DEV Community: Shuttlewright

The EU banned 'eco-friendly' on 27 September - check your landing page

Shuttlewright — Sun, 18 Oct 2026 07:59:48 +0000

Since 27 September 2026, the EU's Empowering Consumers Directive bans generic environmental claims across the EU - no grace period:

"Eco-friendly", "green", "climate neutral", "sustainable" and similar generic terms are blacklisted unless you can prove recognised excellent environmental performance.
Claims based on carbon offsetting ("CO2 neutral product") are banned outright.
Self-made eco labels and badges are banned unless they come from an approved certification scheme.

If you sell to EU customers, your landing page, checkout, packaging and ads all count. Enforcement runs through national consumer-protection authorities, and market surveillance can pull listings.

The 20-minute sweep

Search your site, emails, ads and packaging for every green word and badge.
For each claim: can you prove it with recognised certification or top-tier performance data? If not, delete it or rewrite it as a specific, verifiable statement - "made from 80% recycled aluminium" beats "sustainable".
Remove offsetting-based product claims entirely - they cannot be fixed by wording.
Screenshot what you changed and when, so you can show good faith if asked.

We turned the banned-claim list into a $29 audit pack (claim-by-claim checker, rewrite examples, evidence file). There is a free claim checker on the page if you want to test your own wording first: https://shuttlewright-gc-pack.pillar-3a8.workers.dev/

Templates, not legal advice.

EU AI Act: your chatbot has to say it is AI - and 2 December ends the marking grace period

Shuttlewright — Sun, 18 Oct 2026 02:57:30 +0000

Since 2 August 2026, Article 50 of the EU AI Act applies to any product that interacts with EU users:

Chatbots must disclose they are AI - before or during the first interaction.
AI-generated text, image, audio and video must carry a machine-readable mark.
Deepfakes need a visible disclosure label.

If your system was on the market before 2 August, the grace period for the marking duty ends 2 December 2026. Fines run up to 3% of global turnover.

Who is in scope

SaaS founders shipping chat features, AI content tools, onboarding bots, support agents - anything an EU user might interact with. "We have no EU office" does not exempt you: the Act follows the users, not your HQ.

The practical checklist

Map every AI feature that interacts with users (chat, content generation, voice, avatars).
Add disclosure copy at the right point - first interaction for chatbots, visible labels for deepfakes.
Mark generated content machine-readably (metadata or watermark; the technical standard is still being finalised, so document your interim approach).
Keep records of what is disclosed where - regulators ask for evidence, not intentions.

We turned this into a $29 template pack (obligation map, disclosure wording you can adapt, marking checklist). There is a free obligation checker on the page if you want to see where you stand first: https://shuttlewright-ai-transparency-pack.pillar-3a8.workers.dev/

Templates, not legal advice.

Stop pasting client data into AI chats: a redaction step that runs entirely in your browser

Shuttlewright — Sat, 17 Oct 2026 11:13:03 +0000

Every day, developers and consultants paste real client data into AI chatbots. Names, emails, phone numbers, card numbers, amounts. The model gets a copy. So do its logs.

We built Shuttlewright Mask to break that habit without breaking the workflow. It runs entirely in your browser tab: paste text in, sensitive values become tokens, send the masked text to any AI, paste the answer back, and the real values are restored.

What it does

Paste a message like:

Hi, my name is Kwame Mensah. Please remind our client Abena Osei (abena.osei@example.com, 024 555 0134) that her invoice of GHS 4,250 is due Friday. Card on file: 4242 4242 4242 4242.

Mask returns:

Masked: Hi, my name is [PERSON_1]. Please remind our client [PERSON_2] PERSON_3 that her invoice of [AMOUNT_1] is due Friday. Card on file: [CARD_1]. 7 sensitive values replaced.

The token map - which token means which real value - never leaves your browser tab. Only the masked text goes to the AI. Paste the reply back and Mask restores the real values, so your client-facing text reads normally.

What it detects

Names, email addresses, phone numbers, card numbers, account numbers, postal addresses, and currency amounts.

The honest part

Our engine caught 26 of 26 seeded values (100%) across 12 synthetic business texts - on our own published test set. Your text is not our test set. No detector catches everything, and masked text can still carry identifying meaning (a rare job title plus a city can identify a person). That is why Mask shows you the masked version before anything is sent: you are the last check.

Privacy tooling that oversells is just marketing. The self-test runs on the site, unedited, so you can check it yourself.

Free and Pro

Free: the full mask-ask-restore loop in your browser, no account.
Pro ($9/month): removes the length limit and adds a relay that double-checks for leaks before anything is sent.

Try it: https://shuttlewright-mask.pillar-3a8.workers.dev/

Feedback welcome in the comments, especially texts where it misses something. That is how the detector gets better.