Metadata-Version: 2.4
Name: eucompliance-ai-act
Version: 0.3.1
Summary: EU AI Act Article 50 disclosure for LiteLLM, LangChain, Haystack, LlamaIndex and the Vercel AI SDK - one line, content never leaves your system
Project-URL: Homepage, https://eucompliance.tools
Project-URL: Documentation, https://eucompliance.tools/llms.txt
Author: Patrick Kaufmann
License-Expression: MIT
Keywords: ai-act,ai-transparency,anthropic,article-50,callback,chatbot-disclosure,compliance,deployer,disclosure,eu-ai-act,eu-ai-act-2026,haystack,langchain,litellm,llamaindex,llm,middleware,openai,provenance,transparency,vercel-ai-sdk
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Legal Industry
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Software Development :: Libraries
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# eucompliance-ai-act

**EU AI Act Article 50 disclosure for deployers — one line, and your content never leaves your system.**

Article 50 of the EU AI Act has applied since **2 August 2026**. If you build someone else's model into your product, *you* are the deployer and the disclosure obligation is yours — not the model provider's. Exposure is up to **EUR 15 million or 3 % of worldwide annual turnover** (Art. 99(4)(g)).

```bash
pip install eucompliance-ai-act
```

```python
from eucompliance_ai_act import wrap
from openai import OpenAI

client = wrap(OpenAI(), deployer="Muster GmbH")

response = client.chat.completions.create(model="gpt-5", messages=[...])
print(response.disclosure)          # the text you must show your users
print(response.disclosure.record)   # the signed provenance record, for your files
```

Nothing else changes: same calls, same return values, same errors.

## Already using LiteLLM or LangChain?

```python
import litellm
from eucompliance_ai_act.integrations import litellm_logger

log = litellm_logger(deployer="Muster GmbH")
litellm.callbacks = [log]          # every model behind the proxy, one line
```

```python
from eucompliance_ai_act.integrations import langchain_callback

log = langchain_callback(deployer="Muster GmbH")
chain.invoke(input, config={"callbacks": [log]})
```

Both run the disclosure **on a background thread** — your model call never waits
for us — and swallow their own errors, so nothing here can take your application
down. `log.last` is the most recent record, `log.summary()` the tally, and
`file="disclosures.jsonl"` writes them straight to disk.

## Haystack and LlamaIndex too

```python
# Haystack — a component you drop in after the generator
from eucompliance_ai_act.integrations import haystack_component

pipe.add_component("disclosure", haystack_component(deployer="Muster GmbH"))
pipe.connect("llm.replies", "disclosure.replies")
```

```python
# LlamaIndex — an event handler on every model call
import llama_index.core.instrumentation as instrument
from eucompliance_ai_act.integrations import llamaindex_handler

instrument.get_dispatcher().add_event_handler(
    llamaindex_handler(deployer="Muster GmbH"))
```

None of these frameworks — LiteLLM, LangChain, Haystack, LlamaIndex — becomes a
dependency of this package; the classes are located at call time, so installing
`eucompliance-ai-act` pulls in nothing you did not already have.

## Your content never leaves your system

This is the point of the design, not a footnote.

The library computes the SHA-256 of the output **locally** and transmits only that hash. We attest a hash we cannot reverse. Verification works by recomputing, so nothing is lost — and there is no data-protection question to answer, no latency added on the content path, and no liability for us over data we never saw.

```json
{"provenance": {"content_sha256": "e3b0c442…", "hashed_by": "client"}}
```

## What you get back

- **The disclosure text** in German or English, in the wording required for your case — generated content, edited content, deepfake, or interactive system.
- **A signed provenance record**: content hash, model, provider, deployer, timestamp — signed with EIP-191 and verifiable by anyone, free and without an account.
- **The obligations that actually apply to you**, with their article references — and if you are neither established in the EU nor serving EU users, it says so instead of selling you something.

## Failure does not break you

Two deliberate properties, because a compliance tool that takes down production is removed after the first incident:

- If our service is unreachable, you still get a valid disclosure text, flagged `offline=True`. The legal obligation applies regardless of our uptime.
- If anything in this library fails, your model call still returns normally. The disclosure is attached on a best-effort basis and never raises into your code path.

## Reconciling with payment records (x402 / CAAP-1)

If your agent pays for inference over x402 and books it under CAAP-1, the audit
binding in your ledger already retains a content hash per entry. Every record
this library produces carries the **same `content_sha256` at the top level** —
in `to_json()`, in the `file=` JSONL of every integration, and in the
`log_evidence()` helper:

```python
from eucompliance_ai_act import disclose, log_evidence

d = disclose(text, model="gpt-5", deployer="Muster GmbH", kind="interaktion")
log_evidence(d)   # appends one line to ai-disclosure-evidence.jsonl
```

One key, two books: an auditor can join a booked payment to its disclosure
record without either system knowing about the other — and without the content
itself being stored anywhere. We treat the record layout as a stable contract:
additive changes only.

## Verifying later

```python
from eucompliance_ai_act import verify
result = verify(response.disclosure.record, content=the_text)
# {'valid': True, 'content_matches': True, ...}
```

Free, no account. If the content was altered after signing, `content_matches` is `False` and the verdict carries `receipt_tampered`.

## What this does and does not prove

**Proves:** that this exact content was attested as AI-generated by this deployer at this time, and is unchanged since.

**Does not prove:** that content *without* a record is human. Reliable detection of AI-written text does not exist — anything sold as such is a coin flip with a price tag. We attest origin. We do not guess it.

**Also worth saying:** a detachable record can be removed. It protects against alteration, not against omission.

This is a technical attestation, not legal advice. Classifying your own system remains your responsibility.

## Pricing

The free tier needs no account: five calls per day per address. Beyond that, `POST /x402/ai-disclosure` costs $0.01 per call, payable per request in USDC — no account, no subscription. Verification is always free.

```python
import os
os.environ["EUCOMPLIANCE_API_KEY"] = "…"   # optional
```

## Links

- Service and documentation: <https://eucompliance.tools>
- Machine-readable catalogue: <https://api.eucompliance.tools/.well-known/x402>
- MCP server: <https://mcp.eucompliance.tools/mcp>

MIT licensed. Operated by Patrick Kaufmann, sole proprietor in Vienna, Austria.
