EU AI Act Compliance

How TRAI maps to Article 50 transparency obligations. For compliance officers and CISOs at EU-regulated entities.

Regulatory Context

The EU AI Act (Regulation 2024/1689) entered into force on 1 August 2024. Article 50 -- Transparency obligations for providers and deployers of certain AI systems -- applies from 2 August 2026.

Article 50(1)(a) requires that AI systems generating synthetic text content must be designed and developed in such a way that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. TRAI produces the cryptographic evidence trail that satisfies this obligation.

Enforcement timeline: The Digital Omnibus grace period (3 months) is only for machine-readable marking of systems already in market before 2 August. TRAI is ready for the 2 August deadline on text content.

How TRAI Maps to Article 50

Article 50 Requirement	TRAI Coverage	Implementation
Art. 50(1)(a) -- Machine-readable marking of AI-generated text	Covered	COSE_Sign1 envelope with Ed25519 + ML-DSA-65 hybrid signature. Content-addressed via BLAKE3 hash. Machine-readable by design.
Art. 50(2) -- Transparency for image/audio/video	Partial	Code exists in `tl-watermark` (Kirchenbauer z-test, AudioSeal hooks, C2PA stubs). Not wired into notarization pipeline. Deferred to v1.1.1+.
Art. 50(4) -- GPAI model provider transparency	Covered	Evidence trail includes model metadata, disclosure content, and cryptographic proof of generation time.

Configuring Evidence Generation

Environment variables

Variable	Purpose	Dev Default
`TL_DEV_MODE`	Enable dev defaults (mock TSA, mock SCITT, ephemeral keys)	`1`
`TL_TSA_URL`	RFC 3161 Time-Stamp Authority endpoint	FreeTSA (NOT qualified)
`TL_SCITT_ENDPOINT`	SCITT transparency log endpoint	Mock (no live anchoring)
`TL_AWS_KMS_KEY_ID`	AWS KMS key for ML-DSA-65 signing	EphemeralEd25519Signer
`TL_JWT_SECRET`	JWT signing secret for multi-tenant auth	Required in production
`TL_DATABASE_URL`	PostgreSQL connection string	SQLite (dev)

Production requirement: Dev defaults use ephemeral keys and mock services. For production, you must configure a qualified TSP (Actalis Italia, DigiCert, or Sectigo) and an HSM/KMS signer (AWS KMS or Thales Luna). Without these, the evidence trail has no qualified timestamp and no hardware-backed signature.

Notarization request

POST /v1/notarize
Content-Type: application/json

{
  "disclosure_type": "ai_generated_text",
  "content": "The text content to be notarized",
  "model_id": "your-model-identifier",
  "metadata": {
    "deployer_org": "your-org-id",
    "regulation": "eu_ai_act_art_50"
  }
}

The response includes:

cert_id -- unique certificate identifier
cose_sign1_b64 -- base64-encoded COSE_Sign1 envelope
pdf_url -- download URL for the A4 PDF certificate
verification_url -- public URL for GET /v1/verify/{cert_id}

Verification Workflow

Any party can verify a TRAI certificate independently. Three verification paths are supported:

1. Public endpoint (online)

GET /v1/verify/&#123;cert_id&#125;

# Returns:
# - COSE protected header (alg, hash, primary_key_fingerprint)
# - RFC 3161 timestamp token
# - SCITT receipt with Merkle inclusion proof
# - Verification status (Valid / Invalid / TimestampExpired)

2. SDK verification (offline)

# Python SDK
import trai
result = trai.verify(certificate_bytes)
print(result.status)  # "Valid"

# TypeScript SDK (WASM, runs in browser)
import &#123; verify &#125; from '@trai/core';
const result = await verify(certificateBytes);

# Go SDK
result, err := trai.Verify(certBytes)
fmt.Println(result.Status) // "Valid"

3. Offline verifier binary

# Build the offline verifier
cargo build -p tl-verify --release

# Verify a COSE_Sign1 envelope
./target/release/tl-verify --input certificate.cbor

PDF Certificate Components

The TRAI PDF certificate is a multi-section A4 document designed for auditor consumption. Each certificate contains:

Section	Contents	Purpose
L1 Summary	Human-readable summary: disclosure type, timestamp, signer, verification status	Quick auditor review
L2 Raw CWT	Full CBOR Web Token with COSE_Sign1 envelope, protected/unprotected headers	Machine verification
L3 Verification Steps	Step-by-step verification instructions for manual or automated checking	Reproducible verification
Cryptographic Details	Algorithm identifiers, key fingerprints, hash values, TSA response	Forensic evidence
QR Code	Embedded QR linking to `GET /v1/verify/{cert_id}`	Quick verification scan
Hash Chain Position	Sequence number in the BLAKE3 hash chain, previous hash, chain ID	Sequential ordering proof

What TRAI is NOT

Important scope boundaries:

Not a GRC platform -- TRAI is the evidence layer. Use Vanta, Drata, or Hyperproof for GRC workflows.
Not a DPIA substitute -- Use TRAI evidence to demonstrate DPIA compliance, not to substitute the DPIA itself.
Not a real-time monitor -- TRAI provides post-hoc evidence for audit trails, not runtime guardrails.
Not a certification body -- TRAI produces evidence; regulatory certification requires external audit.
Not training process certification -- TRAI certifies AI outputs, not training processes.

TRAI provides technical evidence generation capabilities. It does not constitute legal advice, regulatory certification, or a substitute for independent compliance review. Compliance officers must validate regulatory applicability in their jurisdiction and engage legal counsel for Article 50 compliance assessment.