eucompliance-ai-act 0.2.0

EU AI Act Article 50 disclosure for deployers - one line, content never leaves your system

eucompliance-ai-act

EU AI Act Article 50 disclosure for deployers — one line, and your content never leaves your system.

Article 50 of the EU AI Act has applied since 2 August 2026. If you build someone else's model into your product, you are the deployer and the disclosure obligation is yours — not the model provider's. Exposure is up to EUR 15 million or 3 % of worldwide annual turnover (Art. 99(4)(g)).

pip install eucompliance-ai-act

from eucompliance_ai_act import wrap
from openai import OpenAI

client = wrap(OpenAI(), deployer="Muster GmbH")

response = client.chat.completions.create(model="gpt-5", messages=[...])
print(response.disclosure)          # the text you must show your users
print(response.disclosure.record)   # the signed provenance record, for your files

Nothing else changes: same calls, same return values, same errors.

Already using LiteLLM or LangChain?

import litellm
from eucompliance_ai_act.integrations import litellm_logger

log = litellm_logger(deployer="Muster GmbH")
litellm.callbacks = [log]          # every model behind the proxy, one line

from eucompliance_ai_act.integrations import langchain_callback

log = langchain_callback(deployer="Muster GmbH")
chain.invoke(input, config={"callbacks": [log]})

Both run the disclosure on a background thread — your model call never waits for us — and swallow their own errors, so nothing here can take your application down. log.last is the most recent record, log.summary() the tally, and file="disclosures.jsonl" writes them straight to disk.

Neither LiteLLM nor LangChain becomes a dependency of this package; the classes are located at call time.

Your content never leaves your system

This is the point of the design, not a footnote.

The library computes the SHA-256 of the output locally and transmits only that hash. We attest a hash we cannot reverse. Verification works by recomputing, so nothing is lost — and there is no data-protection question to answer, no latency added on the content path, and no liability for us over data we never saw.

{"provenance": {"content_sha256": "e3b0c442…", "hashed_by": "client"}}

What you get back

• The disclosure text in German or English, in the wording required for your case — generated content, edited content, deepfake, or interactive system.
• A signed provenance record: content hash, model, provider, deployer, timestamp — signed with EIP-191 and verifiable by anyone, free and without an account.
• The obligations that actually apply to you, with their article references — and if you are neither established in the EU nor serving EU users, it says so instead of selling you something.

Failure does not break you

Two deliberate properties, because a compliance tool that takes down production is removed after the first incident:

• If our service is unreachable, you still get a valid disclosure text, flagged offline=True. The legal obligation applies regardless of our uptime.
• If anything in this library fails, your model call still returns normally. The disclosure is attached on a best-effort basis and never raises into your code path.

Verifying later

from eucompliance_ai_act import verify
result = verify(response.disclosure.record, content=the_text)
# {'valid': True, 'content_matches': True, ...}

Free, no account. If the content was altered after signing, content_matches is False and the verdict carries receipt_tampered.

What this does and does not prove

Proves: that this exact content was attested as AI-generated by this deployer at this time, and is unchanged since.

Does not prove: that content without a record is human. Reliable detection of AI-written text does not exist — anything sold as such is a coin flip with a price tag. We attest origin. We do not guess it.

Also worth saying: a detachable record can be removed. It protects against alteration, not against omission.

This is a technical attestation, not legal advice. Classifying your own system remains your responsibility.

Pricing

The free tier needs no account: five calls per day per address. Beyond that, POST /x402/ai-disclosure costs $0.01 per call, payable per request in USDC — no account, no subscription. Verification is always free.

import os
os.environ["EUCOMPLIANCE_API_KEY"] = "…"   # optional

Links

• Service and documentation: https://eucompliance.tools
• Machine-readable catalogue: https://api.eucompliance.tools/.well-known/x402
• MCP server: https://mcp.eucompliance.tools/mcp

MIT licensed. Operated by Patrick Kaufmann, sole proprietor in Vienna, Austria.