-123",
      "chunk_id": "chunk-456",
      "similarity_score": 0.89,
      "ingested_at": "2026-01-15T08:00:00Z",
      "source_uri": "https://example.com/policy.pdf"
    }
  ],
  "generation_model": "gpt-4",
  "response_hash": "sha256:def..."
}

Why This Matters

Organizations using RAG in regulated sectors (legal, healthcare, finance, public administration) need to demonstrate:

• What data influenced AI decisions (Article 13 — transparency)
• That humans can understand and oversee the system (Article 14)
• That logs exist for post-deployment monitoring (Article 72)

This is especially critical because RAG systems blur the line between "the model" and "the data" — regulators will want to trace both.

References

• EU AI Act: Regulation 2024/1689
• Articles 12 (logging), 13 (transparency), 14 (human oversight), 72 (post-market monitoring)
• For automated compliance scanning of AI codebases: mcp-eu-ai-act

Happy to discuss further or help spec this out.