eucompliance-ai-act

EU AI Act Article 50 disclosure for deployers — one line, and your content never leaves your system.

Article 50 of the EU AI Act has applied since 2 August 2026. If you build someone else's model into your product, you are the deployer and the disclosure obligation is yours — not the model provider's. Exposure is up to EUR 15 million or 3 % of worldwide annual turnover (Art. 99(4)(g)).

npm install eucompliance-ai-act

import { wrap } from "eucompliance-ai-act";
import OpenAI from "openai";

const client = wrap(new OpenAI(), { deployer: "Muster GmbH" });

const response = await client.chat.completions.create({ model: "gpt-5", messages: [...] });
console.log(response.disclosure.text);     // the text you must show your users
console.log(response.disclosure.record);   // the signed provenance record, for your files

Nothing else changes: same calls, same return values, same errors. Works with the OpenAI and Anthropic SDKs, and with anything exposing a comparable create method.

Already using the Vercel AI SDK?

import { wrapLanguageModel } from "ai";
import { euComplianceMiddleware } from "eucompliance-ai-act/middleware";

const model = wrapLanguageModel({
  model: openai("gpt-5"),
  middleware: euComplianceMiddleware({ deployer: "Muster GmbH" }),
});

Works with generateText and streamText. By default it never makes your model call wait — the disclosure is produced alongside it. Pass await: true to get the record back in providerMetadata.eucompliance within the same call, or onDisclosure to write it straight into your own log.

No dependency on ai is added: the middleware is structural, so it fits every SDK version that knows wrapGenerate / wrapStream.

Your content never leaves your system

This is the point of the design, not a footnote.

The library computes the SHA-256 of the output locally, via crypto.subtle, and transmits only that hash. We attest a hash we cannot reverse. Verification works by recomputing, so nothing is lost — and there is no data-protection question to answer, no latency added on the content path, and no liability for us over data we never saw.

{"provenance": {"content_sha256": "e3b0c442…", "hashed_by": "client"}}

What you get back

• The disclosure text in German or English, in the wording required for your case — generated content, edited content, deepfake, or interactive system.
• A signed provenance record: content hash, model, provider, deployer, timestamp — signed with EIP-191 and verifiable by anyone, free and without an account.
• The obligations that actually apply to you, with their article references — and if you are neither established in the EU nor serving EU users, it says so instead of selling you something.

Failure does not break you

Two deliberate properties, because a compliance tool that takes down production is removed after the first incident:

• If our service is unreachable, you still get a valid disclosure text, flagged offline: true. The legal obligation applies regardless of our uptime.
• If anything in this library fails, your model call still returns normally. The disclosure is attached on a best-effort basis and never throws into your code path.

Verifying later

import { verify } from "eucompliance-ai-act";
const result = await verify(response.disclosure.record, { content: theText });
// { valid: true, content_matches: true, … }

Free, no account. If the content was altered after signing, content_matches is false and the verdict carries receipt_tampered.

What this does and does not prove

Proves: that this exact content was attested as AI-generated by this deployer at this time, and is unchanged since.

Does not prove: that content without a record is human. Reliable detection of AI-written text does not exist — anything sold as such is a coin flip with a price tag. We attest origin. We do not guess it.

Also worth saying: a detachable record can be removed. It protects against alteration, not against omission.

This is a technical attestation, not legal advice. Classifying your own system remains your responsibility.

Pricing

The free tier needs no account: five calls per day per address. Beyond that, POST /x402/ai-disclosure costs $0.01 per call, payable per request in USDC — no account, no subscription. Verification is always free.

process.env.EUCOMPLIANCE_API_KEY = "…";   // optional

Also available

• Python: eucompliance-ai-act — same API, same guarantees.
• The full catalogue (VAT, IBAN, sanctions screening, and more): eucompliance-tools.

Links

• Service and documentation: https://eucompliance.tools
• Machine-readable catalogue: https://api.eucompliance.tools/.well-known/x402
• MCP server: https://mcp.eucompliance.tools/mcp

MIT licensed. Operated by Patrick Kaufmann, sole proprietor in Vienna, Austria.