The EU AI Act, and what a gateway can carry

Two things, and neither is the one most teams were bracing for.

• The Article 50 transparency obligations became binding. People must be told when they are interacting with an AI system, generated output must be marked in a machine-readable way, and certain uses must be disclosed to the people they affect.
• The AI Office gained its enforcement powers over providers of general-purpose AI models. The obligations on those providers themselves had already applied since 2 August 2025; what arrived a year later was the ability to enforce them.

There is one deadline still ahead. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2). That grace period is the nearest live date for most teams reading this page.

The Act splits obligations between the provider of a system and its deployer. If you are building a product on top of models you did not train, you are usually the deployer, and these are yours:

Tell people they are talking to an AI

At the latest at the point of first interaction, clearly and distinguishably. This attaches to your interface, which is the one thing in the chain we never see.

Disclose deepfakes

Image, audio or video that has been generated or manipulated to resemble real people or events must be disclosed as such.

Disclose AI-generated public interest text

Text published to inform the public on matters of public interest must be disclosed as artificially generated, unless it went through human review with someone holding editorial responsibility.

Tell people about emotion and biometric categorisation

Anyone exposed to a system inferring emotion or categorising biometric characteristics must be informed. Note that our Acceptable Use Policy prohibits running these through ModelBeat at all.

None of those can be satisfied by your inference layer, because every one of them is a statement made to your users in your product. What your inference layer can do is make the rest of it evidenceable.

An obligation you cannot evidence is an obligation you cannot demonstrate you met. These are recorded on every request, on every plan, without configuration:

• Which model served each request, by identity, in our own routing record. During the public beta the API response names an intelligence tier rather than the specific model, so today that identity is held by us rather than returned to you with each call.
• Why the router chose it, kept alongside the request metadata rather than derived after the fact.
• Input and output token counts, cost and latency, so a usage record exists per call rather than per month.
• An immutable audit entry for every privileged action, written in the same transaction as the action itself. A failed audit write fails the action.

Our stated retention period for request metadata and routing decisions is 13 months. It is a policy, not yet enforced by a scheduled purge. The audit log is kept seven years and is append-only. Prompt and completion bodies are not persisted at all, which is a constraint on what we can hand you as much as a protection.

Stated plainly, because a vendor implying otherwise is how a deployer ends up unprotected:

• Every disclosure in the section above. They attach to your interface and your editorial process.
• Marking your generated output in a machine-readable form. We do not watermark or mark content, and no gateway can do it for you at the point your product renders it.
• Deciding whether what you are building is high-risk under Annex III, and everything that follows if it is.
• Your own risk assessment, your own record keeping, and your own AI literacy obligations for the people operating the system.

Per-request enforcement flags

Provider eligibility is configurable per workspace, and an ineligible provider is unreachable rather than deprioritised. Per-request and per-key residency and retention flags are on the roadmap and do not exist yet.

EU region

One production region is deployed today, in the United States. Region pinning per workspace exists and is immutable once set. An EU region is designed and not live.

Output marking

We do not mark or watermark generated content. That obligation sits with the model provider and with you.

Certification

Our control set is mapped against the Act and evidenced in our repository. No external auditor has tested it, and we hold no certification of any kind.

It is a description of a regulation as we read it on the date at the top of this page, written to help you work out which questions to take to your own counsel. Our reading is not a substitute for theirs, and where the two differ, theirs governs. Dates and scope have already moved once under the Omnibus agreement and may move again.

If you are working through an assessment and want the underlying documents, the security pack is on the enterprise page, and our current framework position is on the security page.