# Fundamental-rights impact assessment evidence

> Signed documentation inputs and their verification limits.

A fundamental-rights impact assessment requires the accountable operator's analysis. Attestix does not generate an authoritative legal assessment or a conformity decision.

## Current source capabilities

- Record agent identity, declared purpose and capabilities.
- Issue and verify credentials within the Attestix canonical-JSON and Ed25519 profile.
- Record provenance and operator-supplied assessment details.
- Verify audit-chain integrity and export records for a reviewer.

A signature verifies key control and content integrity within the supported profile. It does not verify organizational policies, assessor identity, operating effectiveness, physical safeguards, retention, applicability or the truth of an assertion. The local key holder can rewrite and re-sign records; independent trusted checkpoints are a separate requirement.

## Operator responsibilities

Select the relevant framework and scope with accountable owners. Establish issuer trust, permission and replay policy, preserve source evidence, validate controls in the deployed environment, and use qualified independent reviewers where required. Do not treat a record tag, workflow-completion flag, generated declaration or passing unit test as a control-coverage score or certification.

These pages describe existing evidence functions. They do not promise future framework-specific CLI commands, automatic assessment templates or per-control coverage that is not implemented in the current release.

[Framework reference](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)