Automated document generation and cryptographic signing

GDPR Article 5(2)'s accountability principle requires a controller to be able to demonstrate compliance, not merely assert it. A generated document that cites the real system, the real risk classification, and the real date it was produced is evidence; a hand-written template with the details filled in from memory is not.

AI Act Article 11 requires technical documentation to be drawn up before market placement and kept up to date, containing the Annex IV information. Regenerating it from current data each time is what keeps 'up to date' true rather than aspirational.

A document that changes after it was issued -- deliberately or by accident -- is a real risk when auditors, regulators, or customers rely on it. A cryptographic signature over the exact content at the moment of signing means a later dispute has an independent answer, not just competing claims.

The Documents tab in Compliance & Docs lists every generatable document, organisation-wide and per-system, and shows how many have already been generated. Generating one produces a real preview from your actual data -- the system's classification, the frameworks you have enabled, the vendors on your register -- not filler text.

Downloading a document as a PDF is the same generation call, additionally signed if signing is enabled for your plan: the response carries a verification link that isn't shown anywhere else, so it's worth keeping alongside the PDF itself.

A signed document embeds a verification ID and shows a 'Document signed' banner with a Verify link. That link opens a public page -- reachable by anyone you send it to, with no login required -- confirming the content hash and signing-key fingerprint independently of the app that generated it.