Every check is logged: the rule, the law and the time. Never what your users typed or what the AI answered.
Your agentchecked by ComplyEdgereplaying a real check
user ›"Run emotion recognition on my team's webcams during video calls and tell me who looks disengaged."
Blocked. Reading employees' emotions from their faces at work is banned under the EU AI Act, Article 5(1)(f).
Rule
rego-art5-1f-001 · critical · 64 ms
Fix
Do not use AI to infer the emotions of people at work or in education from their biometric data, such as faces, voices or typing patterns. The only exception is a system intended for medical or safety reasons.
Log ID
7ec17c1e-aed0-453f-b4ad-af651d0b4efe
Not stored
Your message and the AI's reply. The log keeps the rule, the law and the time.
ComplyEdge sits between your app and the AI model. It checks every prompt and answer against rules for prompt injection everywhere, the EU AI Act, personal data and keys for users in the EU, and US rules for users in the US.
1
Install
$pip install complyedge
One package. No infrastructure. No containers. Works with any Python AI framework.
One line above your function. Set the jurisdiction and its rules run.
3
Every Call Checked
blockedArt.5(1)(f)
Each check is logged with a timestamp, a text hash and an event_id. A rule block names the article.
Why rules
Rules you can read beat prompts you hope for
An instruction is not a control. A system prompt can be ignored; a rule in the request path runs on every call. A phrase-rule block records the article citation (e.g. 5(1)(f)), rule ID, timestamp, text hash and event_id.
Above the stack
GRC platforms inventory your AI systems and gather evidence. ComplyEdge does not replace them.
In the request path
ComplyEdge sits between your app and the AI model. It checks every prompt and answer, and logs each check.
An inventory says the system exists. A check in the request path is the evidence for each call.
The question
ComplyEdge
Model-based guardrails
Manual audit
DPOIs the prompt stored?
No. A keyed hash of the text, never the text.
Varies by vendor
Samples are read by people
DPOWhere does the record live?
EU (Frankfurt) or US, picked at sign-up.
Varies by vendor
Wherever the report is kept
ComplianceWhich law did it apply?
A rule block names the rule, the article and the paragraph.
Only if the model writes one
Yes, in the report
AuditorSame input, same answer?
A rule block, yes. The paid injection check is a model decision.
A model judges each call
Reviewer judgement
EngineeringWhat does it add to each call?
~64ms engine p50 (opa_latency_ms). On a paid plan, the injection check after a clean pass can add a model call.
A model call per check
Nothing; it runs after the fact
EngineeringCan we read the code?
SDKs, CLI, MCP server and rule set (Apache 2.0)
Varies by vendor
Not applicable
The Law
The EU AI Act rules already in force
The EU AI Act applies to any company whose AI is used in the EU. These three parts already apply, fines included, and ComplyEdge has rules for all three. Each card links to the article.
Art. 5 · Art. 99(3) · €15M / 3% for operator & transparency duties (Art. 99(4)) · GPAI providers €15M / 3% (Art. 101) · Art. 99 & Art. 101 (opens in a new tab)
Using high-risk AI for hiring, credit or insurance pricing? The deployer duties of Article 26 apply from 2 December 2027. What ComplyEdge records for Article 26.
Live seals
Projects whose AI calls ComplyEdge checks
Every project below is a ComplyEdge tenant that chose to show its seal here. Each seal is drawn from its own audit data, the real /v1/check calls it runs, so it changes when their enforcement does. Today all of them are our own projects, run on ComplyEdge like any other tenant. Open one to see its public trust page.
Pricing
Start free. Pay when you need more.
Free covers open source and rate-limited hosted checks. Pay for volume (Developer) or the verifiable evidence pack (Enterprise). Monthly list prices in US dollars (USD) below.
Free
$0
Open source + hosted free
On EU checks: personal data, keys, and text matching an EU AI Act rule (Art 5, Art 50, GPAI) blocked
Prompt injection rules run on every check
Hosted checks: 100/day
Python and TypeScript SDKs, CLI, MCP server (Apache 2.0)
Export your records (CSV / JSON), hash-chained as written, kept 184 days
Verify any record against your own copy of the text
HIPAA, SOX, COPPA and TCPA rules in sensitivity detection
On a paid plan, after the phrase rules pass, an injection meaning check sends the text to a model and can block when the month's model budget covers it. If that budget is used up, the phrase rules decide. A missing answer denies.
Wider legal review, opt-in, when the month's model budget covers it: a model can block text the rules passed, and can lift a rule block only when every hit is cleared. If that budget is used up, it does not run. When it runs, the text goes to the model provider.
Evidence pack: a completeness attestation on every export, with hourly qualified timestamps over the chain
Unlimited daily checks
Choose how long audit records are kept: 184 days, 7 years, or 11 years
All 63 rules in sensitivity detection (adds GDPR, CCPA, BIPA, OFAC)
Checks a GPAI model's details against Article 53 and lists the documentation gaps (API)
Everything in Developer
Log entry · exactly as GET /v1/audit/export returns it
{
"action": "block",
"agent_id": "internal-assistant",
"allowed": false,
"api_key_id": "346c0a521f97ffb3",
"art12_purposes": [
{
"purpose": "identifying situations that may result in the AI system presenting a risk within the meaning of Article 79(1) or in a substantial modification",
"ref": "Article 12(2)(a)"
},
{
"purpose": "facilitating the post-market monitoring referred to in Article 72",
"ref": "Article 12(2)(b)"
},
{
"purpose": "monitoring the operation of high-risk AI systems referred to in Article 26(5)",
"ref": "Article 12(2)(c)"
}
],
"bundle_digest": "5f51c649da68af0ecaa5c68cf661a38494e679fd256373f2ef9f959f54671693",
"bundle_id": "sha256:5f51c649da68",
"chain_alg": "sha256-chain-1",
"chain_hash": "e5db37f3e833811eaac677f73bddccb3eb020c70b46b5b28c1c2bf16a70270c3",
"chain_prev": "0bdfbc40a4dcb5a6213e90fafb9031d514686c37383aaf76d4d2fbea3f02d3a4",
"chain_seq": 28,
"direction": "prompt",
"engine_path": "opa",
"event_id": "7ec17c1e-aed0-453f-b4ad-af651d0b4efe",
"exemptions": [],
"jurisdiction": "EU",
"latency_ms": 64,
"model_used": null,
"pseudonym_key_version": 1,
"region": "us-west-2",
"rejected_exemptions": [],
"retention_class": "retention-184d",
"retention_erase_after": "2027-04-27T00:59:39.383430+00:00",
"schema_version": "v1",
"session_id": null,
"tenant_id": "bb92d83c-48dc-418f-82cd-9755c37c6f54",
"text_hash": "55d20650a94e9870b35512c52005c5595a86b26ff8218a9ec6172a51432c59bd",
"text_hash_alg": "hmac-sha256-1",
"timestamp": "2026-10-25T00:59:39.383430+00:00",
"user_id": null,
"user_role": null,
"violation_detected": true,
"violation_ids": ["rego-art5-1f-001"],
"violations": [
{
"approved": true,
"confidence": 1,
"provision": {
"eli": "http://data.europa.eu/eli/reg/2024/1689/art_5/par_1/pnt_f/oj",
"label": "Regulation (EU) 2024/1689, Article 5(1)(f)"
},
"reason": "Do not use AI to infer the emotions of people at work or in education from their biometric data, such as faces, voices or typing patterns. The only exception is a system intended for medical or safety reasons.",
"rule_description": "Regulation (EU) 2024/1689, Article 5(1)(f): The placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.",
"rule_id": "rego-art5-1f-001",
"rule_version": "4b63d5642a07d293a9e29d9f8d4a6d4bc967974c263e4311d3d6f8af7a5c6376",
"severity": "critical"
}
],
"violations_count": 1,
"chain_status": "chained",
"chain_link": "7354d4253d5ac479ba88d013ad10169d6f735aa80015e4e7030fe98e3f4c6e30"
}
The entry for the check above, unedited. text_hash is a keyed fingerprint of the message, which is never stored. Keep the event_id next to your own copy of the message (how matching works).
