getreadystack's picture
Upload index.html with huggingface_hub
2fd71d3 verified
Raw History Blame Contribute Delete
42 kB
<!doctype html><html lang="en"><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>EU AI Act Article 50 Transparency Audit for Your Codebase</title>
<meta name="description" content="Finds the AI call sites, generation code and system prompts that trigger EU AI Act Article 50 disclosure duties - in force since 2 August 2026.">
<style>
:root{color-scheme:light dark}
body{margin:0;font:16px/1.6 system-ui,-apple-system,"Segoe UI",sans-serif;
background:#fbfbfa;color:#16161d}
@media(prefers-color-scheme:dark){body{background:#14141a;color:#e8e8ea}}
.wrap{max-width:880px;margin:0 auto;padding:28px 20px 64px}
h1{font-size:1.7rem;line-height:1.25;margin:.2em 0 .3em}
p.sub{margin:0 0 1.4em;opacity:.8}
textarea{width:100%;min-height:230px;font:13px/1.5 ui-monospace,Menlo,Consolas,monospace;
padding:12px;border:1px solid #c9c9d1;border-radius:10px;background:transparent;color:inherit;
box-sizing:border-box}
button{font:600 15px/1 inherit;padding:12px 22px;border:0;border-radius:10px;
background:#1d4ed8;color:#fff;cursor:pointer;margin:12px 0}
button:hover{background:#1a43bd}
table{border-collapse:collapse;width:100%;margin-top:14px;font-size:14px}
th,td{border-bottom:1px solid #d8d8e0;padding:8px 6px;text-align:left;vertical-align:top}
th{font-weight:600;opacity:.75}
td.n{width:64px;font:13px ui-monospace,monospace;opacity:.7}
.ok{padding:14px;border-radius:10px;background:#e8f5ec;color:#14532d;margin-top:14px}
@media(prefers-color-scheme:dark){.ok{background:#15321f;color:#bbf7d0}}
.next{margin-top:30px;padding:18px;border:1px solid #d8d8e0;border-radius:12px}
.next h2{font-size:1.05rem;margin:0 0 .5em}
.cta{margin-top:18px;padding:16px 18px;border:1px solid #1d4ed8;border-radius:12px}
.cta p{margin:0 0 .6em}
.cta a.buy{display:inline-block;font:600 15px/1 inherit;padding:12px 22px;border-radius:10px;background:#1d4ed8;color:#fff;text-decoration:none}
.cta p.terms{margin:.8em 0 0;font-size:13px;opacity:.75}
.next ul{margin:.3em 0 1em 1.1em;padding:0}
</style>
<div class="wrap">
<h1>EU AI Act Article 50 Transparency Audit for Your Codebase</h1>
<p class="sub">Finds the AI call sites, generation code and system prompts that trigger EU AI Act Article 50 disclosure duties - in force since 2 August 2026.</p>
<textarea id="src" placeholder="Paste a file here - a chatbot handler, a system prompt, an image or voice generation service, an HR scoring script"></textarea>
<button id="go">Audit this file</button>
<div id="out"></div>
<div class="yj-home-find"><div class="yj-lgbar"><a href="/" class="yj-lg on">EN</a><a href="/de/" class="yj-lg">DE</a><a href="/ja/" class="yj-lg">JA</a><a href="/es/" class="yj-lg">ES</a><a href="/pt/" class="yj-lg">PT</a></div><section class="yj-find"><h2>Find a tool</h2><input id="yjq" type="search" autocomplete="off" placeholder="Type a product name, format or task"><div id="yjr"></div></section><style>.yj-lgbar{position:absolute;top:14px;right:18px;display:flex;gap:6px;z-index:60}.yj-lg{font:600 12px/1 system-ui,sans-serif;padding:6px 9px;border-radius:4px;text-decoration:none;color:#8b96a3;border:1px solid rgba(140,150,165,.28)}.yj-lg:hover{color:#e8eaed;border-color:rgba(160,175,195,.6)}.yj-lg.on{color:#0e1116;background:#cfd6de;border-color:#cfd6de}.yj-find{max-width:760px;margin:34px auto 8px;padding:0 20px}.yj-find h2{font:600 20px/1.3 system-ui,sans-serif;margin:0 0 10px}#yjq{width:100%;box-sizing:border-box;padding:13px 15px;font:400 15.5px system-ui,sans-serif;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:rgba(255,255,255,.04);color:inherit}#yjq:focus{outline:none;border-color:#7FD1C4}#yjr{margin-top:10px;display:flex;flex-direction:column;gap:6px}#yjr a{display:flex;justify-content:space-between;gap:12px;padding:11px 14px;border:1px solid rgba(140,150,165,.22);border-radius:6px;text-decoration:none;font:400 14.5px/1.4 system-ui,sans-serif;color:inherit}#yjr a:hover{border-color:#7FD1C4}#yjr .pr{font:600 13px system-ui,sans-serif;color:#5fbf9a;white-space:nowrap}</style><script>(function(){var q=document.getElementById("yjq"),r=document.getElementById("yjr"),D=null;function load(){if(D)return Promise.resolve(D);return fetch("/search-index.json").then(function(x){return x.json();}).then(function(j){D=j;return j;}).catch(function(){D=[];return D;});}function esc(t){return String(t).replace(/[&<>"]/g,function(c){return {"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c];});}function run(){var v=q.value.trim().toLowerCase();if(v.length<2){r.innerHTML="";return;}load().then(function(j){var w=v.split(/\s+/),o=[];for(var i=0;i<j.length&&o.length<12;i++){var t=j[i].t.toLowerCase();var ok=true;for(var k=0;k<w.length;k++){if(t.indexOf(w[k])<0){ok=false;break;}}if(ok)o.push(j[i]);}r.innerHTML=o.length?o.map(function(x){return "<a href=\""+esc(x.u)+"\">"+"<span>"+esc(x.t)+"</span>"+(x.p?"<span class=\"pr\">$"+x.p+"</span>":"")+"</a>";}).join(""):"";});}q.addEventListener("input",run);q.addEventListener("focus",load);})();</script></div><div class="cta" id="cta" hidden><p>In the full version: audit the whole repository and export the register as CSV, JSON or HTML.</p>
<a href="https://getreadystack.com/api/buy/cl/polar_cl_CgFfcIlACJrXuIyrkoDLS0KZVtswtVmyEUoIm4c4Fhc" class="buy">Get the full version - $29</a>
<p class="terms">$29 once · one licence key per person or team seat · Specialist firms price an AI-system classification round at EUR 3,000-15,000.</p></div>
<div class="next"><h2>In the full version</h2><ul><li>Whole-repository audit</li><li>Export the register (CSV / JSON / HTML)</li><li>CI report</li><li><a href="https://getreadystack.com/api/buy/cl/polar_cl_CgFfcIlACJrXuIyrkoDLS0KZVtswtVmyEUoIm4c4Fhc">Get the full version</a></li></ul></div>
</div>
<script>
var RULES=[{"pattern": "chat\\.completions\\.create|responses\\.create\\(", "flags": "i", "message": "Art 50(1) - OpenAI chat/responses call site. If this output reaches a person, they must be told at first contact that they are interacting with an AI system. Add the call site to your Article 50 register.", "sev": "warn"}, {"pattern": "new\\s+Anthropic\\(|anthropic\\.messages\\.create|messages\\.create\\(|from\\s+anthropic\\b", "flags": "i", "message": "Art 50(1) - Anthropic messages call site. Human-facing output needs an AI-interaction notice before or at the first reply. Record this file in the register.", "sev": "warn"}, {"pattern": "GenerativeModel\\(|generate_content\\(|generateContent\\(|google\\.generativeai", "flags": "i", "message": "Art 50(1) - Gemini generation call site. Disclose the AI system to the person at first interaction unless the AI involvement is obvious to a reasonable person.", "sev": "warn"}, {"pattern": "InvokeModelCommand|bedrock-runtime|invoke_model\\(|converse\\(", "flags": "i", "message": "Art 50(1) - Bedrock invocation. You are the provider of the interacting system even when the model is someone else's; the disclosure duty is yours.", "sev": "warn"}, {"pattern": "ChatOpenAI\\(|ChatAnthropic\\(|ChatGoogleGenerativeAI\\(|langchain|llama_index", "flags": "i", "message": "Art 50(1) - orchestration framework call site. Trace where this chain's output surfaces to a user; that surface is what needs the disclosure.", "sev": "warn"}, {"pattern": "dialogflow|botpress|\\brasa\\b|LexRuntime|voiceflow|intercom.*bot", "flags": "i", "message": "Art 50(1) - chatbot platform integration. The end user must be informed they are talking to an AI system, in a way that is clear and distinguishable at first interaction.", "sev": "warn"}, {"pattern": "\\bollama\\b|llama[_-]?cpp|text-generation-inference|\\bvllm\\b|localai", "flags": "i", "message": "Art 50(1) - self-hosted model serving. Self-hosting does not remove the transparency duty; if a person is on the other end, disclose.", "sev": "warn"}, {"pattern": "images\\.generate|dall-?e|gpt-image|imagen-", "flags": "i", "message": "Art 50(2) - image generation. Output must carry an effective, machine-readable mark that it is AI-generated. Systems on the market before 2 Aug 2026 must comply by 2 December 2026.", "sev": "error"}, {"pattern": "StableDiffusionPipeline|\\bdiffusers\\b|stable-?diffusion|comfyui|automatic1111", "flags": "i", "message": "Art 50(2) - local image generation pipeline. A local pipeline strips nothing by itself, but it also marks nothing by itself. Attach a C2PA manifest or watermark before the file leaves your service.", "sev": "error"}, {"pattern": "replicate\\.run|fal\\.subscribe|fal_client|together\\.images", "flags": "i", "message": "Art 50(2) - hosted generation API. Confirm in writing whether the vendor marks the output; if it does not, you must mark it before publication.", "sev": "error"}, {"pattern": "elevenlabs|audio\\.speech|texttospeech|TextToSpeechClient|tts\\.synthes", "flags": "i", "message": "Art 50(2) - synthetic audio. Generated speech is synthetic content and needs the machine-readable mark, on top of any deepfake disclosure under Art 50(4).", "sev": "error"}, {"pattern": "runwayml|\\bsora\\b|veo-\\d|kling|pika[_-]?labs|luma\\.?ai", "flags": "i", "message": "Art 50(2) - video generation. Video output needs the machine-readable mark; if it depicts a real person, Art 50(4) deepfake disclosure applies as well.", "sev": "error"}, {"pattern": "c2pa|ContentCredential|content_credentials|truepic|\\bsynthid\\b", "flags": "i", "message": "Art 50(2) - provenance tooling found. Good. Verify the manifest survives resizing, re-encoding and your CDN, because an unreadable mark is not a mark.", "sev": "info"}, {"pattern": "-map_metadata[\\\"'\\s,]+-1|piexif\\.remove|strip[_-]?exif|remove[_-]?exif|stripMetadata|noProfile\\(|--strip-all|(convert|mogrify|magick)[^\\n]{0,60}\\s-strip\\b|exiftool\\s+-all=", "flags": "i", "message": "Art 50(2) RISK - this strips file metadata. If the media carries a C2PA manifest or metadata watermark, this line destroys the mark you are required to attach.", "sev": "error"}, {"pattern": "deepface|py[_-]?feat|\\bFER\\b|emotion[_-]?(recognition|classifier|detect)|affectiva|morphcast", "flags": "i", "message": "Art 50(3) - emotion recognition. As deployer you must inform the people exposed to it, and process their personal data under the GDPR.", "sev": "error"}, {"pattern": "face[_-]?recognition|insightface|facenet|get_frontal_face|detect_faces|face_encodings", "flags": "i", "message": "Art 50(3) - face processing. If faces are used to sort people into categories, the people exposed must be informed.", "sev": "warn"}, {"pattern": "biometric[_-]?categor|gender[_-]?(estimation|classif)|ethnicity[_-]?(predict|classif)|age[_-]?gender", "flags": "i", "message": "Art 50(3) - biometric categorisation. Inferring gender, age or ethnicity from biometrics triggers the deployer's duty to inform, and some inferences are prohibited outright under Art 5.", "sev": "error"}, {"pattern": "faceswap|\\broop\\b|deepfake|wav2lip|sadtalker|heygen|synthesia|d-id\\.com", "flags": "i", "message": "Art 50(4) - deepfake generation. Image, audio or video resembling real people must be disclosed as artificially generated or manipulated.", "sev": "error"}, {"pattern": "voice[_-]?clon|voiceClone|speaker[_-]?embedding|\\bxtts\\b|instant[_-]?voice", "flags": "i", "message": "Art 50(4) - voice cloning. A cloned voice of a real person is a deepfake and must be labelled as artificially generated.", "sev": "error"}, {"pattern": "auto[_-]?publish|publishArticle|generate[_-]?article|createPost\\(|cms\\.publish", "flags": "i", "message": "Art 50(4)(b) - published text. AI-generated text published to inform the public on matters of public interest must be disclosed, unless a human took editorial responsibility after review.", "sev": "info"}, {"pattern": "(scrape|crawl|harvest)[^\\n]{0,30}(face|facial|headshot|mugshot)|clearview", "flags": "i", "message": "Art 5 PROHIBITED - untargeted scraping of facial images to build a recognition database. This is banned outright, not merely a disclosure duty. Top penalty tier.", "sev": "error"}, {"pattern": "social[_-]?scor|socialScore|trustworthiness[_-]?score|citizen[_-]?score", "flags": "i", "message": "Art 5 PROHIBITED - social scoring of natural persons leading to detrimental treatment. Banned outright. Top penalty tier.", "sev": "error"}, {"pattern": "realtime[_-]?biometric|real[_-]?time[_-]?face|live[_-]?facial[_-]?recognition", "flags": "i", "message": "Art 5 PROHIBITED - real-time remote biometric identification in publicly accessible spaces. Narrow law-enforcement exceptions only.", "sev": "error"}, {"pattern": "(employee|candidate|applicant|student|pupil|interviewee)[^\\n]{0,40}emotion|emotion[^\\n]{0,40}(employee|candidate|applicant|student|pupil|interviewee)", "flags": "i", "message": "Art 5 PROHIBITED - inferring emotions of people in the workplace or in education. Banned outright since 2 February 2025. Top penalty tier.", "sev": "error"}, {"pattern": "(never|do\\s*not|don'?t|avoid|refuse\\s+to)[^\\n]{0,40}(reveal|disclose|admit|mention|say|tell)[^\\n]{0,40}(a\\.?i\\.?\\b|\\bbot\\b|assistant|language model|machine|robot)", "flags": "i", "message": "Art 50(1) BREACH - this prompt instructs the model to hide that it is an AI. The duty to inform the person cannot be contracted away in a system prompt.", "sev": "error"}, {"pattern": "you\\s+are\\s+(a\\s+|an\\s+)?(human|real\\s+person|real\\s+human|live\\s+agent)|pretend[^\\n]{0,20}(to\\s+be|you\\s+are)[^\\n]{0,20}(human|person)|act\\s+as\\s+a\\s+human", "flags": "i", "message": "Art 50(1) BREACH - the persona claims to be a human being. Anything that makes the AI indistinguishable to the user defeats the disclosure duty.", "sev": "error"}, {"pattern": "human[_-]?name|agent_name\\s*=\\s*['\\\"][A-Z][a-z]+['\\\"]|\\\"agentName\\\"", "flags": "i", "message": "Art 50(1) - a human-sounding agent name is allowed, but the AI notice must still be clear and distinguishable at first interaction.", "sev": "info"}, {"pattern": "data-ai-disclosure|You'?re\\s+(chatting|talking)\\s+with\\s+an\\s+AI|AI-generated|generated\\s+by\\s+AI|aria-label=\\\"[^\\\"]*AI\\b", "flags": "i", "message": "Disclosure string found. Keep it visible at or before the first interaction, and keep the wording in your Article 50 evidence file.", "sev": "info"}];
function scan(t){var L=String(t).split(/\r?\n/),h=[],i,r,re;
for(i=0;i<L.length;i++){for(var k=0;k<RULES.length;k++){r=RULES[k];
try{re=new RegExp(r.pattern,r.flags||'')}catch(e){continue}
if(re.test(L[i]))h.push({line:i+1,msg:r.message})}}
return h}
document.getElementById('go').onclick=function(){
var t=document.getElementById('src').value,o=document.getElementById('out');
if(!t.trim()){o.innerHTML='';return}
var h=scan(t),c=document.getElementById('cta');
if(c)c.hidden=false;
if(!h.length){o.innerHTML='<div class="ok">Nothing found to report.</div>';return}
var s='<table><tr><th>Line</th><th>Finding</th></tr>';
for(var i=0;i<h.length;i++){s+='<tr><td class="n">'+h[i].line+'</td><td>'+
String(h[i].msg).replace(/&/g,'&amp;').replace(/</g,'&lt;')+'</td></tr>'}
o.innerHTML=s+'</table>'};
</script>
</html>
<section data-yj-install="free" style="margin:2rem auto 1rem;max-width:46rem;padding:1.25rem 1.25rem;border:1px solid #cfe3d6;border-radius:12px;background:#f6fbf8;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .4rem;font-size:1.2rem">Install free</h2><p style="margin:0 0 .8rem;color:#41505f">Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.</p><a href="https://marketplace.visualstudio.com/items?itemName=ReadyStack.ai-act-article-50-audit" rel="noopener" data-yj-install-door="mp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'ai-act-article-50-audit',src:'mp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">VS Code Marketplace</a><a href="https://www.npmjs.com/package/@readystack/ai-act-article-50-audit" rel="noopener" data-yj-install-door="npm" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'ai-act-article-50-audit',src:'npm',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">npm</a><a href="https://www.npmjs.com/package/@readystack/ai-act-article-50-audit" rel="noopener" data-yj-install-door="mcp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'ai-act-article-50-audit',src:'mcp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">MCP server (npx)</a><a href="https://hub.docker.com/r/getreadystack/ai-act-article-50-audit" rel="noopener" data-yj-install-door="docker" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'ai-act-article-50-audit',src:'docker',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Docker Hub</a><pre style="margin:.5rem 0 0;padding:.6rem .8rem;background:#f3f5f8;border-radius:8px;font-size:.9rem;overflow:auto">ext install ReadyStack.ai-act-article-50-audit
npx @readystack/ai-act-article-50-audit &lt;file&gt;
npx @readystack/ai-act-article-50-audit --mcp</pre><p style="margin:.6rem 0 0;font-size:.92rem;color:#41505f"><a href="https://getreadystack.com/api/buy/team" rel="nofollow" style="color:#0f7b3f;text-decoration:underline">Team? One key for every ReadyStack linter, 5 seats, $149 once</a></p></section>
<section data-yj-alert="rule" style="margin:1rem auto 1.5rem;max-width:46rem;padding:1.1rem 1.25rem;border:1px solid #d9dee6;border-radius:12px;background:#fbfcfd;font:15px/1.55 system-ui,-apple-system,Segoe UI,sans-serif"><b style="font-size:1.05rem">Get the full rule table as a PDF</b><div style="opacity:.78;margin:.35rem 0 .8rem">All 28 rules EU AI Act Article 50 Transparency Audit for Your Codebase checks, each with its source and date, on printable pages you can hand to your team or auditor. We email it now, and once more only if a rule changes. No newsletter.</div><div style="display:flex;gap:8px;flex-wrap:wrap"><input id="yjae" type="email" placeholder="you@example.com" style="flex:1;min-width:210px;padding:11px 13px;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:#fff;color:inherit"><button id="yjab" style="padding:11px 18px;border-radius:8px;border:0;cursor:pointer;background:#0f7b3f;color:#fff;font:600 15px system-ui,sans-serif">Email me the PDF</button></div><div id="yjao" hidden style="margin-top:.6rem;color:#0f7b3f">Sent. It arrives within the hour - check spam too.</div><script>(function(){var b=document.getElementById("yjab"),e=document.getElementById("yjae");if(!b||!e)return;b.addEventListener("click",function(){var v=e.value.trim();if(!/.+@.+\..+/.test(v))return;try{localStorage.setItem("yj_em","1");}catch(_){}fetch(location.origin+"/api/subscribe",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:v,slug:"ai-act-article-50-audit",lang:"en",source:"rule_table"+((b.closest&&b.closest("section")&&b.closest("section").getAttribute("data-yj-moved"))?"_at_result":"")})}).then(function(r){var o=document.getElementById("yjao");o.hidden=false;if(!r.ok){o.textContent="Could not save - please try again.";}}).catch(function(){var o=document.getElementById("yjao");o.hidden=false;o.textContent="Could not save - please try again.";});});})();</script><script>(function(){var e=document.getElementById("yjae"),s=e&&e.closest?e.closest("section"):null,o=document.getElementById("out");if(!s||!o)return;var d=false;function mv(ev){if(d)return;if(ev&&ev.target&&s.contains(ev.target))return;d=true;var b=o;while(b.parentNode&&b.parentNode!==document.body&&b.parentNode.tagName!=="MAIN"&&b.parentNode.tagName!=="ARTICLE")b=b.parentNode;if(!b.parentNode||b===s||b.contains(s))return;try{b.parentNode.insertBefore(s,b.nextSibling);s.setAttribute("data-yj-moved","1");}catch(_){}}document.addEventListener("input",mv,true);document.addEventListener("change",mv,true);})();</script></section>
<section data-yj-cta="paid" style="margin:3rem auto;max-width:46rem;padding:1.5rem 1.25rem;border:1px solid #d8dee9;border-radius:12px;background:#fbfcfe;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .5rem;font-size:1.25rem">Get the complete version <span class="yj-price">$29</span></h2><p style="margin:.25rem 0 1rem;color:#41505f">This page is the working piece. The full pack has everything below.</p><p style="margin:0 0 1rem;color:#41505f">Finds the AI call sites, generation code and system prompts that trigger EU AI Act Article 50 disclosure duties - in force since 2 August 2026.</p><p style="margin:0 0 1rem;color:#5b6b7c;font-size:.94rem">Specialist firms price an AI-system classification round at EUR 3,000-15,000.</p><a href="https://getreadystack.com/api/buy/cl/polar_cl_CgFfcIlACJrXuIyrkoDLS0KZVtswtVmyEUoIm4c4Fhc" rel="nofollow" style="display:inline-block;padding:.7rem 1.3rem;border-radius:8px;background:#1b64f2;color:#fff;text-decoration:none;font-weight:600">Buy the full version — $29</a></section>
<!--yj-share-s101--><div style="margin:28px 0 8px;text-align:center"><button id="yjcp" type="button" style="font:inherit;padding:10px 18px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Copy link</button><button id="yjimg" type="button" style="font:inherit;padding:10px 18px;margin-left:8px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Save result as image</button></div><script>(function(){var b=document.getElementById("yjimg");if(!b)return;b.addEventListener("click",function(){var o=document.getElementById("out");var txt=(o&&(o.innerText||o.textContent)||"").trim();if(!txt){b.textContent="(no result yet)";setTimeout(function(){b.textContent="Save result as image";},1500);return;}var lines=txt.split(String.fromCharCode(10)).filter(function(x){return x.trim();}).slice(0,10);var W=1200,P=56,c=document.createElement("canvas");c.width=W;var lh=38,H=P*2+70+lines.length*lh+60;c.height=H;var x=c.getContext("2d");x.fillStyle="#1a1512";x.fillRect(0,0,W,H);x.fillStyle="#f3e9d2";x.font="600 34px system-ui,Segoe UI,Arial";var t=(document.title||"").split("|")[0].trim();x.fillText(t.slice(0,54),P,P+34);x.font="22px ui-monospace,Menlo,Consolas,monospace";x.fillStyle="#e8dcc4";for(var i=0;i<lines.length;i++){x.fillText(lines[i].slice(0,88),P,P+70+i*lh+22);}x.font="600 22px system-ui,Segoe UI,Arial";x.fillStyle="#c9a227";var d=location.hostname.replace("www.","");x.fillText(d,W-P-x.measureText(d).width,H-P+6);c.toBlob(function(bl){var u=URL.createObjectURL(bl),a=document.createElement("a");a.href=u;a.download=(t||"result").replace(/[^a-z0-9]+/gi,"-").toLowerCase()+"-"+d+".png";document.body.appendChild(a);a.click();setTimeout(function(){URL.revokeObjectURL(u);a.remove();},2000);},"image/png");});})();</script><script>(function(){var b=document.getElementById("yjcp");if(!b)return;var t=b.textContent;b.addEventListener("click",function(){var u=location.href.split("#")[0];function d(){b.textContent="Link copied";setTimeout(function(){b.textContent=t;},1800);}if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(u).then(d,function(){prompt("",u);});}else{prompt("",u);}});})();</script><script data-yj="yj-view-beacon">(function(){try{var p=location.pathname;var k='yjv:'+p;if(sessionStorage.getItem(k))return;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",ref:(document.referrer||''),src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}catch(e){}})();</script>
<script data-yj="yj-use-beacon">(function(){try{var o=document.getElementById('out');if(!o)return;var p=location.pathname,k='yju:'+p,sent=false;function fire(){if(sent||sessionStorage.getItem(k))return;if(!(o.textContent||'').replace(/\s+/g,'').length)return;sent=true;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",t:'use',src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}var mo=new MutationObserver(function(){fire();if(sent)mo.disconnect();});mo.observe(o,{childList:true,characterData:true,subtree:true});}catch(e){}})();</script>
<section data-yj="yj-facts-v1" style="max-width:920px;margin:48px auto 0;padding:0 20px;font-family:system-ui,sans-serif"><style>.yj-article p{font:400 15.5px/1.7 system-ui,sans-serif;color:#26313b;margin:0 0 12px;max-width:72ch}.yj-article h2,.yj-article h3,.yj-article h4{font:600 17px/1.35 system-ui,sans-serif;color:#1b1f24;margin:22px 0 8px}.yj-article table{border-collapse:collapse;margin:10px 0 16px;font:14px/1.45 system-ui,sans-serif}.yj-article th,.yj-article td{border:1px solid #e2e6ea;padding:6px 10px;text-align:left}.yj-article th{background:#f4f6f8}.yj-article pre{background:#0f1720;color:#e6edf3;padding:12px 14px;border-radius:8px;overflow:auto;font:13px/1.5 ui-monospace,Menlo,monospace}.yj-article code{font:13px ui-monospace,Menlo,monospace;background:#f1f3f5;padding:1px 4px;border-radius:3px}.yj-article pre code{background:none;padding:0}.yj-article ul,.yj-article ol{font:15px/1.6 system-ui,sans-serif;color:#26313b}</style><p style="font:400 13px/1.5 system-ui,sans-serif;color:#6b7680;margin:0 0 14px"><time datetime="2026-09-17">Updated 2026-09-17</time> · ReadyStack</p><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","dateModified":"2026-09-17","author":{"@type":"Organization","name":"ReadyStack"}}</script><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Worked example</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 16px;color:#5b6570">Real numbers from this tool, line by line.</p><div class="yj-article"><p><img src="https://getreadystack.com/img/promo/sku17508_result_card.jpg" alt="Twenty findings in one checkout page: PCI DSS 6.4.3 on the markup you already shipped" loading="lazy" style="max-width:100%;border-radius:6px"></p>
<p>Five scripts nobody authorised sit on one ordinary checkout page - e-commerce developers in the US and the EU, on markup that already renders and takes money.</p>
<pre><code>checkout.html
5 error The CSP is in a &lt;meta&gt; tag - meta ignores report-uri and report-to, so 11.6.1 can never alert you.
5 error script-src allows bare https: - every host on the internet is an authorised script source.
7 error googletagmanager.com/gtag/js - a container can add a script after the inventory was signed.
9 error jquery@latest - a moving version, so no integrity hash stays true until the next audit.
10 error static.hotjar.com - a session recorder on a page that has a card field.</code></pre>
<p>That is the audit output, not a summary. Twenty findings come back from that page in total; those five are the top of the list. Not one is a bug - the page renders and payments go through. They are a requirement mandatory since 2025-03-31 that nobody put on the sprint board.</p>
<p>PCI DSS 4.0.1 requirement 6.4.3 says every script executed in the customer&#x27;s browser on a payment page needs three things: a method confirming it is authorised, a method assuring its integrity, and an inventory entry with a written justification. Requirement 11.6.1 adds that you must be alerted when that page&#x27;s scripts or security headers change.</p>
<p>The markup behind them:</p>
<pre><code>&lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot;script-src &#x27;self&#x27; &#x27;unsafe-inline&#x27; https:&quot;&gt;
&lt;script src=&quot;https://www.googletagmanager.com/gtag/js?id=G-8QK2M1RS&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;https://static.hotjar.com/c/hotjar-2914455.js?sv=6&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;https://js.stripe.com/v3/&quot;&gt;&lt;/script&gt;</code></pre>
<p>The last line is fine, and naive tooling flags it anyway: js.stripe.com must load with no Subresource Integrity hash, because Stripe rotates that file. It still needs an inventory row - justification: renders the hosted card fields.</p>
<h3>What changed this year</h3>
<p>Merchants with a fully outsourced checkout used to have a way out: if the processor delivered the whole payment page, a QSA could agree that 6.4.3 and 11.6.1 were not applicable, and that was enough for the report.</p>
<p>On 2026-08-04 the PCI Security Standards Council published a revised FAQ 1331: QSA agreement alone is no longer sufficient, and merchants must consult their Compliance Accepting Entity - the acquirer or payment brand. The requirements did not change; the escape route narrowed, inside an assessment cycle many teams are in.</p>
<h3>Why your existing tools miss it</h3>
<p>A CSP evaluator grades the policy string and never opens your page, so it misses a script injected at runtime by <code>document.createElement(&#x27;script&#x27;)</code>. ESLint reads JavaScript, not <code>&lt;script&gt;</code> attributes, so <code>integrity=</code> with no <code>crossorigin=</code> - which browsers ignore, leaving you unprotected while the markup claims otherwise - goes straight past it. And an assistant trained before this year will tell you Subresource Integrity is sufficient for 6.4.3. It is the most common wrong answer here: SRI inventories nothing, skips dynamically injected scripts, and never notices an authorised script behaving differently.</p>
<p>The audit reads the page as markup, line by line, against 26 rules written for payment pages: each finding names the line, the requirement it fails and the fix. The free version audits the page you have open, completely - all 26 rules, no key, no watermark, nothing locked.</p>
<p>What a licence adds is not more rules - it is the artifact. An assessor does not accept a findings panel; they accept a dated inventory. The full version exports it as CSV, JSON or HTML across every payment page in the repository, and fails a CI build when an unauthorised script appears. A PCI consultant bills about $76 an hour in the US in 2026, and a QSA-assisted self-assessment runs $5,000 to $20,000. Building this inventory by hand is billed inside that, and it has to be rebuilt every time marketing adds a tag.</p></div><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:34px 0 6px;color:#1b1f24">Questions people ask</h2><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What does the AI Act Article 50 Audit actually do?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">It reads your source files and prints every line that triggers an EU AI Act transparency duty: LLM and chatbot call sites under Article 50(1), image, audio and video generation that needs a machine-readable mark under Article 50(2), emotion and biometric categorisation under 50(3), deepfakes under 50(4), and practices banned outright by Article 5. Twenty-eight rules, each printed with its paragraph and line number.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Who is this for?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Engineering teams that ship an LLM, image, voice, deepfake or emotion feature to users in the European Union, and the person on that team who has been asked to produce the Article 50 register. It is written for developers, not lawyers: it runs in VS Code, prints file and line numbers, and exports a file your compliance colleague can actually read.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why can&#x27;t I just ask ChatGPT or run ESLint?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">ESLint has no Article 50 rule; the duties are not style problems. A chat assistant can summarise the Act, but it cannot list which of your four thousand files hold the call sites, and its sense of the timeline is usually wrong: the Digital Omnibus delayed the Annex III high-risk rules to December 2027 and left Article 50 in force from 2 August 2026.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What is free and what needs a licence?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Free finishes one file completely, in the editor or in the browser: all twenty-eight rules, every line number, no watermark, no blocked result and no time limit. A licence changes the scope, not the quality. It audits the whole repository in one pass and exports the register as CSV, JSON or HTML, plus a JSON report a CI pipeline can gate on.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What would this cost if a person did it?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Specialist firms price an AI-system classification round at roughly EUR 3,000 to 15,000 depending on how many systems you have, and a Chapter III gap analysis considerably more. This does the code-side inventory step of that work for forty-nine dollars, once. It is an inventory tool, not legal advice, and it does not replace the assessment itself.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why not just ask ChatGPT or another AI chat?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. AI Act Transparency Audit - Article 50 (chatbots, deepfakes, checks the file you open against 28 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.</p></details><script type="application/ld+json" data-yj="yj-faq-ld">{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "What does the AI Act Article 50 Audit actually do?", "acceptedAnswer": {"@type": "Answer", "text": "It reads your source files and prints every line that triggers an EU AI Act transparency duty: LLM and chatbot call sites under Article 50(1), image, audio and video generation that needs a machine-readable mark under Article 50(2), emotion and biometric categorisation under 50(3), deepfakes under 50(4), and practices banned outright by Article 5. Twenty-eight rules, each printed with its paragraph and line number."}}, {"@type": "Question", "name": "Who is this for?", "acceptedAnswer": {"@type": "Answer", "text": "Engineering teams that ship an LLM, image, voice, deepfake or emotion feature to users in the European Union, and the person on that team who has been asked to produce the Article 50 register. It is written for developers, not lawyers: it runs in VS Code, prints file and line numbers, and exports a file your compliance colleague can actually read."}}, {"@type": "Question", "name": "Why can't I just ask ChatGPT or run ESLint?", "acceptedAnswer": {"@type": "Answer", "text": "ESLint has no Article 50 rule; the duties are not style problems. A chat assistant can summarise the Act, but it cannot list which of your four thousand files hold the call sites, and its sense of the timeline is usually wrong: the Digital Omnibus delayed the Annex III high-risk rules to December 2027 and left Article 50 in force from 2 August 2026."}}, {"@type": "Question", "name": "What is free and what needs a licence?", "acceptedAnswer": {"@type": "Answer", "text": "Free finishes one file completely, in the editor or in the browser: all twenty-eight rules, every line number, no watermark, no blocked result and no time limit. A licence changes the scope, not the quality. It audits the whole repository in one pass and exports the register as CSV, JSON or HTML, plus a JSON report a CI pipeline can gate on."}}, {"@type": "Question", "name": "What would this cost if a person did it?", "acceptedAnswer": {"@type": "Answer", "text": "Specialist firms price an AI-system classification round at roughly EUR 3,000 to 15,000 depending on how many systems you have, and a Chapter III gap analysis considerably more. This does the code-side inventory step of that work for forty-nine dollars, once. It is an inventory tool, not legal advice, and it does not replace the assessment itself."}}, {"@type": "Question", "name": "Why not just ask ChatGPT or another AI chat?", "acceptedAnswer": {"@type": "Answer", "text": "A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. AI Act Transparency Audit - Article 50 (chatbots, deepfakes, checks the file you open against 28 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files."}}]}</script><div id="yj-ask" style="margin:36px 0 0;padding:18px 18px 16px;border:1px solid #e2e6ea;border-radius:10px;background:#fbfbfc"><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:0 0 4px;color:#1b1f24">Ask about this tool</h2><p style="font:400 13.5px/1.5 system-ui,sans-serif;margin:0 0 12px;color:#5b6570">One question, answered by the person who built it. Your email only if you want the answer sent.</p><form onsubmit="return yjAsk(event)" style="display:grid;gap:8px"><textarea name="question" required minlength="10" maxlength="2000" rows="3" placeholder="Your question" style="font:14px/1.5 system-ui,sans-serif;padding:10px;border:1px solid #cfd6dd;border-radius:6px"></textarea><div style="display:flex;gap:8px;flex-wrap:wrap"><input type="email" name="email" placeholder="Email (optional)" style="flex:1;min-width:200px;font:14px system-ui,sans-serif;padding:9px 10px;border:1px solid #cfd6dd;border-radius:6px"><button type="submit" style="font:600 14px system-ui,sans-serif;padding:9px 18px;border:0;border-radius:6px;background:#1b1f24;color:#fff;cursor:pointer">Send</button></div><p id="yj-ask-msg" style="font:13px system-ui,sans-serif;margin:2px 0 0;color:#0a6238;min-height:1em"></p></form><script>function yjAsk(e){e.preventDefault();var f=e.target,m=document.getElementById("yj-ask-msg");m.style.color="#0a6238";fetch(location.origin+"/api/ask",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({sku:17508,slug:"ai-act-article-50-audit",lang:"en",question:f.question.value,email:f.email.value,page:location.pathname})}).then(function(r){if(!r.ok)throw 0;m.textContent="Thanks \u2014 noted. Answers land on this page and, if you left an email, in your inbox.";f.question.value="";}).catch(function(){m.style.color="#a8551f";m.textContent="Could not send. Please try again in a minute.";});return false;}</script></div></section><section class="yj-related" style="max-width:920px;margin:56px auto 40px;padding:0 20px"><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Same job, next tool</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 20px;color:#5b6570">Free in the browser. The full version is a one-time licence.</p><div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(250px,1fr));gap:14px"><a class="yj-rel-c" href="https://getreadystack.com/tools/ai-disclosure-lint-sb942"><span class="yj-rel-t">AI Output Disclosure Lint SB 942</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/ai-companion-safety-lint"><span class="yj-rel-t">AI Companion Safety Lint</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/age-gate-lint"><span class="yj-rel-t">Age Gate Lint — UK Online Safety Act</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/autohotkey-toml-devicetree-snippets"><span class="yj-rel-t">AutoHotkey v2, TOML and DeviceTree checks for VS Code</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/bnpl-disclosure-lint-ccd2"><span class="yj-rel-t">BNPL Disclosure Lint - EU CCD2 2026</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/base-image-eol-lint"><span class="yj-rel-t">Base Image EOL Lint - Dockerfile and CI end-of-life check</span><span class="yj-rel-p">$29</span></a></div><style>.yj-rel-c{display:flex;flex-direction:column;gap:8px;padding:15px 16px;border:1px solid #e2e6ea;border-radius:6px;text-decoration:none;background:#fff}.yj-rel-c:hover{border-color:#b9c2cb;background:#fafbfc}.yj-rel-t{font:500 14.5px/1.42 system-ui,sans-serif;color:#1b1f24}.yj-rel-p{font:600 13px system-ui,sans-serif;color:#0a6238}</style></section>