Your pipeline names what changed
Validate one versioned AI-system manifest locally, then submit it with a source-bound credential when your deployment is ready.
Change-aware AI compliance
When an AI system changes, move the evidence with it.
Connect a customer-controlled manifest from your local workflow or CI pipeline alongside the tenant-scoped inventory API. Trusq spots meaningful differences, preserves the before-and-after record and turns it into an exact proposal, ready for one accountable review. Signed webhooks bring verified EU regulatory impacts into the same workflow.
Deployment evidence
Turn every declared system change into a review-ready record.
You choose the manifest and you keep the decision. Trusq reads what your client submits and shows the exact difference, plus the reviews acceptance would open.
Your sideYour client submits one manifestThe file you point it at, from your own laptop or your CI job. Nothing else is read.
The gateA workspace administrator decidesTrusq records the manifest as a proposal and shows the exact differences below.
AcceptReject
Trusq registerUnchanged until you acceptOn acceptance, only controls that depend on a changed fact move to Needs recheck.
| Declared fact | Current | Proposed | Difference |
|---|---|---|---|
| Provider | Example provider | Example provider | unchanged |
| Model | Example model | Example model | unchanged |
| Model version | 2026-08 | 2026-09 | changed |
| Intended purpose | Rank applicants for a human recruiter. | Rank applicants for a human recruiter. | unchanged |
| Lifecycle status | active | active | unchanged |
If you accept: only controls that depend on the changed fact move to Needs recheck. The excerpt below shows three affected controls; the workspace calculates and displays the complete set. Nothing else changes, and the earlier approvals stay on file.
- TRQ-DOC-01 Technical documentation
- TRQ-RSK-01 Risk management system
- TRQ-LOG-01 Automatic logging and record retention
See the exact difference
Trusq shows every affected system, action and current-to-proposed field value before the register moves.
Apply once, carry the evidence forward
A tenant admin confirms the proposal. Trusq updates the existing register, preserves the change trail and starts the appropriate reassessment workflow.
One end-to-end regulatory event
Official source → affected system → machine action.
Trusq verifies the change
Only published records with their official source enter the customer feed.
The obligation graph finds impact
The event names the registered system, framework, articles and structured match basis.
Your workflow receives it once
Use a cursor-based API or an HMAC-signed webhook with a stable event id for idempotency.
The dossier stays reconstructable
Retrieve the systems, obligations, approved evidence, automatic rule updates and audit trail as JSON.
Machine contract
Small surface. Explicit controls.
Tenant-bound credentials
Workspace admins issue revocable, expiring credentials with separate changes:read, dossier:read, systems:read and systems:write scopes. A source-bound systems:observe scope powers review-first CI submissions. Reusable token values are never stored.
Signed, retryable delivery
Every POST carries event, delivery and idempotency identifiers plus a SHA-256 HMAC over the raw body. Failures back off and move to dead letter after eight attempts.
Protected delivery destinations
Webhook delivery is restricted to validated public HTTPS endpoints, keeping credentials and private networks outside the outbound delivery path.
Endpoints
Everything needed to automate the regulatory-change loop.
GET https://app.trusq.io/api/v1/changes
Cursor-paginated, system-specific regulatory impacts with official source URL, articles, action and match basis.
GET https://app.trusq.io/api/v1/dossier
Machine-readable systems, obligations, approved evidence, automatic rule updates and audit trail.
GET https://app.trusq.io/api/v1/dossier/package
Tamper-evident package with payload/content hashes and checkpoint continuity. Verify with the current public key at /.well-known/trusq-audit-key.pem; its verification metadata is also available in the machine-readable contract.
GET https://app.trusq.io/api/v1/releases
Signed central corpus releases with validation, aggregate impact preview and reconciliation result.
POST https://app.trusq.io/api/v1/systems/import
Dry-run and atomically create, update, restore or retire up to 500 AI systems using stable external IDs and an isolated source_id. In reconcile mode, a missing system is retired only inside that source namespace; its assessments and audit evidence remain. Provider, model, version and intended-purpose differences create a tenant-scoped human-review trigger. Dry-runs and unchanged rows create none. The same contract is available as CSV inside the workspace.
POST https://app.trusq.io/api/v1/system-observations
Submit up to 25 explicitly declared systems from the dependency-free local/CI client. Trusq stores an idempotent proposal, shows the exact before-and-after values and applies it only after tenant-admin confirmation.
GET https://app.trusq.io/api/v1/systems
Cursor-paginated active or retired inventory so connectors can prove convergence instead of blindly pushing rows.
GET https://app.trusq.io/api/v1/openapi.json
Machine-readable OpenAPI 3.1 contract for connector and CI/CD generation.
regulatory.impact.created
A verified published change affects a registered system.
obligation.reconciled
A new rule-corpus version has been applied automatically without rewriting historical assessments or approved evidence.
corpus.released
A source-bound, content-signed central corpus passed validation and was promoted across tenants.
dossier.notarized
A daily signed dossier checkpoint was created without storing a second copy of customer content.
Choose the delivery mode that fits. Team brings the living dossier and workspace export to teams working in Trusq. Business adds inventory API, scoped credentials and signed webhooks, plus the system-observation connector. The 14-day Professional evaluation lets you test the machine-connected workflow before choosing a plan.
Your authorised team reviews and approves each decision before it enters the dossier.