DEV Community

Pedram madani
Pedram madani

Posted on

The EU AI Act started applying to your chatbot two days ago

#ai #claude #openai #opensource

Article 50 of the EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) started applying on 2 August 2026. Not "is coming". Applied. If you ship a chatbot, or generate text, images, audio or video for EU users, the transparency duties are live now.

Two more dates worth putting in your calendar:

  • 2 December 2026: synthetic-content systems placed on the market before 2 August 2026 must meet Article 50(2) marking (Article 111(4)). Four months.
  • 2 December 2027: Annex III high-risk obligations.

The text is around 100 pages, and most of us either ignore it or eventually pay a lawyer. I wanted a third option that runs where I work.

In the editor

Legalithm is an MCP server, so it works in Claude Code, Cursor and Codex:

claude plugin marketplace add legalithm-org/legalithm
claude plugin install legalithm@legalithm
Enter fullscreen mode Exit fullscreen mode

Then ask your agent "does the EU AI Act apply to this feature, and what tier?". It calls classify and answers with the Article cited, rather than recalling the regulation from training data, which is exactly where these answers go wrong.

Four tools: classify, explain_obligation, generate_disclosure (Article 50 text, EN or DE), and check_record. The first three run fully offline. The rule corpus is bundled with the server, so there is no API key and no source code, prompt or result leaves your machine.

Real output for a CV screening feature, as the provider:

{
  "risk": "high",
  "confidence": "high",
  "citations": [{ "article": "6(2)", "annex": "III", "asOf": "2026-08-03", "appliesFrom": "2027-12-02" }],
  "matchedRules": ["high_risk_employment", "high_risk_domain_selected"],
  "confidenceScore": 0.72,
  "reviewRequired": false
}
Enter fullscreen mode Exit fullscreen mode

Note matchedRules, asOf and confidenceScore. You can see which rule fired, how old the corpus is, and how sure the engine was. That is the difference between this and asking a model the same question.

Content marking, for the December deadline 

npm i -g legalithm
legalithm mark ./out.png --watermark   # C2PA + pixel watermark
legalithm verify ./out.signed.png
Enter fullscreen mode Exit fullscreen mode

No key. The hero image on the repo is AI-generated and marked with this exact command, so you can download it and verify both layers yourself.

In your repo 

npx legalithm init    # detects the stack, writes a dated compliance record
npx legalithm check   # re-verify in CI, non-zero exit on drift
Enter fullscreen mode Exit fullscreen mode

These two need a free API key, because unlike everything above they talk to the hosted record service. I would rather say that than let you find out.

The honest part

It is a rule engine that cites the Article it matched. A starting point, not legal advice, not a certification, and with no lawyer validation yet. The design choice I am proud of: when it is not confident it sets reviewRequired and defers to a human instead of asserting. A compliance tool that is confidently wrong is worse than none.

Free, open source, and it stays free through the high-risk deadline.

https://github.com/legalithm-org/legalithm

Tell me where the classification is wrong. That is the most useful feedback I can get.

Top comments (0)