Fermat's Last Theorem Verified in Lean 4: What Changes in Governance

The fact: a historic proof translated into formal language

On September 4, 2026, the research laboratory Anthropic made public the complete translation of Fermat's Last Theorem into the formal language Lean 4, machine-verified in eleven days of computational work, as reported by the laboratory itself in a dedicated technical document^[1].

The resulting code comprises 13 million lines, distributed across a public repository accessible on GitHub^[2].

The formalization declares three starting axioms. An independent comparator and a second verification kernel, built with logic distinct from the first, confirm the coherence of the entire deductive chain.

The mathematical proof of the theorem remains that published by Andrew Wiles and Richard Taylor in 1995: the 2026 work formalizes and verifies that proof, remaining distinct from an alternative version generated by an artificial system.

The value of the release rarely resides in the mathematical result, long since established, but rather in its end-to-end traceability: every deductive step remains inspectable by the verification kernel, a level of detail rarely available in business decision-making processes based on agents.

The 1976 precedent: four colors, a long lesson

In 1976 Kenneth Appel and Wolfgang Haken published the first proof of the four color theorem obtained with the aid of a computer, as documented on Wikipedia^[3].

That proof analyzed an enormous number of reducible configurations, an operation impractical for complete manual verification. The mathematical community debated at length what counted as acceptable verification, precisely because an isolated human was incapable of retracing the entire calculation by hand.

In 1997 Robertson, Sanders, Seymour, and Thomas reduced the number of configurations to 633, remaining nonetheless within an extremely extensive case analysis. In 2005 Georges Gonthier verified the entire theorem with general-purpose automated proof software, closing a chapter open for nearly thirty years.

The 1976 episode shows how acceptance of a computational proof requires institutional time, independent of its technical correctness.

The parallel with the Fermat case is direct: both proofs shift the center of gravity of trust from line-by-line human reading to structured computational verification.

Some mathematical observers have previously argued that a proof verified by machine nonetheless lacks the explanatory value of a demonstration readable by a human being. The 2026 Lean 4 formalization reopens the same tension, applied to a theorem of even greater cultural scope than the four colors.

Plausible output and verified output: where accountability shifts

A generative system produces text, code, or proofs with a degree of plausibility estimated statistically. A formal verifier, like the Lean 4 kernel employed in this case, applies deterministic logical rules and returns a binary judgment: the deductive chain holds or it fails.

This distinction matters because it changes the accountable subject. When output is plausible, responsibility rests with those who produce it and those who release it absent independent control.

When output is verified by a second independent system, with declared axioms and preserved logs, responsibility shifts partially to those certifying the verifier and those preserving its configuration. It is the verifier, in this scheme, that becomes the central artifact of governance, more than the content of the proof itself.

A recurring objection holds that the verifier itself requires blind trust, merely shifting the problem one level. The operational answer consists in making the verifier code public and pairing it with a second independent kernel, as occurred in this case, to reduce dependence on a single system.

For an organization releasing output generated by agents, the question becomes operational: which internal role certifies the verifier, in writing, before release?

What Regulation (EU) 2024/1689 requires

Regulation (EU) 2024/1689, known as the AI Act, sets three obligations relevant to this scenario, viewable in full text on EUR-Lex^[4].

Article 50 imposes transparency on content generated by artificial intelligence systems, with the obligation to signal clearly the artificial nature of the output, within EU jurisdiction.

Articles 11 and Annex IV require, for systems classified as high-risk, detailed technical documentation and complete traceability of the process that generated the output: model versions, parameters, execution logs.

Article 14 imposes effective human oversight of high-risk systems, with an identified subject capable of interrupting or correcting the process before the output produces effects.

For the General Counsel, the concrete legal exposure concerns proof that the human oversight provided for in Article 14 has been exercised in reality, with a named subject capable of blocking release before publication, beyond merely formal provision on paper.

A compliance posture calibrated to generic textual output proves today scarcely adequate when facing machine-verifiable output: the object of oversight changes, the artifact to preserve changes.

Decision matrix for General Counsel and Board

Three categories of decision emerge for those governing the adoption of agentic systems capable of producing formally verifiable output.

• Which artifact to preserve: declared axioms, version of the formal language, complete log of the comparator and second kernel, with verifiable time marking.
• Who certifies the verifier: an internal technical role, in writing, with authority distinct from those producing the output, consistent with Article 14 of the Regulation.
• Who has authority to block release: the Board Audit & Risk Committee requires visibility over this decision chain before publication of any machine-verified result intended for external use.

For the Chief Risk Officer, the updated risk framework today distinguishes between plausible output and verified output, assigning distinct exposure profiles to each category.

The Board Audit & Risk Committee requires, for each machine-verified release intended for external use, documentary evidence of the certification chain, comprehensive of date, named responsible party, and outcome of the second verification kernel.

For the CEO, the strategic decision concerns speed of adoption: accelerating release of verifiable output offers measurable competitive advantage, provided the governance of the artifact is already operational.

The CEO also evaluates the opportunity to invest in a structured audit trail: the absence of this infrastructure generates a cost of retroactive reconstruction higher should a regulator require evidence after the fact.

Three decisions for the next quarter

1. Map which internal processes produce output candidate for formal verification, and define for each the risk level according to AI Act classification.
2. Name in writing the role responsible for certification of the verifier, before any deployment involving machine-verified output.
3. Build a standard audit trail, comprehensive of axioms, versions, logs of the comparator, preserved in a format accessible to the Board Audit & Risk Committee.

Audit remains required: the perimeter of the object to control changes, from produced text to the verification process that certifies it.

Regulatory horizon

Regulation (EU) 2024/1689 is in force within the European Union, with staggered implementation of distinct obligations through 2027. Article 50 on transparency of generated content applies according to the implementation timeline already published in the legal text.

Outside the European Union, no equivalent framework specific to machine-verified output in the agentic domain exists to date. The question that remains open concerns which role, named in writing before deployment, is accountable for the verified output within each organization adopting these systems.