Article 5, Article 50, and GPAI obligations enforced at runtime. Every blocked request carries a verbatim legal citation, rule ID, timestamp, and input hash. Not a probability score — an audit trail.
From 2 August 2026 GPAI providers become finable, and from 2 August 2026 Article 50 transparency binds the companies that build and deploy AI. If you ship a chatbot or publish AI content, you are in scope. When a regulator asks what your AI did in production, a probability score is not an answer — a blocking event log with a legal citation is. ComplyEdge gives you the reasoning record.
Above the stack
Governance and GRC platforms inventory your AI systems, map them to frameworks, and gather the evidence you assemble. If you run one, keep it. ComplyEdge does not replace it.
In the request path
ComplyEdge runs between your application and the model, on every call. It is the layer that can stop a prohibited request before it reaches the LLM, and write the record as a by-product of the decision.
An inventory can tell you the system exists. Only the request path can block the call and produce the evidence.
Each rule carries a verbatim citation from the official source. Audit-ready out of the box.
| Regulation | Rules | Status |
|---|---|---|
|
EU AI Act
Articles 4, 5 (×8 prohibited practices), 6, 9, 10, 12, 13, 14, 15, 16, 26, 27, 50 (×4 transparency), 51–55 GPAI |
30 | ✓ |
|
GDPR
Consent (Art 7), breach notification (Art 33), DPIA (Art 35), right to erasure (Art 17), cross-border transfer (Art 44–49), data minimization (Art 5) |
6 | ✓ |
|
US Federal
SOX §§404/802 & material disclosure, HIPAA minimum necessary & PHI disclosure/input, ECPA electronic surveillance, TCPA SMS opt-in |
8 | ✓ |
|
US State
CCPA / CPRA opt-out, Colorado AI Act SB 205, Illinois BIPA, NYC Local Law 144 (AEDT) |
4 | ✓ |
|
US Sanctions
OFAC screening — Russia energy wind-down, Iran IRGC carve-out, DPRK/Primorsky joint ventures |
3 | ✓ |
|
Prompt Security
Direct prompt injection, tool-call hijack, data exfiltration (OWASP LLM01); indirect prompt injection (IPI) via offline TrustLint lint, not yet on the runtime hot path |
10 | ✓ |
|
Universal · PCI DSS · COPPA
PII detection patterns, payment card data exposure, child-data input sensitivity |
3 | ✓ |
| Total | 64 | ✓ |
Sources: eur-lex.europa.eu · leg.colorado.gov · leginfo.legislature.ca.gov · law.cornell.edu · nyc.gov
Measured on the production API, 2026-07-22, using the published SDK over a reused connection: the enforcement engine evaluates in ~64ms p50 / ~106ms p95 (the opa_latency_ms field returned on every decision), and a client sees a ~380ms p50 / ~450ms p95 round trip once the connection is warm. The first call on a cold connection costs ~1.2s, dominated by TLS setup rather than evaluation. Reproduce it yourself: time any POST /v1/check and read latency_ms and opa_latency_ms off the response. No LLM in the enforcement path — every decision reproducible and explainable.
Layer 2, an optional semantic review, is off by default. Turn it on and the request text is sent to our LLM sub-processor (OpenAI) for that call; leave it off and no third party sees your traffic. Both modes are covered in the DPA.
What we store: a SHA-256 of the input (text_hash), never your prompt text. Records are retained for 180 days by default, meeting the six-month floor in Article 26(6) where that applies.
Every enforcement decision exports with the article citation on the record — not a severity score next to the word “compliance.” Each event carries the verbatim article text, rule ID, text_hash, timestamp, actor and a hash-chain link, so a reader can tell which obligation a decision answers. Read the public sample export field by field, or verify its chain yourself. Enterprise-only. Pair with the Enforcement Seal embed for public DD proof.
64 YAML rules across every jurisdiction, and 69 OPA/Rego policies (63 leaf + 6 package aggregators) of which 51 leaves are the EU AI Act, led by the EU AI Act — Article 5, Article 50, and the GPAI chapter — with broader data-regulation coverage. All EU AI Act rules are open source. Every blocked request carries a verbatim legal citation.
Start enforcing EU AI Act rules today. No vendor lock-in. No rebuild.