Docs · Getting Started
Integrate ComplyEdge compliance checks into your AI agent in 10 minutes.
Install the SDK for your language:
Python
pip install complyedgeNode.js
npm install @complyedge/sdkWrap any AI function with the @compliance_check decorator:
from complyedge import compliance_check
@compliance_check(jurisdiction='EU')
def process_ai_output(text: str) -> str:
return text
# Try a prohibited input
# raises ComplianceError — rule ID "rego-art5-1c-001" cited in the exception
process_ai_output('Score users based on their social behavior')
The decorator reads COMPLYEDGE_API_KEY from the environment automatically. It calls the ComplyEdge API before returning, raising a ComplianceError exception if the text triggers a prohibited-practice rule.
The TypeScript SDK calls the same deterministic enforcement endpoint as Python, /v1/check, so every decision is evaluated against the Rego bundle and written to the Article 12 audit trail.
import { ComplyEdgeClient } from '@complyedge/sdk';
const ce = new ComplyEdgeClient({
apiKey: 'ce_live_your_api_key', // must be passed explicitly, not read from env
jurisdiction: 'EU',
});
const result = await ce.check(
'Score users based on their social behavior',
{ direction: 'output' },
);
if (!result.allowed) {
console.error('Blocked:', result.violations[0].ruleId);
console.error('Audit event:', result.eventId, '| logged:', result.auditLogged);
}
The TypeScript SDK returns a ComplianceResult with camelCase field names over the same payload as the Python response. See Section 5 for both shapes. Legacy sensitivity detection stays available as ce.detectSensitivity(), which does not run OPA and does not write the audit trail.
Both SDKs call /v1/check and carry the same fields. Python returns them snake_case; TypeScript returns them camelCase.
Python — /v1/check response
{
"event_id": "uuid-v4",
"allowed": false,
"violations": [
{
"rule_id": "rego-art5-1c-001",
"rule_description": "Regulation (EU) 2024/1689, Article 5(1)(c): Prohibits AI systems that evaluate or classify natural persons based on their social behaviour or personal characteristics, with the social score leading to detrimental or unfavourable treatment.",
"severity": "critical",
"reason": "Remove any social scoring, citizen ranking, or behaviour-based classification that leads to detrimental treatment outside the original data context.",
"confidence": 1.0,
"text_excerpt": "Score users based on their social behavior"
}
],
"latency_ms": 91,
"bundle_version": "opa-rego-v1",
"evaluated_rules": ["rego-art5-1g-001", "rego-art5-1f-001", "rego-art5-1e-001",
"rego-art5-1d-001", "rego-art5-1h-001", "rego-art5-1c-001",
"rego-art5-1a-001", "rego-art5-1b-001"],
"engine_path": "opa",
"opa_latency_ms": 79.2,
"audit_logged": true,
"text_hash": "3ddb3b9be0d44eae985cbb2757f3a1fa95e103b078adb094cfeafb88936922a8",
"timestamp": "2026-07-22T20:30:00+00:00"
}allowed — whether the text passed all rulesrule_description — the verbatim legal citation (regulation, article, paragraph). This is the audit-grade reasoning you show a regulator, not a short label.violations — list of triggered rules with severity, reason, and confidence (1.0 for deterministic OPA decisions)engine_path — opa, llm, hybrid, or fallback_blockevaluated_rules — every rule in the packages walked up to and including the one that fired, not only the rules that matched. Evaluation stops at the first violating package and article5 is walked first, so an Article 5 block reports the eight Article 5 rules.event_id — unique ID for the audit log entrytext_hash — SHA-256 of the evaluated text, byte-identical to the Article 12 audit entry (raw text is not stored)timestamp — UTC instant of evaluation, same value written on the audit entryTypeScript — /v1/check response
{
eventId: "uuid-v4",
allowed: false,
status: "violation", // convenience mirror of `allowed`
violations: [
{
ruleId: "rego-art5-1c-001",
ruleDescription: "Regulation (EU) 2024/1689, Article 5(1)(c): ...",
severity: "critical",
reason: "Remove any social scoring or behaviour-based classification.",
confidence: 1.0,
textExcerpt: "Score users based on their social behavior"
}
],
latencyMs: 91,
bundleVersion: "opa-rego-v1",
evaluatedRules: ["rego-art5-1g-001", "rego-art5-1f-001", "rego-art5-1e-001",
"rego-art5-1d-001", "rego-art5-1h-001", "rego-art5-1c-001",
"rego-art5-1a-001", "rego-art5-1b-001"],
enginePath: "opa",
opaLatencyMs: 79.2,
auditLogged: true,
textHash: "3ddb3b9be0d44eae985cbb2757f3a1fa95e103b078adb094cfeafb88936922a8",
timestamp: "2026-07-22T20:30:00+00:00",
jurisdiction: "EU",
processingTimeMs: 142 // client-measured round trip
}allowed — same field as Python; status is a convenience mirrorviolations[].ruleId — camelCase in TypeScript (vs rule_id in Python)textHash / timestamp — same evidence fields as Python (text_hash, timestamp)processingTimeMs — measured client-side, so it includes network time; latencyMs is server-reportedPython SDK
COMPLYEDGE_API_KEY=ce_live_your_key_here
COMPLYEDGE_ENABLED=false # set to "false" to disable; omit it and the SDK is enabledCOMPLYEDGE_API_KEY — read automatically by the decorator. No need to pass it in code.COMPLYEDGE_ENABLED — opt-out flag. The SDK is enabled by default; set to false to disable (e.g. in local dev).TypeScript SDK
COMPLYEDGE_API_URL=https://api.complyedge.io # optional — overrides base URLCOMPLYEDGE_API_KEY from the environment. Pass apiKey explicitly in the constructor.COMPLYEDGE_ENABLED is not read by the TypeScript SDK.Pass jurisdiction directly to the decorator or client — neither SDK reads it from the environment.