Recommended Free Tools
Build the engine as two separate things: a versioned rules engine that checks an instrument’s software and configuration against jurisdiction-specific obligations, and an append-only evidence record of every change and decision. Persistent agent memory can help the engine retrieve and reason over that history, but it should be a derived, rebuildable index on top of the evidence record. It should never become the record itself.
The first design decision is the engine’s legal role, because it changes every later choice. An advisory tool that helps engineers check obligations does not form part of the measurement, so its errors are errors of advice, though it still needs trustworthy records. Software that is part of a legally relevant measuring instrument falls inside that instrument’s conformity path, and any AI component inside it needs a defined boundary and change control. The rest of this article assumes you have made that choice explicitly.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Verified by Law: Legal Metrology Frameworks for Digital Commercial Systems | $9.99 | Buy on Amazon |
| 2 |
|
Springer Handbook of Metrology and Testing | $239.99 | Buy on Amazon |
| 3 |
|
Handbook of Mass Measurement | $83.59 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Fix the scope before designing anything
No single global legal-metrology ruleset exists. Requirements depend on the market, the instrument category and, for software, the role the software plays. Three choices define the engine’s scope:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Jurisdiction: the market where the instrument is placed on the market or used.
- Instrument category: for example, non-automatic weighing instruments, automatic weighing instruments, or other measuring instruments. Each can follow a different instrument standard.
- Software role: advisory (outside the measurement), associated (supports the instrument but sits outside its legally relevant part), or legally relevant (part of the instrument’s functional behaviour that determines measured results).
NIST’s guidance gives concrete examples of how these choices diverge. It states that US-market instruments need to comply with NTEP Publication 14 on Software. For the European Union, it distinguishes non-automatic weighing instruments from automatic weighing and other measuring instruments, and points to the applicable instrument standard plus WELMEC Guide 7.2 where applicable. These are examples, not an exhaustive global ruleset.
| Market or scope | Reference named in official guidance | Engine design consequence |
|---|---|---|
| United States | NTEP Publication 14 on Software, which NIST says US-market instruments need to comply with | Store the publication as a rule source and record the edition or version each evaluation applied. |
| European Union, non-automatic weighing instruments | The applicable instrument standard, with WELMEC Guide 7.2 where applicable | Model the instrument category as its own rule scope and confirm whether WELMEC Guide 7.2 applies to the instrument. |
| European Union, automatic weighing and other measuring instruments | A different applicable instrument standard, with WELMEC Guide 7.2 where applicable | Use a separate rule set. Do not assume rules for non-automatic weighing instruments carry over. |
| Other markets | Not covered in this article | Create a rule scope only after the governing source has been identified with the national metrology authority. |
Advisory tool or part of the instrument?
The two designs carry different obligations, and the boundary between them is where most engines go wrong.
Advisory engine
- Its outputs are recommendations to people. It does not alter indications, parameters or instrument software.
- It needs its own audit trail covering the rule versions it applied, the inputs it received and the advice it gave.
- Instrument-level obligations stay with the instrument’s own compliance file. The engine supports that file; it does not replace it.
Engine that is part of the instrument
- Any output that sets, adjusts or verifies a legally relevant parameter or software function falls inside the instrument’s conformity path.
- Expect verification, approval and, depending on the change, re-assessment to be required before the change takes effect in a regulated context.
- The common failure mode is an advisory engine that writes values back into the instrument. Once it does, it is part of the instrument, whatever its original label.
NIST’s FAQ on software-controlled instruments puts the measurement first. It states: “The measurement process has top priority, and where applicable, measures are taken against spoofing of the measurement indication, transmission delays, and unavailability of system components (e.g., full data storage or loss of communication).” Any engine that logs or reasons inside a measuring instrument must be designed so that it cannot degrade that priority.
Model rules as versioned data
Represent each obligation as a versioned rule scoped by jurisdiction, instrument category, software role and effective dates. Keep the source clause and the rationale with the rule. Every evaluation should record the rule version it applied, so a later reviewer can reconstruct the exact check that was run on a given date.
The following record shape is illustrative. The field names are a design choice, not a published OIML schema, and the obligation text would be copied from the governing clause:
{
"rule_id": "example-rule-0042",
"version": 3,
"obligation": "Obligation text copied from the source clause",
"jurisdiction": "US",
"instrument_category": "example-category",
"software_role": "legally_relevant",
"effective_from": "2026-01-01",
"effective_to": null,
"source": "NTEP Publication 14 on Software, edition recorded",
"rationale": "Why this check applies to this scope",
"approved_by": "compliance owner"
}Each evaluation then points to the rule version it used and to the evidence it examined:
{
"evaluation_id": "eval-2026-10-09-017",
"rule_id": "example-rule-0042",
"rule_version": 3,
"subject": "instrument serial and software build",
"input_evidence_ids": ["evt-88121", "evt-88140"],
"result": "pass | fail | review",
"evaluated_at": "2026-10-09T10:14:03Z"
}Record the events that prove what the instrument did
Junichi Okamoto of the National Metrology Institute of Japan (AIST) explains OIML D 31:2023 and audit trails in a 2026 OIML Bulletin article. The core definition is exact: “An audit trail is a log that records events occurring within a measuring instrument together with their timestamps, thereby providing evidence of interventions.”
Rank #2
Treat software releases, parameter adjustments, model snapshots, approvals, verifications, failed updates and manual interventions as first-class records. Every event should identify the actor or system, the time, the object and version affected, the reason and an evidence reference. The table adds what each event type needs beyond those common fields. OIML’s audit-trail discussion supports timestamped records and later examination; the exact schema is your design choice.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Event | Capture beyond the common fields | What a verifier can establish |
|---|---|---|
| Software release | Build identifier and a hash of the installed package | Which software was running during a given period |
| Legally relevant parameter adjustment | Previous and new value, and the authorisation reference | What changed, and whether a change was authorised |
| Model or configuration snapshot | Snapshot identifier, module version and a hash of the parameter set | The state of an adaptive module at a specific point in time |
| Approval | Approver identity, scope of approval and the rule version relied on | Who accepted a change and against which obligation |
| Verification | Method, reference test and result | That the instrument was checked after a change |
| Failed update | Point of failure, rollback state and error code | The instrument’s actual state after the failure, not the intended one |
| Manual intervention | Operator, stated reason, and state before and after | Who intervened, why, and what the effect was |
Design the logging so that it fails visibly. If the evidence store is full or unreachable, the engine should record a gap rather than continue silently, and the gap itself should become an event once storage recovers. Decide this behaviour in advance and document it, because it is the first thing a verifier will ask about.
Keep durable evidence separate from agent memory
The agent needs memory to be useful, but the evidence record needs to be stable. Keep them in separate stores with different rules:
- Evidence record: append-only, hash-linked, signed and reviewable by an independent party. Entries are never edited in place.
- Agent memory: summaries, embeddings and retrieval indexes built from the evidence. It can be rebuilt, pruned or re-indexed, and every change to it is itself recorded.
Each memory write should record the source event identifiers, the model or configuration version that produced it, the writer and a timestamp. Each retrieval used in an evaluation should record which memory items were used. With those links, a reviewer can see why the agent gave a particular answer, and can check that answer against the underlying events.
Choosing durable storage
OIML’s 2020 article on logging services identifies immutability, availability, persistence and scalability as desirable properties. It presents hardware write-once/read-many storage, a trustworthy third party and a distributed ledger as options. It does not rank them, so the table describes trade-offs rather than a verdict.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Option | Tamper resistance | Availability and persistence | Operational control | Privacy and deletion | Independent verification |
|---|---|---|---|---|---|
| Hardware write-once/read-many storage | Committed writes cannot be altered, subject to the media and device | Depends on device lifetime and replacement planning | Held by the instrument owner | Data stays on local hardware | Verifier must access the device or a verified export |
| Trustworthy third party | Depends on the third party’s controls | Depends on the third party’s service continuity | Shared with the third party | Data leaves your boundary | Verifier can query the third party, but its trustworthiness must be established |
| Distributed ledger | Altering history requires altering replicated copies | Depends on the number and independence of replicating parties | Shared governance | Immutability can conflict with deletion duties | Verifier needs access to a copy or node |
| Append-only store with hash chaining | Detects edits only if the chain head is protected | Depends on your infrastructure | Fully local | Data stays local | Limited unless the chain head is anchored externally |
Conditions for tamper evidence
Takeaki Kamada’s 2026 OIML Bulletin article proposes an auditable record linking recognition, weighing and time. Kamada states that hash chaining by itself does not prevent tampering. The article proposes four conditions for legally meaningful tamper evidence: digital signatures, managed keys, trusted time and external anchoring. This is a technical proposal, not binding law, but it is the most specific guidance available on what a hash-chained log needs in order to be credible to a verifier.
Rank #3
Can the AI model learn or update during use?
It can, but only if the adaptive part is isolated and recorded. An OIML Bulletin analysis of the EU AI Act and D 31:2023 (2025) distinguishes two kinds of change. The dynamic module is defined as: “This dynamic module is a software module whose functional behaviour depends on predefined device-specific parameters that may change over time during use.” The same analysis describes a snapshot as a way to preserve a static representation of such a module at a point in time, so that its state can be examined later.
Changes fall into different treatments:
| Change | Nature | Treatment |
|---|---|---|
| Device-specific parameter changes within a dynamic module | The module is designed to depend on parameters that may change during use | Log each change, snapshot the module state and apply the review scope set by the governing framework |
| Type-specific parameter changes | May alter the characteristics of the approved type | Treat as a potential substantial change. Check whether prior review is required under the applicable framework |
| Software structure changes | Change what the approved software does, such as new logic or new modules | Treat as a potential substantial change. Determine whether re-verification or approval is required |
Whether a change needs additional approval depends on the applicable legal framework and the facts of the change. Not every model update requires recertification. Record the decision and its rationale in the evidence record each time, including when the outcome is that no review is needed.
How long must high-risk AI logs be kept?
The retention rule you may have seen applies only in a narrow case. Under Regulation (EU) 2024/1689, the EU AI Act, the relevant provisions for high-risk AI systems are:
| Provision | Who it addresses | Rule as stated |
|---|---|---|
| Article 12 | High-risk AI systems | Must technically allow automatic recording of events (logs) over the system’s lifetime |
| Article 19 | Providers | Retain logs under their control for an appropriate period of at least six months, unless applicable Union or national law says otherwise |
| Article 26 | Deployers | Retain logs under their control for at least six months, subject to exceptions and other applicable law |
The text dated 2026 is the consolidated version. These rules apply only if your AI system is classified as high-risk under the Act. They do not set a retention period for every AI or metrology system. For a system outside that category, the period comes from the metrology rules that govern the instrument and from your contractual obligations. This article does not establish a general retention period for metrology records.
Build sequence
The following order keeps each control testable before the next one depends on it.
Quick Recap
- Write the scope statement. Name the jurisdiction, instrument category, software role and whether any AI component touches legally relevant behaviour. Expected result: a one-page boundary document approved by the product owner.
- Load rules as versioned records. Each rule carries its source clause, rationale and effective dates. Expected result: every evaluation cites a rule ID and version.
- Build the append-only evidence store. Implement the event schema from the table above. Expected result: a test event is appended, the hash chain verifies, and an attempted in-place edit is rejected.
- Add signatures, managed keys and trusted time. Do not describe the log as tamper-evident until these are in place. Expected result: a verifier validates signatures using keys obtained from a source independent of the engine.
- Route agent memory through the evidence store. Every memory write references source event IDs. Expected result: deleting the memory index and rebuilding it from the evidence reproduces the same index content.
- Isolate the adaptive module. Define the boundary between legally relevant and associated software, and set snapshot triggers for every parameter change. Expected result: each change produces a snapshot and a linked event.
- Test failure paths. Simulate full storage, loss of communication and a failed update. Expected result: a gap event or failed-update event appears after recovery, and measurement behaviour follows the priority NIST describes.
- Run a verification drill. Pick an evaluation record, retrieve the rule version it cites, verify the hash chain and signatures, and reproduce the evaluation from the snapshot. Expected result: the same outcome, with every reference resolving.
What this article cannot establish
- No universal checklist. The official guidance supports a design framework. Whether a particular deployment complies depends on jurisdiction, instrument category and whether the engine is advisory or part of the instrument. Those boundaries must be fixed before anyone states that the engine is compliant.
- Conformity routes vary. Assessment for a legally relevant instrument runs through the national metrology authority or the designated conformity body in the target market.
- No performance or adoption figures. The official material on this topic publishes no error-rate, adoption or market statistics, so this article makes no claims of that kind. The six-month retention figure is a legal threshold, not a measured statistic.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
