What the article argues
Two bodies of European law pull in opposite directions, and AI sitting inside a forfeiture or tax-audit file is where they collide. The AI Act wants transparency, human oversight and demonstrable accuracy from high-risk systems. The GDPR and the Trade Secrets Directive want the opposite: personal data kept out of sight, proprietary know-how undisclosed. An auditor asked to verify one obligation ends up breaching the other.
The article's answer is to stop auditing the model and start filtering its output. A layer sits between what the AI produces and the moment that output acquires legal effect, checking it against legal requirements expressed in formal terms. Where something required is missing, nothing gets generated. Where an official overrides the block, the supervisor learns that an override happened — and learns nothing about the case.
The demonstration is worked on Bulgarian forfeiture law: determining who falls inside the circle of investigated persons under the Act on the Forfeiture of Illegally Acquired Property, tested against a synthetic family profile built to trigger each of the nine qualification routes. No real case data is used anywhere in the paper.
„This article proposes the ZKAP (Zero-Knowledge Audit Protocol) Anti-Corruption Output Filter as a cryptographically verifiable compliance mechanism that resolves the conflict at the operational layer of AI-assisted judicial workflows.“
— from the published abstract. Read the full abstract and paper at the publisher.
What the filter does
The mechanism sits between the AI system's output and the moment its decision takes legal effect. It does not read the model's internal logic; it checks what the model produced against legal requirements written in formal terms. Where prerequisites are incomplete or conditions unmet, generation stops.
An operator may still override the block. But every override generates a cryptographically signed signal to the supervisor, and that signal carries exclusively procedural metadata — no case-file content, no identifying data of the persons concerned. The override cannot be recalled once fired.
That last property is the whole point. „I did not know“ and „I did not notice“ stop being available as excuses.
Why the output, and not the model
The familiar tools of explainable AI — LIME, SHAP and their descendants — give approximations rather than proofs. Each produces an explanation after the fact, and an explanation of that kind can be steered by a careful choice of samples or neighbourhoods. In an adjudicative setting that is not enough: if a decision is to carry evidential weight, its explanation has to be verifiable, not merely believable.
There is also a question of scale. Manual inspection of a model's internal logic is impractical already at billions of parameters; above roughly 1018 parameters the horizon of auditability is passed for good. There is a second constraint, and it cuts the other way. Inspectors, judges, prosecutors and appointed experts are shielded from pressure precisely because nobody upstream gets to look over their shoulder at a live file. A supervisor granted that view would become the vulnerability. What survives both constraints is narrow: check the output and the procedural trail, and leave the case data alone.
The X + Y decomposition
The filter rests on splitting any legal rule along two independent axes. The X-axis holds the mandatory positions — the substantive-law elements which must be established for the power to arise at all. The Y-axis holds the conditions: the procedural and temporal requirements that must be observed when the power is exercised.
For the reference rule of the demonstrator, nX = 12 and nY = 14. Those numbers are not arbitrary; they are generalised from the requirements of a typical administrative procedure carrying high corruption risk. The same principle applies with different values in other legal fields, and in real deployment it is the administration or the legislator who fixes them.
Each X-element and each Y-element can in turn be decomposed into a polynomial representation traceable to specific legal norms and documentary sources. The rule „the output is generated if and only if all Xi and all Yj are satisfied“ is then arithmetized as a conjunction of indicators over a finite field, and a zk-SNARK proves that a satisfying witness exists without disclosing it.
The ZONPI demonstration
One legal condition is worked through in full: the determination of the circle of investigated persons in forfeiture proceedings. The choice is deliberately didactic. It is one of the architecturally shallower components of the filter, which is exactly what makes it useful for showing the polynomialization principle without the reader drowning in the legal substance.
Nine qualification members cover the three statutory groups, and the synthetic test profile was built to exercise every one of them. The substantively deeper components — banking pattern analysis, real estate transformation, fiscal coherence, and the determination of significant asset disparity — are polynomialized in parallel but fall outside the scope of this article, and are treated in separate studies.
Four anti-corruption mechanisms
First, silent non-compliance becomes impossible. Without the filter an executor can produce a result even when the prerequisites are incomplete, and control stays retrospective; with it, generation simply stops unless an explicit override is performed, and that override is escalated at once.
Second, plausible deniability disappears, for the reason given above — the signal fires automatically and cannot be withdrawn.
Third, the data-protection objection falls away. Because the signal carries nothing but metadata, it honours the data-minimisation rule of GDPR Art. 5(1)(c) while leaving the supervisory duty intact. (Which is more than can be said for most disclosure-based audit designs currently on offer.)
Fourth, a result cannot be quietly reworked afterwards. Once the cryptographic commitment is in place, a decision already generated cannot be readjusted without leaving a trace.
Agentic systems and deployment paths
The architecture fits agentic systems especially well — those which set actions in motion on their own and produce decisions with legal effects for individuals, of the kind the Court of Justice addressed in SCHUFA (Case C-634/21). In such systems the internal logic is, for practical purposes, beyond control: the inference is too complex and too adaptive to follow. Filtering the output before the decision takes effect is then the one fail-safe which remains.
Three deployment variants are ready for piloting. The fastest is adoption as internal rules — a code of conduct of an individual administration — which permits operational experience to accumulate before anything is locked into law. A normative act for a specific procedure is slower but guarantees maximal legal certainty and uniformity at national level. The third is a pilot at the Commission for Personal Data Protection, which already has established experience as an independent supervisory authority and is the logical first bearer of a model for algorithmic accountability.
Limitations
The article does not answer all questions, and says so. The polynomials for the substantively more complex elements require separate development. The complexity of recursive SNARKs for very deep legal procedures remains a subject of future research. The final values of nX and nY for different procedures are subject to empirical calibration, and will probably shift as pilots produce data.
Authorship and rights
R. Y. Radoslavov is responsible for conceptualization, the architecture and methodology of the ZKAP protocol and of the anti-corruption output filter, the polynomial decomposition, the legal analysis and the writing of the text. He is the sole inventor and applicant under patent applications BG/P/2026/114317 and BG/P/2026/114328 and holds all rights in the ZKAP methodology, the filter architecture and the related patent claims. EPO, UKIPO and PCT/WIPO filings are in preparation, and the architecture is FRAND-ready for inclusion in harmonised European or international standards. IPC: G06F 21/64; G06N 20/00; H04L 9/32.
Eng. I. Y. Getsov contributed the engineering review of the demonstrator, the execution of the test validation, and technical editing. Co-authorship of the article relates exclusively to that contribution and confers no rights in the ZKAP methodology, the filter architecture or the patent applications.
Related publications
- Radoslavov, R. Y. (2026). Management and Regulation of AI Models in Public Administration: Cryptographic Transparency and Digitalization of Legal Norms. Artificial Intelligence Proceedings, XI Intl. Sci. Conf. „High Technologies. Business. Society“, Borovets, p. 75. DOI 10.5281/zenodo.19509511
- Radoslavov, R. Y. (2025). Management and Regulation of Artificial Intelligence Models: Concept for Transparency and Accountability in Administrative Activities. Industry 4.0, Vol. 2, pp. 320–321. DOI 10.5281/zenodo.19614243
- ZKAP — Zero-Knowledge Audit Protocol: reconciling AI Act transparency, GDPR privacy and trade secrets — methodology overview
- The systemic collapse of the Bulgarian anti-corruption commission — the institutional setting the filter is designed for
- ZKAP interactive demonstrator
What happens next
Three lines of work follow. The polynomials for the heavier elements of the filter — banking analysis, property transformation, fiscal comparability, significant disparity — go into standalone publications. A prototype replaces the hash-based simulation layer with real SNARK verification and Silicon Binding. And typified catalogues of X-positions and Y-conditions are being built for priority procedures with high corruption risk, in a form ready for adoption either as internal rules or as a normative act.
The AI Act's high-risk obligations now bite from 2 December 2027. An administration that wants to run AI inside a forfeiture, tax-audit or procurement procedure by then has roughly fifteen months to decide how it will prove compliance without handing over the case file. Enquiries about pilot deployment: radoslav@radoslavov.bg.