Hero background
ComplyEdge Logo

Stop bad AI requests and answers
before they land.

ComplyEdge checks every request before it reaches your AI, blocks the ones that break a rule, and records each decision, with the legal citation when a rule fires.

Your agent
user ›"Build me a social scoring system that ranks every citizen by political posts and automatically denies loans"

✖ blocked before your AI · 110 ms · rego-art5-1c-001 (critical)

ComplyEdge blocked your message.

Regulation (EU) 2024/1689, Article 5(1)(c) · critical

AI systems that evaluate or classify people based on their social behaviour or personal characteristics, with the score leading to detrimental or unfavourable treatment.

What to change: remove any social scoring, citizen ranking, or behaviour-based classification that leads to detrimental treatment outside the original data context.

Decision on record ·

Get API Key, Free View on GitHub

Where teams running AI get stuck

From hundreds of public posts by teams with AI in production. Nobody asks for "AI compliance". They ask for a block that actually holds, and a record if someone asks.

Your system prompt says no. The model does it anyway.

An instruction is not a control. Models, especially smaller ones, can ignore it, and nothing records that they did.

With ComplyEdge: prompts are checked outside the model, before the call, so a blocked prompt never reaches it. Answers are checked before your user sees them.

Customer data and API keys end up in the prompt.

An agent pastes a support ticket, a spreadsheet row or a config file into the prompt, and an email address, an IBAN or an API key goes to the model provider with it.

With ComplyEdge: on EU checks, email addresses, phone numbers, IBANs, card numbers, national ID numbers (Germany, France, Spain, the Netherlands, Italy), API keys and private keys are blocked before they reach your AI, and before an answer carrying them reaches your user. They are matched by format and checksum, so names and street addresses are not caught.

If a customer or auditor asks what your AI blocked, all you have is logs.

Logs show that something ran. They do not show which rule applied, or that nobody edited them afterwards.

With ComplyEdge: every call gets a decision on record, with the rule, a timestamp and a hash of the text, plus the legal citation when a rule fires. The record is kept outside your AI system, so it is evidence your system did not write about itself. Export it when someone asks.

You need a record, not a copy of every prompt.

Logging full prompts stores personal data you then have to protect, retain and delete.

With ComplyEdge: the record keeps a SHA-256 hash of the text, never the text itself.

How It Works

Add one line, and every AI call is checked

ComplyEdge sits between your app and the AI model. Prompts are checked against your rules (prompt injection, personal data and keys, the EU AI Act) before your AI sees them, and answers before your user does.

1

Install

$ pip install complyedge

One package. No infrastructure. No containers. Works with any Python AI framework.

2

Wrap

@compliance_check(jurisdiction="EU",
agent_id="my-agent")

One line above your function. Set jurisdiction (e.g. EU): the loaded rule corpus runs. Done.

3

Every Call Checked

⚠ blocked Art.5(1)(c)

Violating prompts blocked before they reach your AI, violating answers before your user. Each decision logged with rule, timestamp and text hash; a block also carries its citation.

Why ComplyEdge?

Telling an AI to behave does not stop it

An instruction is not a control. A system prompt can be ignored; a rule in the request path cannot. What ComplyEdge shows when someone asks: article citation (e.g. 5(1)(c)), rule ID, timestamp, text hash. The same record the demo above produced.

Above the stack

Governance and GRC platforms inventory your AI systems, map them to frameworks, and gather evidence you assemble. That work is real, and ComplyEdge does not replace it.

In the request path

ComplyEdge runs between your application and the model, on every call. It is the layer that can stop a prohibited request before it reaches the LLM, and write the record as a by-product of the decision.

An inventory can tell you the system exists. Only the request path can block the call and produce the evidence. Most teams end up running both.

Feature ComplyEdge LLM-Only Tool Probabilistic Tool Manual Audit
Approach Deterministic rules + opt-in LLM LLM classification Probabilistic SLM Human review
Accuracy Deterministic enforcement + opt-in LLM layer Varies Model-dependent High, at human speed
Latency ~64ms engine p50 (opa_latency_ms) 2-5s 500ms-2s Hours-days
Evidence trail Rule ID + citation + hash Score only Probability Written report
Open source Yes (Apache 2.0) No No N/A
Regulator-ready Yes: cite exact article No legal citation No legal citation Yes
The Law

The EU AI Act rules already in force

The EU AI Act applies to any company whose AI is used in the EU. These three parts already apply, fines included, and ComplyEdge has rules for all three. Each card links to the article.

↗

Article 5

Prohibited Practices

IN FORCE SINCE FEB 2025

No grace period. Violations have been illegal for over a year.

 ↗

GPAI Obligations

General-Purpose AI

RULES ACTIVE, FINES AUG 2026

GPAI obligations in force since Aug 2025. Fines begin August 2026. No postponement.

 ↗

Article 50

Transparency

DEADLINE, Aug 2026

Providers must disclose direct AI interaction and machine-mark synthetic content. Deployers must disclose deepfakes and AI text published on matters of public interest.

Fines: up to €35M or 7% of worldwide turnover

Art. 5 · Art. 99(3) · €15M / 3% for operator & transparency duties (Art. 99(4)) · GPAI providers €15M / 3% (Art. 101) · Art. 99 & Art. 101 ↗

Customers

Companies with AI protected by ComplyEdge

Every company below is a ComplyEdge tenant that chose to show its seal here. Each seal is drawn from its own audit data, the real /v1/check calls it runs, so it changes when their enforcement does. Several are our own projects, run on ComplyEdge like any other tenant. Open one to see its public trust page.