EU AI Act Art. 50 · enforcement in · PLD 2024/2853 Art. 10 · rebuttable presumption · DORA Art. 19-20 · in force since 2025-01-17

Apohara TrustLayer · v3.0 + W7/W8/W9 · 2026

August 2, 2026.

EU AI Act Art. 50 becomes enforceable. Here's the evidence your board will ask for.

TrustLayer notarizes your AI-generated content with COSE_Sign1 receipts, eIDAS-qualified timestamps, and SCITT anchors — so when the board asks "are we compliant?" you have a URL, not a PowerPoint.

For the engineers — cryptographic details ↓
TrustLayer produces COSE_Sign1 receipts with Ed25519 + ML-DSA-65 hybrid signatures, RFC 3161 qualified timestamps from Actalis Italia, and SCITT anchors — so your AI evidence stands up in court and in audit. EU AI Act Art. 50 + DORA + PLD 2024/2853 + ISO 42001.
EU AI Act · Art 50 DORA · Art 19-20 PLD 2024/2853 · Art 10 FIPS 204 · ML-DSA-65 COSE_Sign1 · RFC 9052 36 MCP · tools MIT / Apache-2.0
36days to EU AI Act Art. 50 enforcementUpdated every minute. Live counter at the top of the page.
€15Mmax fine or 3% global turnoverPer EU AI Act Art. 99. Plus PLD Art. 10 product liability exposure.
4compliance layersVisible disclosure · machine-readable · watermark · retention.
5to deploySelf-host with make demo. Or sign up for hosted Pro tier.
1,287 tests 36 MCP tools 1,952B ML-DSA-65 pk 3,309B signature

The 4-layer compliance model.

Every disclosure reports 4 independent layers per EU AI Act Art. 50 + Code of Practice §3.2. The rollup is most-restrictive-wins — a NonCompliant in any layer forces the global rollup. We surface NotApplicable and Partial honestly; we never false-positive green.

EU AI Act Art. 50(1)(a)

Visible disclosure

User-facing text label that marks AI-generated content. Covereddisclosure_text + disclosure_html_widget.

● Compliant
EU AI Act Art. 50(2)

Machine-readable

COSE_Sign1 envelope (RFC 9052) + RFC 3161 qualified timestamp from Actalis Italia (eIDAS). Full CMS signature verification per RFC 5652 §5.6.

● Compliant
EU AI Act Art. 50(3)

Watermark

Pure-Python Kirchenbauer z-test detector (z > 4.0) for text. Covered for text; Partial for image / audio / video (planned v1.1.1).

▲ Partial
Retention

Append-only audit

INSERT-only tables: disclosure_records + tool_execution_receipts + policy_decisions + key_rotation_events. 3y EU AI Act · 5y DORA.

● Compliant
Rollup · most-restrictive-wins Partial · watermark out of scope for image/audio/video A NonCompliant in any layer forces the global rollup. We never false-positive green. Honest disclosure via the disclaimers field on every API response.

The €15M question.

Three regulations you are already subject to. The deadlines are not negotiable; the evidence you keep is.

EU AI Act · Regulation 2024/1689

Art. 50 transparency

€15Mor 3% global turnover

Fines for AI-generated content without machine-readable provenance or visible disclosure. Applies to deployers and providers in the EU market.

Deadline · 2 August 2026
PLD · Directive 2024/2853

Art. 10 evidence pack

Rebuttablepresumption of defect

Shifts the burden of proof to the plaintiff when a seller holds a verifiable evidence pack. Without it, defect is presumed — under PLD Art. 10.

Deadline · 9 December 2026
DORA · Regulation 2022/2554

Art. 19-20 ICT incident log

22,000+EU financial entities

Tamper-evident ICT incident logs required for credit institutions, insurers, and investment firms. Operational-resilience fines are layered on top.

In force since · 17 January 2025

Try it. Right now.

Three tabs mirror the production endpoints. Client-side only — no backend, no network, no secrets.

[Before TrustLayer]

Your AI generates: "This report was created with GPT-4o"

A regulator asks: "Prove it was disclosed."

Your answer: ¯\_(ツ)_/¯

[With TrustLayer — try it ↓]

Your AI generates the same content.

TrustLayer produces a certificate: timestamped, signed, and verifiable at a URL.

You paste that URL in your compliance documentation.

0 certificates generated in this session

Client-side simulation · no backend · no network. Production uses real Actalis Italia RFC 3161 + real SCITT + real WASM SDK (tl-wasm).

$ POST /v1/notarize · client-side simulation
4-step pipeline · ~1.7s total
  1. Fingerprinting content (tamper-proof)…
  2. Signing with post-quantum cryptography…
  3. Timestamping (eIDAS-qualified, Actalis Italia)…
  4. Running EU AI Act Art. 50 assessment…
cert_id · Partial · Watermark out of scope
content_hash
tsa_provider
Actalis Italia (eIDAS)
scitt_entry_id
issued_at
tenant
demo · apohara

4-layer compliance rollup

  • Visible disclosure (Art. 50(1)(a))✓ Compliant
  • Machine-readable (Art. 50(2))✓ Compliant
  • Watermark (Art. 50(3))▲ Partial · text only
  • Retention (3y EU / 5y DORA)✓ Compliant
Download PDF Share →
GET /verify/{cert_id} · 4-layer disclosure table

VERIFIED

This content was certified by [your-org] on 2026-06-27

as AI-generated, compliant with EU AI Act Art. 50.

Machine-readable: COSE_Sign1 · RFC 3161 timestamped · SCITT-anchored

cert_id · ▲ Partial · Watermark text-only
LayerEvidenceStatus
Visible disclosuredisclosure_text + html_widget presentPASS
Machine-readableCOSE_Sign1 + RFC 3161 verified (Actalis Italia)PASS
WatermarkKirchenbauer z-test (z > 4.0) — text onlyWARN
RetentionAppend-only chain · 3y EU / 5y DORAPASS
rollup · most-restrictive-wins verify_url · https://trustlayer.apohara.io/verify/—
Python · apohara-trustlayerPyPI · v3.0
# pip install apohara-trustlayer
from apohara_trustlayer import Notary

notary = Notary(api_key="…")
cert = notary.notarize(
    content="Report generated by GPT-4o on 2026-06-27",
    ai_system_id="gpt-4o@openai",
    tenant="acme",
)
print(cert.cert_id, cert.content_hash)
TypeScript · @apohara/trustlayernpm · v3.0
// npm i @apohara/trustlayer
import { Notary } from "@apohara/trustlayer";

const notary = new Notary({ apiKey: process.env.TL_KEY! });
const cert = await notary.notarize({
  content: "Report generated by GPT-4o on 2026-06-27",
  aiSystemId: "gpt-4o@openai",
  tenant: "acme",
});
console.log(cert.certId, cert.contentHash);
Go · apohara-trustlayer/sdk/gogo.dev · v3.0
// go get github.com/SuarezPM/apohara-trustlayer/sdk/go
package main

import (
    "context"
    "log"
    "github.com/SuarezPM/apohara-trustlayer/sdk/go"
)

func main() {
    n := trustlayer.New("…")
    cert, err := n.Notarize(context.Background(), trustlayer.NotarizeRequest{
        Content:    "Report generated by GPT-4o on 2026-06-27",
        AISystemID: "gpt-4o@openai",
        Tenant:     "acme",
    })
    if err != nil { log.Fatal(err) }
    log.Println(cert.CertID, cert.ContentHash)
}

Endpoints, RFCs, and what we shipped.

Five endpoints, eight standards, one frozen smoke-test artifact you can verify offline.

Endpoints

POST /v1/notarizeCOSE_Sign1 + RFC 3161
GET /verify/{cert_id}Public · HTML
GET /v1/verify/{cert_id}Public · JSON L1
POST /v1/pld/rebuttalPLD Art. 10 pack
GET /v1/dora/evidence-packDORA 7/7 checks

Standards · RFCs · NIST · ETSI

RFC 9052 · COSE_Sign1coset 0.4.2
RFC 3161 · TSAActalis Italia · eIDAS
RFC 9943 · SCITTscitt-cose 0.1.1
RFC 8392 · CWTCBOR Web Tokens
RFC 5652 · CMS§5.6 verify
RFC 9162 · MerkleTransparency logs
FIPS 204 · ML-DSA-65NIST PQC
ETSI EN 319 421/422Qualified TSP
$ audit_artifacts/smoke_test/v1.1.x_output.txt · frozen artifact · sha256 verified
# Frozen smoke-test artifact — openssl ts -verify + cargo test output
# Audit-trail drift detection: sha256 of v1.1.x_output.txt must match.
# Regression asserted by tests/test_smoke_test_artifact.py

artifact: audit_artifacts/smoke_test/v1.1.x_output.txt
sha256:    c693f2f95fddf3c7aceb9ff42a489a17d4a34311e9350f3eee86dd0e26a35b88
openssl:   Verification: OK  # RFC 3161 + RFC 5652 §5.6 chain re-walked
cargo:     test result: ok. 1287 passed; 0 failed   # 1,137 Rust + 119 tl-evidence + 21 TS + 16 Go
pytest:    202 passed in 28.4s                          # Python control plane

# HONEST DISCLOSURES (per AC-22): the artifact names every synthetic
# / demo-grade part. We never false-positive green.

Pricing. No invented logos.

Per README W5. Real numbers, not a sales deck.

// evaluation · pre-AI Act deadline

Free

$0forever

Show me it works — self-host the control plane. No TSA, no SLA, no support.

  • Demo completa
  • Self-host the control plane
  • 100 certs/mo
  • MIT / Apache-2.0
// DORA + PLD · regulated industries

Enterprise + DORA Pack

€500DORA Pack add-on

DORA + PLD on top of AI Act — HSM-backed signing, on-prem deployment, dedicated Slack channel.

  • Art. 50 + PLD Art. 10 + DORA ✓
  • HSM signing
  • On-prem
  • SLA + dedicated Slack
FreePro $199/moEnterprise + DORA Pack €500
Para quiénEvaluación técnicaStartups pre-revenueEmpresas con AI en producción
Problema que resuelveQuiero ver cómo funcionaCumplir Art. 50 antes del 2 agostoDORA + PLD además del AI Act
Certificados100/mes10,000/mesIlimitado
Lo que importaDemo completaArt. 50 compliant ✓Art. 50 + PLD Art. 10 + DORA ✓

Design partner program · 2026-07-10 application deadline

We need 5 EU-regulated design partners before Art. 50 enforcement.

EU financial services subject to DORA Art. 9-13 · AI providers subject to EU AI Act Art. 50(2) · product makers subject to PLD 2024/2853 · ISO/IEC 42001:2023 AIMS aspirants. 6 months free, full production stack, direct Slack channel with Pablo.